> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor look-alike domains

> Find registered look-alikes of a domain your organization owns, check them for spoofed content and phishing, watch them for changes and request takedowns. What it needs, what it costs and how the steps fit together.

Domain monitoring finds look-alikes of a domain your organization owns. You give it `acme.com`. It generates candidate names, such as typos, swapped or doubled letters, homographs, other top-level domains and added words. It also searches new domain registrations and certificate transparency logs for names that contain your domain. Each candidate that has DNS name servers is registered, and becomes a result.

Each result carries its DNS records, WHOIS data and web server status. When a web server answers, the scan also takes a screenshot and scores the URL. If you attach your brand keywords or logo, it checks the site for them too. You then triage the results, watch the ones that matter and, where your plan allows, request a takedown.

In the dashboard this is **Exposure** → **Lookalike Domains**. The [API reference](https://client-api.leak.center/scalar-docs/#tag/spoofguard) groups these endpoints under the **SpoofGuard** tag, and your plan lists the plan feature under that name too. The API calls a scan an *analysis*.

### How it differs from other searches

| You want to… | Use |
| - | - |
| Find registered look-alikes of `acme.com` and check each one for spoofing | **Domain monitoring** (this page) |
| Search a day of newly registered domains for a brand keyword | [New domain registrations](https://wiki.darknetsearch.com/api/guides/expert-domain-registrations.md) |
| Read the TLS certificates issued for names under a domain | [SSL Transparency Logs](https://wiki.darknetsearch.com/api/guides/expert-ssl-logs.md) |
| Look up a domain in phishing feeds and blocklists | [Phishing references](https://wiki.darknetsearch.com/api/guides/expert-phishing.md) |
| Get a match when `acme.com` shows up in leaks, forums or chats | [Monitors](https://wiki.darknetsearch.com/api/guides/alerts.md) |

[Monitors](https://wiki.darknetsearch.com/api/guides/alerts.md) and their matches are a separate product. Domain monitoring has its own look-alike monitors and look-alike alerts.

### Before you start

* **Your plan includes Domain Monitoring.** Without it, the scan, brand library, look-alike monitor and alert endpoints return `403`.
* **The domain is a registered asset of your organization.** Register it with [`organization_assets_create`](https://client-api.leak.center/scalar-docs/#tag/organization-settings/POST/api/service/organization_assets_create/), with `asset_type` set to `domain`, or in the dashboard under **Manage** → **Assets**. A subdomain such as `shop.acme.com` is scanned only when it is registered as its own asset.
* **Optional: a brand library.** A logo, brand keywords, a word list and a list of trusted domains make the scan check more. You can attach them later. See [Set up a brand library](https://wiki.darknetsearch.com/api/guides/domain-monitoring-brand-library.md).

Everything belongs to your organization, not to a user or a key. Scans, the brand library, look-alike monitors and look-alike alerts are shared by the dashboard and every API key of your organization. A scan started in the dashboard appears in the API, and holds the same slot.

An API key acts only as its own organization. To scan a client's domains, register them as assets of your own organization and scan them with your key. They share your slots. A client workspace that the client signs in to is a separate organization with its own keys. See [Client organizations](https://wiki.darknetsearch.com/api/guides/authentication.md#client-organizations).

### Availability and cost

**Availability:** Domain Monitoring. [Plans and quotas](https://wiki.darknetsearch.com/api/guides/plans-and-quotas) lists what each plan includes. Takedowns and powers of attorney need a second plan feature, Domain takedowns.

**Cost:** no metered allowance. Each distinct domain you scan holds one Monitored Assets slot until you delete its scan. Monitors hold the same slots. Rescans, polling, results, triage, exports and the brand library take no slot. Calls made with your API key count toward the API Calls allowance and the per-second rate limit described in [Rate limits](https://wiki.darknetsearch.com/api/guides/rate-limits.md). Only `2xx` responses count toward the allowance.

Domain monitoring endpoints refuse a call in these ways:

| Status | Body | When |
| - | - | - |
| `403` | `{"detail": "This feature is not included in your plan."}` | Your plan lacks Domain Monitoring. Every scan, brand library, look-alike monitor and alert endpoint checks it. Takedown endpoints check Domain takedowns instead. The same body comes back when your license is not in force. |
| `409` | `{"detail": "You have reached your Monitored Assets limit of 10.", "resource": "monitored_assets", "limit": 10}` | You start a scan while every Monitored Assets slot is in use. See [Monitored Assets slots](#monitored-assets-slots). |

Scans have no metered allowance, so they never return the allowance `429` with `resource` and `period`. Sending a takedown does use an allowance. See [Take down a look-alike domain](https://wiki.darknetsearch.com/api/guides/domain-takedowns.md). [Handle API errors](https://wiki.darknetsearch.com/api/guides/errors.md) lists every error body.

### Monitored Assets slots

Your plan includes a number of Monitored Assets slots. Each distinct domain with a scan holds one slot, whether the scan is running, finished or stopped. Each [monitor](https://wiki.darknetsearch.com/api/guides/alerts.md) holds one slot from the same pool. Starting a scan when every slot is in use returns `409`, and nothing is created:

```json theme={"dark"}
{
  "detail": "You have reached your Monitored Assets limit of 10.",
  "resource": "monitored_assets",
  "limit": 10
}
```

`limit` is your slot count, packs included. Branch on `resource`, not on `detail`.

