How Fake Domain Detection Works: DNS, CT Logs, and Web Crawlers

Most brand teams find out about a lookalike domain the worst possible way: a customer emails to say they bought from what they thought was your website and never received their order. By that point the fake site has been live for weeks, collecting payments and eroding trust in your name.

The question is not whether lookalike domains get registered against your brand. They do. The real question is how fast you find them.

Detection speed is everything. A domain registered today can have a functioning fake storefront live within hours. Waiting for customers to report it is not a strategy. What works is monitoring the infrastructure that fraudsters have to use the moment they register a domain, before the site is even built.

This article breaks down the four technical signals that make early fake domain detection possible, and why combining them is the only approach that reliably catches the full range of threats.

Newly Registered Domain Feeds: The Earliest Warning Signal

Every domain registration flows through a global system of accredited registrars, and that data does not stay private. Zone files and newly registered domain (NRD) feeds publish a daily record of every domain that has just been added to the internet. For brand protection purposes, this is the closest thing to a real-time alert.

The monitoring process works like this:

• NRD feeds are ingested continuously, covering hundreds of thousands of new registrations per day
• Each domain is scored against a brand's known identifiers: trading name, product names, common misspellings, and TLD variations
• Domains above a similarity threshold are flagged for review
• High-confidence matches trigger immediate investigation; borderline cases go to human validation

The critical advantage is timing. A domain in an NRD feed has typically been registered within the last 24 to 48 hours. The fraudster has not yet built the site, run ads, or collected a single victim. That window is when enforcement is cheapest and fastest.

The limitation of NRD feeds alone is coverage. Not every registrar publishes zone data on the same schedule, and some ccTLDs have restricted or delayed feeds. That is where the other signals become essential.

Certificate Transparency Logs: Catching Domains the Moment They Go HTTPS

Any website that wants to appear legitimate needs an SSL/TLS certificate. Without one, modern browsers display a security warning that instantly undermines a fake shop's credibility. To obtain a certificate, the site operator must request it from a Certificate Authority (CA), and every certificate issued is logged in publicly accessible Certificate Transparency (CT) logs.

Why CT Logs Matter for Fake Domain Detection

When a fraudster acquires an SSL certificate for a lookalike domain, that action is recorded in a CT log within minutes. The log entry contains:

• The exact domain name, including any subdomains
• The issuing Certificate Authority
• The date and time of issuance
• The certificate's validity period

Monitoring CT logs in near real-time means a brand protection system can detect a fake domain the moment the operator tries to make it look trustworthy. This is particularly valuable for catching domains that slipped through NRD feeds due to registrar delays or ccTLD gaps.

CT logs also surface subdomain-level abuse. A fraudster might register a generic domain and create a subdomain such as “yourbrand.fakesite.com”. NRD feeds would not flag the root domain as a brand match, but CT log monitoring catches the subdomain the moment its certificate is issued.

For brands operating across multiple markets, fake sites targeting customers in Germany, France, or the UK often use local ccTLDs with less transparent registration data. CT logs cut through that gap.

Passive DNS: Reading the Historical Record

Passive DNS is the accumulated record of how domain names have resolved over time. DNS queries and responses are silently recorded by passive DNS collectors, building a historical dataset that shows which IP addresses a domain has pointed to, when it changed, and what other domains shared the same infrastructure.

What Passive DNS Reveals

• Infrastructure clustering: Multiple fake domains often resolve to the same IP address or hosting provider. Once one is identified, passive DNS can surface the entire cluster run by the same actor.
• Historical activity: A domain that appears dormant now may show previous activity on known fraud hosting providers, a strong risk signal even when the site is currently blank.
• Domain age vs. registration date: Fraudsters sometimes re-register expired domains to appear more legitimate. Passive DNS exposes this by showing the full resolution history, not just the current registration date.
• Shared hosting patterns: When lookalike domains share nameservers or hosting infrastructure, passive DNS connects those dots so enforcement can target the underlying operation rather than individual domains one at a time.

If you want to understand the full scope of lookalike domains already live against your brand, the domain portfolio audit process goes deeper into how that historical sweep works in practice.

Web Crawling and Visual Similarity: Confirming What the Domain Is Actually Doing

DNS signals and certificate data tell you a suspicious domain exists. Web crawling and visual similarity analysis tell you what it is actually doing with your brand. Once a domain is flagged, automated crawlers visit the live site and collect its content: page structure, text, images, logos, product listings, and layout. That content is then analysed against the brand's known visual and textual identity.

