Domains & Typosquat Monitoring

Kansyn watches domains two ways at once: it monitors domains you already own for suspicious changes, and it proactively looks for domains attackers might register to impersonate you.

Monitoring your own domains

Once a domain is added and DNS-verified, Kansyn takes periodic snapshots and looks for:

  • New or changed login/credential-entry forms
  • Visual changes (screenshot diffing) against your known-good baseline
  • Suspicious code patterns (credential harvesting, payment skimmers, malicious JS, brand asset theft)

A flagged change becomes an Incident, with an AI-written explanation, confidence score, and severity — not just a raw diff.

Typosquat variant generation

For every monitored domain, Kansyn generates lookalike variants across 24 techniques, grouped into a few families:

  • Character-level: missing/doubled/transposed characters, keyboard-adjacent typos, repeated characters
  • Visual/homograph: ASCII lookalikes (0 for o, 1 for l) and full Unicode homograph attacks (Cyrillic/Greek characters that render identically to Latin ones)
  • Phonetic: sound-alike substitutions (ph→f, ck→k), vowel swaps
  • Word-level: phishing-style prefixes/suffixes (login-, -verify, -secure), combosquatting (brandshop, getbrand)
  • TLD abuse: swapped TLDs (.com → .net) and typo'd TLDs (.com → .con)
  • Bitsquatting: single-bit-flip variants, exploiting hardware memory errors

Real-time detection via Certificate Transparency

Rather than periodically re-checking whether any of those thousands of generated variants got registered, Kansyn listens to the public Certificate Transparency log stream in real time. The moment any domain is registered and gets a TLS certificate issued, it's checked against every org's watched variants — matches surface within moments of registration, not on the next scheduled scan.

What this doesn't cover

Certificate Transparency and typosquat generation both operate on domain registrations. An attacker who never registers a domain at all — for example, hosting a phishing page on a free platform like Google Sites or Notion and driving traffic to it with a paid search ad — is structurally invisible to this pipeline. That specific gap is closed by Ads, which watches the ad itself rather than a domain.