Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Overview
Defend threat intelligence provides two types of domain monitoring. Dark web domain monitoring watches for breach data involving email addresses at a client's domain, available on the Essentials tier. Lookalike domain monitoring detects newly registered domains that impersonate a client's brand — potential phishing infrastructure — and is available on the Complete tier. MSP security analysts use both together to cover both past exposure and future impersonation risk.
Dark Web Domain Monitoring (Essentials)
A domain monitor scans for any email address at the specified domain that appears in breach or paste data. This is the fastest way to cover all users at a client domain without adding each address individually.
Setting Up a Domain Monitor
- Go to Dark Web.
- Click New Monitor and choose Domain.
- Enter the client's domain (for example,
clientcompany.com). - Set notify recipients — typically your security analysts and the client's primary contact.
- Click Save.
The scanner runs twice per day. The first scan returns all historical breach findings for addresses at that domain.
Lookalike Domain Monitoring (Complete Tier)
Lookalike monitoring watches for domains that were recently registered and closely resemble a brand domain you want to protect. Attackers register these to run phishing campaigns and impersonate client communications.
The scanner runs daily. It pulls newly registered domains from WhoisXML, then runs DNS resolution on candidates to check whether they are live. If WhoisXML is not configured, the scanner falls back to DNS-only detection, which will find fewer domains.
Setting Up a Lookalike Monitor
- Go to Lookalike Monitoring.
- Click Add Monitor.
- Enter the brand domain to protect (for example,
clientcompany.com). - Click Save.
Reviewing Lookalike Candidates
Detected candidates appear in the list with:
- The lookalike domain name
- A similarity score
- DNS resolution status (whether the domain is live)
- WhoisXML registration data when available
For each candidate, choose an action:
- Monitor — continue watching the domain for further activity.
- Report — flag it for escalation or client notification.
- Ignore — dismiss the candidate if it is not a threat (for example, a legitimate related domain).
Supply-Chain Domain Monitoring (Complete Tier)
Supply-chain monitoring watches vendor domains for breach activity rather than lookalike registration. See Vulnerability Intel for supply-chain vendor setup details.
FAQ
Will a domain monitor pick up addresses I have not explicitly added? Yes. A domain monitor matches any email address at that domain that appears in breach or paste data — you do not need to enumerate individual users.
The lookalike monitor is returning very few results. Confirm the WhoisXML API key is configured in Settings. Without it, the scanner operates in DNS-only mode and detects a smaller set of lookalike candidates. Full detection requires WhoisXML.
How do I know if a lookalike domain is actively being used for phishing? The DNS resolution status in the findings list shows whether the domain is live. A live, high-similarity domain with recent registration is the highest-risk combination and warrants immediate client notification.