* **Delete a scan or a monitor to free a slot.** [`analysis_delete`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/DELETE/api/service/analysis_delete/\{analysis_id}/) frees the domain's slot at once. You can scan the domain again later.
* **Rescan instead of starting again.** At the limit, `start_domain_analysis` returns `409` for every domain, including one you already scan. [`analysis_rescan`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/service/analysis_rescan/\{analysis_id}/) needs no free slot.
* **One scan per domain.** Starting a domain that already has a scan reuses that scan. It takes no second slot.

[Plans and quotas](https://wiki.darknetsearch.com/api/guides/plans-and-quotas#capacity-slots) explains how slots and packs work. In the dashboard, **Manage** → **Usage** shows how many slots are in use.

### The workflow

**1. Set up a brand library (optional)**

Upload a logo, and create brand keywords, a word list and trusted domains. Attach them to a scan by ID. → [Set up a brand library](https://wiki.darknetsearch.com/api/guides/domain-monitoring-brand-library.md)

**2. Scan a domain**

Start a scan of a registered domain, poll it until its results settle, read and filter the look-alikes, mark them reviewed, then export them. → [Scan an organization's domain for look-alikes](https://wiki.darknetsearch.com/api/guides/domain-monitoring-scans.md)

**3. Watch look-alikes and read alerts**

Turn on the scan-wide monitors for new look-alikes, put single results under a look-alike monitor, and read look-alike alerts from one inbox. → [Watch look-alike domains and read alerts](https://wiki.darknetsearch.com/api/guides/domain-monitoring-alerts.md)

**4. Request a takedown**

Upload a signed power of attorney, prepare a takedown draft for a look-alike, and send it to the registrar or hosting provider. → [Take down a look-alike domain](https://wiki.darknetsearch.com/api/guides/domain-takedowns.md)

### Errors you will see

The error body depends on where the call was refused:

* **`detail`** when the API refuses the call itself: plan feature (`403`), Monitored Assets slots (`409`), and service failures (`502`, `504`).
* **`details`** when the scanning service refuses it: an unknown scan ID (`404`), a domain it does not accept, or a scan that is still running (`400`).
* **`message`** for the per-second rate limit and the API Calls allowance (`429`), and when the scanning service sends a response the API cannot read (`502`).

The scanning service's own request limit returns `429` with `detail`. Field errors from either source are keyed by field name, for example `{"domain": ["..."]}`. Read the first of `detail`, `details` and `message` that the body contains.

| Status | Body | Meaning |
| - | - | - |
| `404` | `{"details": "Analysis with this ID does not exist."}` | No scan with this ID, or the scan was deleted. |
| `429` | `{"detail": "Request was throttled. Expected available in 1200 seconds."}` | The scanning service's own limit for your organization: 10 scan starts per hour, and 180 other domain monitoring requests per minute. The wait is in the message. The response has no `Retry-After` header. |
| `429` | `{"message": "Rate limit exceeded", ...}` | The per-second rate limit or your API Calls allowance. See [Rate limits](https://wiki.darknetsearch.com/api/guides/rate-limits.md). |
| `502` | `{"detail": "The requested service is temporarily unavailable."}` | The scanning service failed. Retry later. |
| `502` | `{"message": "An unexpected error occurred. Please try again later or contact support."}` | The scanning service sent a response the API could not read. Retry later. |
| `504` | `{"detail": "The requested service timed out."}` | The scanning service did not answer in time. Retry later. |

### Sort lists by date

The scan list, the look-alike monitor list, the look-alike alerts inbox and the takedown list take a `date_sort` parameter. The scanning service reads it the other way round: `date_sort=desc` lists the oldest first, and `date_sort=asc` lists the newest first.

> [!TIP]
>
> Omit `date_sort` to list the newest first. Send `date_sort=desc` only when you want the oldest first.

### Endpoints

Every Domain monitoring endpoint is in the [API reference](https://client-api.leak.center/scalar-docs/#tag/spoofguard). These are the ones each step starts from.

| Action | Endpoint |
| - | - |
| Start a scan | [`POST /api/service/start_domain_analysis/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/service/start_domain_analysis/) |
| Get a scan, its progress and its results | [`GET /api/service/analysis_detail/{analysis_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/service/analysis_detail/\{analysis_id}/) |
| List scans | [`GET /api/service/analysis_list/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/service/analysis_list/) |
| Rescan a domain | [`POST /api/service/analysis_rescan/{analysis_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/service/analysis_rescan/\{analysis_id}/) |
| Delete a scan and free its slot | [`DELETE /api/service/analysis_delete/{analysis_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/DELETE/api/service/analysis_delete/\{analysis_id}/) |
| Upload a logo | [`POST /api/spoofguard/logos/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/logos/) |
| Create a word list | [`POST /api/spoofguard/wordlists/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/wordlists/) |
| Watch discovered domains | [`POST /api/service/create_analysis_monitor/{analysis_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/service/create_analysis_monitor/\{analysis_id}/) |
| Read look-alike alerts | [`GET /api/service/alerts/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/service/alerts/) |
| Create a takedown draft | [`POST /api/spoofguard/takedowns/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/takedowns/) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.