DomainDecoy

DomainDecoy is a web app (with optional Slack/Teams alerts) that monitors for brand impersonation across newly registered domains, DNS changes, and lookalike email infrastructure. It continuously scans zone files and passive DNS for typosquats, homoglyph domains, and suspicious MX/SPF/DKIM setups that indicate phishing readiness. When a risky domain appears, the app generates a concise risk brief: similarity score, hosting/ASN, certificate details, email posture, and recommended next actions (blocklists, DMARC policy tweaks, takedown packet). It also tracks your own brand’s email authentication health and warns when DMARC alignment or BIMI readiness regresses—because weak posture makes impersonation easier. This is an AI + traditional app: AI summarizes evidence, drafts takedown notices, and reduces analyst workload, but the core detection relies on deterministic signals and reputation data.