Build a daily digest of brand-matching domains
A newly registered domain can imitate a familiar Australian brand before its owner sends a message. It may use a plausible business name, a misleading extension, or a logo designed to win trust from customers in Sydney, Melbourne, Brisbane, Perth or Adelaide. Early visibility gives defenders time to warn users, report deceptive infrastructure and avoid rushed decisions.
A practical system explains how to build a daily digest of newly registered domains that match your brand name, rather than relying on someone to inspect registration feeds by hand. It should combine reliable discovery, consistent matching, risk evidence and a clear response path. The result is a focused queue for security teams, brand owners and people responsible for email and web filtering.
Define the match before collecting data
Create a protected list containing your exact brand, approved abbreviations, common misspellings and legacy product names. Add country-code combinations such as brand.com.au and brand.au when they are relevant. Exclude generic words that would generate hundreds of false matches.
Set matching levels: exact matches, plausible typos and character substitutions, then broader keyword matches. Store the original Unicode domain and a lowercase ASCII or punycode version. Define how diacritics, hyphens, digits and plurals are treated before the feed is built.
Discover newly registered domains
Poll the relevant registry RDAP service, using the IANA bootstrap to locate authoritative endpoints. Capture the domain, creation event, registrar, nameservers, status values and update timestamp. Respect rate limits, cache responses and avoid aggressive WHOIS polling, which can be incomplete or privacy-restricted.
Combine registration data with Certificate Transparency logs, passive DNS observations and authorised registrar feeds. CT activity can reveal a new site before public DNS is indexed. For candidates with mail records, teams can use bulk domain checks to inspect authentication and trust signals; a dormant domain may have no reputation history yet.
Normalise and enrich each candidate
Convert Unicode names with Punycode, strip accidental whitespace and apply one lowercase canonical form. Remove only duplicate URLs; retain meaningful variants such as hyphens and plural forms. Deduplicate against previous days so a domain remains visible until an owner closes its case.
For each domain, query A, AAAA, MX, TXT and NS records. Check SPF, DKIM and DMARC when mail infrastructure exists, plus registrar privacy, hosting location and certificate dates. Save raw responses with the normalised value; these details support later analysis and prevent a matching rule from silently changing the evidence.
Rank candidates for human review
Use a transparent score rather than treating every name collision as phishing. Weight brand similarity, recency, domain age, DNS and mail configuration, malicious infrastructure links and external reports. Keep registration recency as a prioritisation signal, not proof of abuse.
| Evidence | Meaning | Suggested action |
|---|---|---|
| Exact brand match | Strongest impersonation intent | Review immediately |
| Character substitution or added word | Likely confusion or typo-squatting | Inspect site and email |
| Newly registered with active MX | Potential targeted email campaign | Check authentication and senders |
| No DNS or mail activity | Early or dormant infrastructure | Retain and monitor |
Assign priority after the technical checks. High-priority items should include an exact protected-brand match combined with active hosting or deceptive content. Medium items need enrichment and a named reviewer. Low items stay in a monitored queue until new evidence appears.
Schedule delivery and ownership
Run collection and scoring daily through a small service such as cron, GitHub Actions or a cloud scheduler. Store timestamps in UTC, then render each office’s local time. A 07:00 Sydney launch reaches Perth and Adelaide earlier; Brisbane shares Sydney’s offset, while Melbourne follows the same daylight-saving changes.
Send a concise digest with the domain, first seen, matching reason, DNS summary, evidence links and risk priority. Email it to the security alias and post high-priority alerts to the incident channel. Use the API to push high-priority candidates into the case system instead of copying them between tools. Avoid exposing personal data from privacy-protected registration records; route each item to a named analyst with an owner and review-by time.
Record collection failures, rate-limit responses and duplicate counts. A missed feed can create a dangerous blind spot, while health monitoring keeps partial results labelled instead of presenting incomplete coverage as a clean scan.
Apply Australian response procedures
Check Australian context without assuming the registrant is local. .au eligibility rules, .com.au registry data and local user expectations can affect risk, but registration alone does not establish malicious intent. Compare names with IP Australia trade mark records, preserve neutral evidence, and avoid public accusations until misuse is verified.
Before blocking an email source, apply the platform’s sender reputation guidance and inspect the actual message, authentication results and reporting history. Confirmed phishing can be reported to the registrar or hosting provider and through ACSC ReportAssist. For .au namespaces, use the relevant registry or registrar abuse process; for consumer harm, preserve messages, headers, receipts and URLs.
Audit, tune and document the process
Review false positives and confirmed impersonators every month. Track detection lead time, review age, escalation rate and the proportion of domains acquired before an active site or mail campaign appears. Feed confirmed outcomes back into matching weights, but keep material scoring changes under version control.
Document data sources, retention periods, access controls and who can block a domain or initiate a takedown. The platform background identifies the service operated by Zulu Labs Inc.; internal procedures should still require human verification and preserve an audit trail. Holiday campaigns, marketplace impersonation and domains targeting Australian customer service teams expose different gaps, which recorded tests make visible.