Subdomain and Phishing Detection

Overview

Fencer runs three complementary discovery processes for every verified domain: subdomain discovery expands your known attack surface, lookalike-domain detection identifies registered domains that attackers could use for phishing or brand impersonation, and registration (WHOIS) lookups track your domain’s registrar, expiry, and transfer protection. Together these give you visibility into both the legitimate perimeter you need to protect and the fraudulent infrastructure that may be targeting your users.

Subdomain Discovery

How subdomains are discovered

Fencer discovers subdomains passively, without sending traffic to your servers:

• Public sources — certificate transparency logs, DNS aggregators, and other passive DNS sources.
• Connected integrations — hostnames found in your connected cloud accounts, including DNS zone records from Cloudflare, AWS Route 53, and DigitalOcean.

Fencer then resolves each candidate in DNS and keeps the ones that resolve. Names that only match a wildcard DNS record, and hosts that point at domain-parking services, are filtered out. A candidate that stops appearing is removed after it has been missing for several consecutive discovery runs.

Reviewing subdomain results

Subdomains appear on the DNS Records tab of the domain detail page. Filter by Position and choose Subdomain to see only records below the apex. For each record you can see:

• Name — the full hostname.
• Type and Value — the record type (A, AAAA, CNAME, and so on) and what it points to.
• IP Owner — the network that owns the IP address the record resolves to.

The domain list on Posture > Domains also shows each domain’s subdomain count in the Subdomains column.

A large or unexpected subdomain count can indicate shadow IT, forgotten services, or misconfigured wildcard DNS entries. Review subdomains regularly to confirm each one is expected and properly secured.

Phishing and Lookalike Domain Detection

How lookalike detection works

Fencer generates domain permutations based on your domain — variations using typosquatting, character substitution, homoglyphs, and similar techniques — and then checks which permutations are actually registered and resolving (with A, AAAA, or MX records). For each registered lookalike it records the IP addresses, mail servers, registrar, registration date, hosting network, and a screenshot compared against your own site.

Each lookalike gets a status, which Fencer sets initially and you can change:

• Safe — set automatically when the domain is registered through a brand-protection registrar.
• Suspicious — set automatically when the domain only has mail records, when its screenshot is at least 60% similar to your site, or when it was registered after your domain.
• New — every other registered lookalike.
• Malicious — set by you after investigating.

Lookalikes that are not Safe and do not redirect to your real domain create vulnerabilities on your domain: High for Malicious, Medium for Suspicious, and Low for New.

Owned domain exclusions

Fencer automatically excludes any domains you have added to your organization from lookalike results. This prevents your own related properties from appearing as false positives. The exclusion is bidirectional: adding a new domain to your organization also auto-ignores any existing lookalike vulnerabilities that match that domain name.

Caution

If a legitimate domain appears in your lookalike results, add it to your organization or mark it Safe rather than ignoring individual vulnerabilities manually.

Investigating lookalike domains

1. Open the domain detail page and select the Lookalike Domains tab (shown when any are found).
2. Each row shows the lookalike Domain, the permutation Type, its Status, a Screenshot / Match score, IP Addresses, MX, Registrar, and Created date. Filter by status, registrar, network, whether it redirects to your real domain, or whether it has a screenshot.
3. Click a lookalike to open its details. Signals such as Visual impersonation, Mail capable, and Redirects to your domain summarize the risk.
4. Set its Status to Safe, Suspicious, or Malicious once you have investigated. Changing the status requires the assets:edit permission.
5. For actively malicious domains, click Report to report the domain to its registrar, and notify your relevant abuse contacts.

WHOIS Monitoring

What WHOIS tracks

For each verified domain, Fencer looks up the domain’s registration data. When it is available, the WHOIS tab shows:

• Registrar — the organization that manages the domain registration.
• Domain Expiry — when the domain registration expires, with the number of days remaining so you can plan renewals proactively.
• Transfer Protection — whether a registrar transfer lock is Enabled or Disabled.
• EPP Status Codes — the registry status codes on the domain (for example clientTransferProhibited).

Without transfer protection, an attacker could transfer the domain to another registrar, so enable the lock with your registrar.

Monitoring expiry

The days remaining turn amber within 90 days of expiry and red within 30 days, and the domain’s overview shows when the registration expires. An expired domain can be registered by anyone, potentially leading to loss of email delivery, service outages, or domain hijacking.

Note

Registration data accuracy depends on the registrar’s public disclosure policy. Some registrars use privacy protection services that redact registrant contact information. Fencer still captures the dates and registrar name from these redacted records.

Examples

Reviewing subdomains after a scan:

1. Open the domain detail page for example.com and select the DNS Records tab.
2. Filter by Position > Subdomain. The list includes api.example.com, mail.example.com, and staging.example.com.
3. staging.example.com appears unexpected — investigate by checking whether it is listed in your asset inventory and whether it is protected by authentication.

Investigating a lookalike domain:

1. The Lookalike Domains tab shows examp1e.com as a registered lookalike with status Suspicious and a high screenshot match.
2. Open it to check the registrar, registration date, hosting network, and screenshot.
3. If it is serving a fraudulent login page, set its status to Malicious, click Report, and notify your anti-phishing contacts.

Monitoring WHOIS expiry:

1. On the WHOIS tab, example.com shows an expiry date with 18 days remaining in red.
2. Log in to your domain registrar and renew the domain registration immediately.
3. Run a manual scan after renewal to confirm the updated expiry date is reflected.

Troubleshooting

• No subdomains found — discovery relies on public data sources and your connected integrations. If your domain is new or has very few public records, few results are expected.
• Lookalike results include your own domains — add those domains to your Fencer organization. This automatically excludes them from lookalike results.
• WHOIS shows no expiry date — some TLDs or registrars do not expose expiry dates publicly. Contact your registrar directly to confirm renewal status.

Related pages

• Domain Attack Surface
• SSL/TLS and Email Security
• Vulnerability Management