The threat pattern
This is brand impersonation through attacker-controlled subdomains. In every example below, xyz.com is the registered domain controlled by the third party. Your organization doesn't own the hostname, even though your name appears prominently in it.
| Suspicious hostname | Technique |
|---|---|
mydomain.xyz.com | Brand name used as a subdomain |
mydomain.com.xyz.com | Entire legitimate domain embedded in a hostname |
login-mydomain.xyz.com | Login-themed impersonation |
sso.mydomain.com.xyz.com | Multi-level subdomain impersonation |
Typosquatting monitors watch for newly registered domains that resemble yours. Here the attacker registers nothing that looks like your domain, so the signal lives in hostnames, not registrations. Prioritize passive DNS, hostname intelligence and phishing-page monitoring.
Substitute your own brand string for mydomain and your own registered domain for mydomain.com in every query on this page.
Choose your tools
Combine sources rather than relying on one. urlscan tracks website observations, VirusTotal aggregates security intelligence, and DNSDB identifies hostnames from passive DNS data, even when nobody has submitted the page to a scanner.
| Tool | What it can find | Assessment |
|---|---|---|
| urlscan.io | Brand names embedded in scanned hostnames, phishing pages, screenshots, redirects | Best free starting point |
| VirusTotal Intelligence | Hostnames containing your brand, malicious URLs, detections, infrastructure relationships | Excellent for investigations |
| DomainTools DNSDB | Historical DNS records where your brand appears within any hostname | Best for broad DNS discovery |
| urlscan Pro | Newly observed hostnames, certificates, scans and brand-related monitoring | Strong for continuous monitoring |
| DomainTools Iris Detect | Newly discovered impersonation domains and associated risk signals | Useful for enterprise brand protection |
urlscan.io for immediate searches, DomainTools DNSDB for broad historical discovery, and VirusTotal Intelligence for enrichment and investigation.
urlscan.io: your brand inside unrelated domains
Searches observed webpage hostnames that contain your brand string while excluding pages whose registered domain really is yours.
This is the fastest way to surface live phishing pages that embed your name in a hostname you don't own.
Open urlscan.io Search and run this, substituting your brand and registered domain:
page.domain.keyword:*mydomain* AND NOT page.apexDomain:mydomain.comTo search any hostname contacted during a scan, not just the page itself:
domain.keyword:*mydomain*The *.keyword fields support wildcard and regular-expression matching, but a leading wildcard requires a signed-in account. Scans only cover sites urlscan has observed, so an empty result is not proof that the threat doesn't exist.
VirusTotal Intelligence: hostnames and URLs
Finds domains and submitted URLs whose hostnames contain your brand string.
Surfaces attacker hostnames that already carry phishing detections, historical resolutions or other suspicious relationships.
Search for domains containing the brand string:
entity:domain domain:"*mydomain*"Search for submitted URLs whose hostnames contain your brand:
entity:url hostname:mydomainAdvanced corpus-wide searching generally requires VirusTotal Intelligence access.
DomainTools DNSDB: hostnames no scanner has seen
Searches passive DNS for any hostname containing your brand string, whether or not the page was ever submitted to a scanner.
It is arguably the most relevant dataset for this exact problem, because it catches domains that have never appeared in phishing scanners.
- In DNSDB Scout, open Flexible Search, choose Keyword, and search for your brand string:
mydomain- Review the matching FQDNs and exclude anything under your own registered domain.
- DomainTools added flexible/regex search to the Iris Investigate passive DNS panel in January 2026, including searches for brand names embedded in subdomains.
Typical observations look like these (illustrative examples, not actual detections):
mydomain.attacker-example.com
mydomain.com.attacker-example.net
verify-mydomain.phishing-example.orgCertificate transparency: a useful supplement
Use crt.sh or crtlog to look for TLS certificates containing your brand inside a hostname. For example, an identity search on crt.sh for:
%mydomain%An attacker can use a wildcard certificate for *.xyz.com. In that case the certificate may reveal only *.xyz.com, not the phishing hostname mydomain.xyz.com. Treat certificate searches as a supplement to passive DNS, never a replacement.
Build the monitoring process
For continuous protection, turn the one-off searches into a pipeline:
- Search newly observed hostnames for your company name, your legitimate domain, and common variants.
- Exclude domains your organization legitimately owns or has authorized.
- Flag matches where the actual registered domain belongs to a third party.
- Enrich each finding with DNS history, registration details, reputation, website screenshots and known phishing detections.
- Alert and block: notify your SOC and send confirmed malicious domains to your DNS or web-blocking controls.
Common variants to include alongside your brand string:
For the blocking step, see Block domains with an FQDN address group for the FortiGate CLI that turns a confirmed domain list into a deny policy.
Limits & next steps
No tool sees every attacker-created subdomain. A hostname may not appear in passive DNS, certificate transparency or a scan database until it is observed, so a clean result lowers risk but doesn't prove you're not being impersonated.
- Re-run the urlscan and VirusTotal searches on a schedule, or move to urlscan Pro / Iris Detect for continuous monitoring.
- Cross-check any hit across at least two sources before treating it as confirmed.
- Feed confirmed domains into DNS filtering as well as firewall address objects, since FQDN matching alone can miss DNS-over-HTTPS clients.