DoppelLock

DoppelLock finds the lookalike domains most likely to become phishing infrastructure, then uses Name.com to register and redirect the best risk-reduction bundle under a fixed budget.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for DoppelLock

Inspiration

Attackers do not need a company's real domain. They need one character a customer overlooks. Domain search tools help buyers find one name; brand teams have the opposite problem: dozens of near-identical domains can become phishing infrastructure. The hard question is which available threats to remove first with a limited budget.

What it does

DoppelLock verifies that the authenticated Name.com account controls the official domain, generates up to 40 typo, character-substitution, hyphen, credential-lure, and TLD variants, checks their live availability and price, scores their phishing risk, and solves a bounded portfolio optimization problem to maximize risk removed under budget.

The user approves the exact domains and total price. DoppelLock then rechecks availability, registers the approved defensive domains in the Name.com sandbox, adds an auditable ownership TXT record, and redirects both apex and www traffic to the legitimate site.

How we built it

The application is TypeScript and React deployed on Cloudflare Workers. A server-side Name.com adapter connects five product-critical endpoints:

  • GET /core/v1/domains/{domain} verifies control of the official domain.
  • POST /core/v1/domains:checkAvailability supplies availability and pricing in one batch request.
  • POST /core/v1/domains registers only the approved defensive bundle.
  • POST /core/v1/domains/{domain}/url/forwarding creates apex and www redirects.
  • POST /core/v1/domains/{domain}/records adds a _doppellock TXT ownership marker.

Risk scoring is deterministic and explainable. Bundle selection exhaustively evaluates allowed combinations to produce the greatest measurable exposure reduction without exceeding the user's cap.

Challenges we ran into

Registration is irreversible and prices can change between analysis and checkout. We separated scan from protection, require an exact approval phrase, reject premium domains, cap each approval at four registrations, recheck availability immediately before purchase, and enforce the budget again on the server. The public demo uses a safe evidence mode; the live adapter is restricted to Name.com's sandbox and never fabricates a success response.

Accomplishments that we're proud of

DoppelLock is not a thin availability checker. It turns five Name.com capabilities into a coherent defensive workflow with proof of ownership, portfolio optimization, explicit approval, redirects, DNS evidence, and an API activity trail judges can inspect.

What we learned

Registrar primitives become substantially more valuable when they are composed around a decision: not simply which domains exist, but which small set removes the most phishing risk per dollar.

What's next

Scheduled rescans, newly registered lookalike alerts, MX-record risk signals, registrar abuse workflows, team approval policies, and recurring portfolio re-optimization.

Built With

Share this project:

Updates

Submission history