Compare approaches
Free typosquat scanners vs. paid continuous monitoring
A free scanner answers "what exists right now?" and that is genuinely enough for a one-off audit. Paid monitoring answers "what appeared since I last looked, and can I prove when?" — the question that matters once impersonation is an ongoing risk rather than a curiosity.
Free lookalike scanners are common in this category, and they are useful — we run one ourselves. The honest framing is not free-versus-good, it is snapshot-versus-record. A scanner is a point-in-time query you have to remember to repeat; monitoring is a standing subscription to change, with the history that makes a finding usable in an incident report months later. These are the structural differences, not feature-list differences.
Free scanner vs Paid monitoring, side by side
| Aspect | Free scanner | Paid monitoring |
|---|---|---|
| What you get | A list of lookalike domains as they exist at the moment you run it. | A continuously maintained record of what appeared, when, and what changed since. |
| Who initiates | You do — a scanner finds nothing on the days you forget to run it. | The system does — new findings arrive without anyone remembering to look. |
| Detection latency | The gap between your scans, which in practice is however long until you next think about it. | Near-real-time for certificate-based detection; daily for newly registered domains. |
| Evidence over time | Typically none retained — rerun it later and you cannot show what the page looked like before. | Screenshots, DNS and certificate records, and verdicts retained with timestamps you can cite. |
| Audit and reporting | Nothing to hand an auditor, insurer, or regulator. | A dated trail suitable for compliance documentation and incident reports. |
| Cost | Zero. For an occasional check that is the correct price. | A subscription — justified only if the ongoing record is worth something to you. |
When free scanner is the right call
A free scanner is the right tool when you want to know whether you have a problem at all, when you are checking a domain you do not own, or when impersonation is a once-a-year question rather than a standing risk. Do not pay for monitoring before you have looked once.
When paid monitoring is the right call
Paid monitoring earns its cost when a clone going unnoticed for a week would actually hurt — customer-facing logins, payment flows, regulated sectors — or when you need to evidence to a third party that you were watching, not just that you looked once.
Where impersona.io fits
impersona.io deliberately runs both. The free check is a real scan, not a teaser: you see the lookalike domains, their risk level, and registration recency without paying. Continuous monitoring, retained evidence, and the audit trail are the paid part, because those are the parts that cost us money to run every day rather than once.
Frequently asked questions
Is a free typosquat scanner good enough?
For a one-off audit, often yes — and you should run one before paying for anything. It stops being enough when the risk is continuous: a scanner only sees the moment you run it, retains no evidence, and cannot tell you that a domain appeared last Tuesday.
What can free tiers structurally not do?
Persist. The expensive parts of this category are continuous ingestion, rendering pages in a sandbox, and storing evidence over time — so free tiers almost universally limit scan frequency, retain no history, and omit the evidence trail. Those are cost boundaries, not arbitrary ones.
Why does retained evidence matter?
Because impersonating pages disappear. If a clone is taken down before you document it, a later scan shows nothing and you cannot demonstrate the incident happened — which is precisely when an insurer, auditor, or regulator asks.
Do I have to pay to see my results?
No. The free check returns the lookalike domains, their risk level, and how recently they were registered without an account. Continuous monitoring and full evidence are the paid tiers.
Related comparisons
See your own exposure first
Your first brand check is free. It generates roughly 160 permutations of your domain and checks them against live DNS and domain registration data.