Hunting Like a Pro: Searches for Similar Domain Names

Axur's Monitoring of Similar Domains comes with a default detection configuration that covers the most common threat patterns. But you can go further; by understanding how each detection type works and when to use it, you can fine-tune your rules to maximize coverage while keeping false positives under control.

This article explains each detection type, its ideal use cases, and the query it generates.

Detects domains that use your exact brand name as the label but register a different top-level domain (TLD).

When to use: Always. This is the base detection and is part of the default monitoring query for all clients.

Query example:

Detects: netflix.cn, netflix.shop, netflix.online, netflix.vip

Detects domains that replace letters with visually similar characters — often from non-Latin alphabets — to impersonate your brand. The system normalizes the domain before matching, so a Cyrillic "п" is treated the same as a Latin "n".

When to use: Always. Recommended alongside TLD-squat. This combination forms the default query for all clients.

Default query (TLD-squat + homoglyphs):

Detects: пetflix.com (Cyrillic п), nеtflix.com (Cyrillic е), and other Unicode substitutions

Catches domains that are one character edit away from your brand name, a swap, deletion, insertion, or transposition of a single letter.

When to use: Brand names longer than 5 characters. For shorter names, the search space becomes too broad and generates a high number of false positives.

Query example:

Detects: netflx.com, netlfix.com, netfliix.com

Finds domains that contain your brand name anywhere, before or after other words, to appear as an official subdomain, login page, or service.

When to use: Brand names longer than 3 characters. Very short names will match an excessive number of unrelated domains.

Query example:

Detects: netflixlogin.com, mynetflix.shop, netflix-support.io

An in-house operator that combines combosquat and typosquat detection in a single pass. It matches domains that contain a typo version of your brand name, either standalone or embedded in a longer string.

When to use: When you want broad coverage of both combosquats and typos together. Inherits the false positive risks of both; only recommended for brand names longer than 5 characters.

Query example:

Detects: netflxlogin.top, netlixsupport.com, mynetflxapp.io

Limits results to domains that have an active MX (mail exchange) DNS record, meaning the domain is configured to send or receive email. This is a strong indicator of active phishing infrastructure.

When to use: When you want to focus on the highest-priority threats. Domains with MX records are far more likely to be used in phishing campaigns than parked or inactive domains.

Can be combined with any of the above:

Beyond dnsRecordMX, you can use other DNS fields in Advanced mode to validate the infrastructure behind a suspicious domain:

Domain can send/receive email

Domain resolves to an IPv4 address

Domain resolves to an IPv6 address

Domain has name servers (actively managed)

Domain is an alias pointing to another host
​

Example — active domains with email and web infrastructure:

When using Simulate in Threat Hunting, enable the Deduplicate by domain option. This collapses multiple hits from the same domain into a single result, giving you a cleaner view of how many unique domains your rule would catch, rather than how many total detections.

The Advanced mode toggle unlocks the query field for manual editing. This is useful when you need combinations that the checkboxes don't cover, for example, filtering by a specific TLD, excluding a known legitimate domain, or adding custom DNS conditions.

If you have any questions, feel free to reach out at [email protected] 😊