LookalikeGuardCertificate Transparency brand monitoring
Almost every website now uses HTTPS, and every publicly trusted HTTPS certificate is recorded in public Certificate Transparency (CT) logs. When someone sets up yourbrand-secure-login.com and gets a certificate, the name shows up in those logs, often before the site is used.
Free, no account needed. A scan takes 15 to 60 seconds. You get a shareable result link.
How LookalikeGuard uses CT
- Free scan: searches CT history (via crt.sh) for certificates containing your brand. This finds names we didn't think to generate. A CT-only match containing your brand adds +8; a certificate issued in the last 30 days adds +5.
- Paid monitoring: we run our own connection to the CT log stream and match every new certificate name against your brand and any extra terms you add, then check DNS and the page and alert you by email or webhook.
Limits: CT only shows sites that got a public certificate. A lookalike used only for email, or served over plain HTTP, won't appear, which is why monitoring also re-scans generated lookalikes daily.
Real examples from our scanner
Copied from LookalikeGuard scans of public brands run on 2026-10-18, 2026-10-19 (UTC). Data comes from public DNS, RDAP registration records, certificate logs and a fetch of the page. A score is an automated risk signal, not a finding that anyone is doing something wrong: many lookalikes are defensive registrations, unrelated businesses or parked pages. Results change over time. Names of medium and high results are partly hidden for that reason.
| Brand | Lookalike | Score | Techniques | Top reasons |
|---|---|---|---|---|
| basecamp.com | bas••••pos.app | 100 (high) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +8 Contains your brand name (found in certificate logs) +15 Registered in the last 90 days (61 days ago) +5 TLS certificate issued 0 days ago |
| basecamp.com | basec•••••ammar.com | 93 (high) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +8 Contains your brand name (found in certificate logs) -15 Registered 8 years ago (long-standing) +5 TLS certificate issued 0 days ago |
| basecamp.com | basecamp.digital | 0 (info) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +8 Contains your brand name (found in certificate logs) -15 Registered 12 years ago (long-standing) +5 TLS certificate issued 1 days ago -35 Managed by a corporate brand-protection registrar (e.g. MarkMonitor/CSC), often the brand's own defensive registration |
| allbirds.com | all•••dsa.shop | 100 (high) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +8 Contains your brand name (found in certificate logs) +5 TLS certificate issued 0 days ago +5 Serves a live web page (page title hidden) |
| allbirds.com | allb••••sell.us | 58 (medium) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +8 Contains your brand name (found in certificate logs) +5 TLS certificate issued 0 days ago +5 Serves a live web page (page title hidden) +15 The page prominently shows your brand name |
| allbirds.com | allbirdssk-devbirds.net | 3 (info) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +8 Contains your brand name (found in certificate logs) +5 TLS certificate issued 0 days ago -35 Managed by a corporate brand-protection registrar (e.g. MarkMonitor/CSC), often the brand's own defensive registration |
| gitlab.com | gitlab-dedicated.us | 23 (low) | ct-match, ct-seen | +10 Domain is registered (has DNS) +8 Contains your brand name (found in certificate logs) +5 TLS certificate issued 0 days ago |
| gitlab.com | gitlab-private-pages.org | 18 (info) | ct-match, ct-seen | +10 Domain is registered (has DNS) +8 Contains your brand name (found in certificate logs) -5 Registered 2 years ago +5 TLS certificate issued 0 days ago |
| gitlab.com | gitlab-sbp.page | 8 (info) | ct-match, ct-seen | +10 Domain is registered (has DNS) +8 Contains your brand name (found in certificate logs) -15 Registered 6 years ago (long-standing) +5 TLS certificate issued 0 days ago |
Related: brand impersonation monitoring, API, pricing.
What it does not do
LookalikeGuard is monitoring and early warning. It does not take down domains, send legal notices, or give legal advice. Scores are automated and can be wrong in both directions: a high score is a reason to look, not proof of abuse. Many lookalike domains are parked, owned by unrelated businesses, or registered defensively by the brand itself; you can mark those as yours or dismiss them.