"DMARC does not stop them" should be printed on every email admin's monitor.
On actually doing the lookalike monitoring, since that's where teams tend to stall: dnstwist on a schedule against your own domain is a fine free start. Where it gets thin is homoglyph variants and brand-plus-keyword names like yourbrand-support, which are exactly what BEC crews use for executive impersonation.
If you'd rather not run that yourself, WhoisFreaks Brand Monitoring scans new registrations twice a day for typos, homoglyphs, keyword combos and TLD swaps, and alerts by email or webhook. Disclosure: I work there. There's a one-brand trial on request.
Either way, the output slots nicely into your week-two gateway review as the list behind "domains that look like your own."
"DMARC does not stop them" should be printed on every email admin's monitor.
On actually doing the lookalike monitoring, since that's where teams tend to stall: dnstwist on a schedule against your own domain is a fine free start. Where it gets thin is homoglyph variants and brand-plus-keyword names like
yourbrand-support, which are exactly what BEC crews use for executive impersonation.If you'd rather not run that yourself, WhoisFreaks Brand Monitoring scans new registrations twice a day for typos, homoglyphs, keyword combos and TLD swaps, and alerts by email or webhook. Disclosure: I work there. There's a one-brand trial on request.
Either way, the output slots nicely into your week-two gateway review as the list behind "domains that look like your own."