Mimicwatch

Lookalike-domain alerts for small businesses

Someone can register yourbrnad.com tonight. Find out before your customers do.

Domains like yourbrand-billing.com are used to send fake invoices and copy login pages. Mimicwatch spots them in public records, tells you which ones matter, and hands you the report to get them taken down.

Get a free check See a sample alert

Report within 2 business days. No card, nothing to install.

check: northwind.exampleScanning
  • northwind-invoices.exampleHighMail server, copied login page
  • nortwind.exampleHighMail server, new certificate
  • northwind-support.exampleMediumLive site, no mail yet
  • northwind.shop.exampleLowParked, for sale
  • northwlnd.exampleLowRegistered, no website
Illustration with fictional domains.

Spot the difference

Your customers won't either

Five common ways a domain gets copied. Each takes a scammer a few minutes and a few euros.

Typoyourbrnad.com
Lookalike charactery0urbrand.com
Doubled letteryourbrandd.com
Added wordyourbrand-billing.com
Other endingyourbrand.co

The usual story

How small companies usually find out

A customer forwards a strange invoice

It came from a domain one letter away from yours, with new bank details.

A supplier asks why your details changed

Someone wrote to them from yourbrand-billing.com, using your name and logo.

Staff log in to a copy of your portal

The page looks right. The address is not. Passwords are gone.

Brand-protection services are priced for large companies. Free scanners return long lists of harmless matches and stop there. Mimicwatch sits in between: a short list of what matters, and what to do about it.

How it works

Four steps, none of them on your side

  1. You send us your domain. Nothing to install, no access to your systems.
  2. We watch public records. New TLS certificates in certificate transparency logs, plus spelling variants of your name checked in public DNS.
  3. A person checks every hit. Live website? Mail server? What does the page show? Parked and unrelated domains are filtered out.
  4. You hear only when it matters. Within one business day of us finding it, with a takedown pack you can send as is.

The alert

Short, specific, ready to act on

You see what was found, why it matters, and exactly who to write to.

  • Screenshot and DNS evidence
  • A clear High, Medium or Low risk level
  • Registrar and hosting abuse contacts
  • A pre-written report you can send as is

Curious how takedowns work? Read our guide to reporting a lookalike domain.

New lookalike foundSample alert, fictional domains
High
Your brand
northwind.example
Lookalike
northwind-invoices.example
First seen
TLS certificate issued 3 October, found in the public certificate log
Why it matters
Has a mail server and a page that copies your login screen.
Evidence
Screenshot of the public page, DNS records, certificate details
Takedown pack
Registrar and hosting abuse addresses, links to report to Google Safe Browsing and Microsoft, and a pre-written report with the evidence attached

Pricing

Start free. Keep watching for €9.

For businesses. One brand, one price. Cancel any time.

Free check

€0

One-time report

  • Lookalike domains that exist today
  • Which ones have a live website or mail server
  • Report within 2 business days
Request a free check
Recommended

Monitoring

€9 / month, per brand, for businesses

Or €90 per year (two months free)

  • Public records checked every business day
  • Each hit reviewed by a person before you hear about it
  • Alert with screenshot, risk level and takedown pack
  • Cancel any time
Subscribe monthly Or pay yearly (€90). By subscribing you agree to our Terms. Payment by Stripe. Checkout asks for the domain to watch. To cancel, email hello@mimicwatch.com. Full refund within 14 days.

IT providers and web agencies: €6 per brand per month from 5 brands, billed to you. Ask about the partner plan.

Who runs Mimicwatch

A small independent business

Mimicwatch is run by Ilan, a sole proprietor in Switzerland. Every finding is checked by a person before an alert goes out, never sent straight from a script, and you can write directly to hello@mimicwatch.com.

FAQ

Questions

Where does the data come from?

Only public sources: certificate transparency logs (for example crt.sh), public DNS and public registration data (RDAP/WHOIS). We may take a screenshot of a page anyone can open. We never log in anywhere, never test or attack a domain, and never contact the people behind it.

Do you take the sites down for me?

No. Registrars and hosts expect the brand owner to report. We prepare everything: who to write to, what to say, and the evidence. Sending it usually takes a few minutes. Our guide to reporting a lookalike domain shows the steps.

Is it real-time?

Not yet. Right now a person reviews each finding, so alerts arrive within one business day of us finding the domain. That keeps false alarms low. We will automate more of the watching as we grow, and we will say so here when it changes.

Will I get flooded with alerts?

No. Parked pages, unrelated businesses with similar names and domains with no website or mail are filtered out. If nothing worth your time turns up, you hear nothing.

What counts as one brand?

One main domain and its name. If you run several shops or brands, each one is a separate brand.

Can you guarantee nobody will imitate us?

No one can. We can make sure you find out early and know what to do about it.

What do you do with my domain and email?

We use them only to run your checks and send your alerts. We do not sell or share them. Details are in the privacy notice.

See what already exists for your domain

Send us the domain. You get a plain list of what is out there today, and what, if anything, needs your attention.

Get a free check