How Visual Similarity Analysis Works

Modern brand protection crawlers use image recognition to compare:

• Logo placement and styling against the brand's official assets
• Colour schemes and page layout patterns
• Product imagery, including cases where the fraudster has lifted photos directly from the brand's own site
• Checkout and payment page design, which fake shops often clone wholesale

This is where intent becomes provable. A domain that scores highly on name similarity alone might be a legitimate reseller or a coincidence. A domain that scores highly on name similarity and replicates the brand's visual identity, product catalogue, and checkout flow is almost certainly operating fraudulently.

Remove.tech's brand protection platform combines bot-powered search with advanced image recognition to identify these cases automatically, 24 hours a day. Confident matches escalate immediately; borderline cases route to human review before any enforcement action is taken. That two-stage process keeps takedown accuracy high and avoids targeting legitimate sites by mistake.

For context on the broader range of domain abuse tactics, the guide to typosquatting and domain fraud covers the techniques brands most commonly encounter.

Why No Single Signal Is Enough

Each signal has a genuine blind spot. Fraudsters adapt to whichever monitoring approach they think brands are using.

Here is what each misses on its own:

• NRD feeds alone miss domains registered weeks before activation, re-registered expired domains, and ccTLDs with delayed zone file access
• CT logs alone miss domains using HTTP only, or those set up to redirect rather than host content directly
• Passive DNS alone is retrospective. It tells you what a domain has done, not what it is doing right now
• Web crawling alone only finds domains that are already live. A domain parked and waiting for a seasonal campaign will not appear until it is activated

The combined approach is where detection becomes reliable. NRD feeds catch new registrations within hours. CT logs catch the moment a site goes HTTPS. Passive DNS surfaces historical patterns and infrastructure clusters. Web crawling confirms content and intent. Each signal fills the gap left by the others.

Remove.tech's brand protection platform combines domain monitoring, search engine scanning, and image recognition, 24 hours a day across search engines, domain registrars, and the open web. Results are validated before escalating, so enforcement actions are based on confirmed evidence rather than pattern matches alone.

What Good Detection Looks Like in Practice

Understanding the signals is useful. Knowing what a well-functioning detection programme actually produces is more useful still. When all four layers run together, a brand protection team should expect:

• Same-day alerts on newly registered lookalike domains, before any content is live
• Near-instant notification when a suspicious domain acquires an SSL certificate
• Infrastructure reports grouping related fake domains by shared hosting, nameservers, or registrant data
• Confirmed infringement cases where visual and content analysis has already validated the threat before it reaches the brand team's desk
• Ongoing monitoring after takedown, to catch the same operator registering replacement domains

The hidden costs of lookalike domains go well beyond the obvious fraud cases. Lost organic traffic, fake paid ads using your brand name, and eroded customer trust all compound when fake domains go undetected.

If you are not certain how many lookalike domains are currently live against your brand, a free brand audit from Remove.tech is a practical starting point.

FAQ

What is a newly registered domain feed?

A newly registered domain (NRD) feed is a continuously updated list of domains just added to the internet. Brand protection systems monitor these feeds to identify lookalike domains within hours of registration, before any fake site is live.

Can a fake domain be detected before it has any content?

Yes. NRD feeds and CT log monitoring both operate independently of whether a site has content. A domain can be flagged the moment it is registered or the moment it acquires an SSL certificate, even if the fraudster has not yet built the site.

What are certificate transparency logs?

Certificate transparency logs are publicly accessible records of every SSL/TLS certificate issued by accredited Certificate Authorities. Monitoring CT logs allows brand protection systems to detect fake domains the moment they go HTTPS, often within minutes of the certificate being issued.

What is passive DNS and how is it different from standard DNS monitoring?

Standard DNS monitoring checks how a domain resolves right now. Passive DNS is a historical record of how domains have resolved over time, which IP addresses they pointed to, and what infrastructure they shared with other domains. For brand protection, this is useful for identifying clusters of related fake domains and spotting re-registered expired domains.

Why combine multiple detection signals rather than relying on one?

Each signal has a specific blind spot. NRD feeds miss delayed zone files and re-registered domains. CT logs miss sites without SSL certificates. Passive DNS is retrospective. Web crawling only finds live, active sites. Running all four simultaneously ensures threats caught by one signal are not missed by another.

How does Remove.tech detect and act on fake domains?

Remove.tech's brand protection platform monitors domain registrars, search engines, and the open web 24 hours a day. The system uses bot-powered search and advanced image recognition to identify potential infringements, validates results before taking action, and files takedown notices automatically once a case is confirmed. Borderline cases are reviewed before enforcement to maintain accuracy and avoid false positives.

‍