We are excited to share that from now on, OnDOMAIN’s lookalike scanning process will include the automatic detection of parked domains. By analysing the screenshot of a given lookalike’s web page, OnDOMAIN will be able to conclude whether the lookalike is a parked domain.

The parked domain indicator will appear in the recently added Classification column as the Parked tag.

Please note that this tag may appear alongside the Asset tag, which would mean that the lookalike in question is a parked domain that also happens to be a potential asset of yours.

The three classification definitions are:

Asset: the lookalike domain is potentially an asset owned by your company.

Abandoned: the lookalike domain is potentially an asset owned by your company but has lacked DNS activity for a long time - it has likely been forgotten. It could still be purchased by a third party.

Parked: this is a domain that has been registered by you but isn’t being actively used or is a domain that has been registered by an external agent.

OnDOMAIN relies on the domains that you add to the Domains page in order to start the lookalike domains discovery process. We’ve now added an optional discovery step that will analyse keywords provided by you in order to reduce the discovery of false positives in the lookalikes Activity table.

The keywords are used to increase the matching criteria of newly detected lookalike domains and reduce the number of false positives, in which lookalike names have (almost) nothing to do with any of your original domains.

By adding these keywords, all English language words which contain the keyword as a substring are added to an exclusion list. These will be used to filter out any matching lookalike domains.

To read more about this feature, read the knowledge base article.

Note: this feature will only work if you added a valid OnDOMAIN API Key to the Settings page.

When classifying a top-level domain as safe, it makes sense to also mark any of its detected subdomains as safe.

With this release, we added a new classification option to enable safe auto-classification for TLDs (Top-Level Domains). If this option is enabled, the following happens:

The new classification option appears as shown in the screenshot below:

With this new option, your Unclassified (previously known as New) tab will be tidier.

Previously, if you classified newly detected lookalikes as Ignored or a Threat, there was no way to declassify them.

From now on, you’ll be able to move any already-classified lookalike back to the Unclassified tab. In order to do so, you may use the new classification option from both the individual actions menu and the bulk actions menu.

The Takedowns tab on the Activity page did not offer a way to cancel an ongoing takedown or delete it completely from the list.

With this new release, we’ve added two new options to manage your takedowns.

If at some point you need to restart a takedown process that you deleted previously, just mark the same domain for takedown and restart the takedown process.

When organisations fail to monitor and secure their subdomains, they become targets for fraudsters to hijack and use to carry out impersonation attacks. Therefore, uncovering and securing them is critical.

As a result, we’ve added a new filter called is subdomain. With this new filter, you'll be able to show or hide lookalike entries that are categorised as subdomains.

Upon releasing the automatic parked domains feature, the Classification column in the Activity table stopped working.

This has now been fixed so you can rely on the sorting capabilities for this particular column to create any filters matching your classification and analysis processes.

When selecting rows in the Activity table, a counter with the total number of selected rows is displayed at the bottom of the table.

We have added the very same counter at the top of the table to save you from scrolling to the bottom.