Plumbline

Find fake copies of your website before your users do.

Plumbline Watch looks for domains that imitate yours, scores each one with the same checks Plumbline uses for links, and alerts your team in Telegram with the evidence and a ready-to-send takedown report.

Open Watch in Telegram See an alert

Send /watch to the bot. A free exposure report for any domain is one message away. Independent project, not affiliated with Telegram or the TON Foundation.

Scan to open the bot

How it works

  1. Prove the domain is yours

    Add your domain in the bot and publish a TXT record or a meta tag. Plumbline suggests brand words from your domain and site title, such as the name an imitator would use.

  2. Watch looks two ways

    It searches public certificate logs for new certificates that contain your brand word, and it checks generated look-alikes of your domain: typos, look-alike letters, hyphens, words like “claim” and “support”, and other suffixes.

  3. Each find is judged

    A safe page fetch reads what the site asks for, and the registry and hosting records say how new it is and who runs it. The result is one of four levels.

  4. Your team gets an alert

    In the group you link, with the evidence and a takedown report for the registrar and the host. You send the reports; Plumbline never contacts anyone for you.

What an alert and its evidence look like

These were produced by Plumbline's own scanner and message code, run on made-up data for a fictional brand (Acme Wallet) and a reserved .example domain. They are examples, not real customers or real findings.

🔴 Active threat · acmewallet-claim.example
▸ The site imitates your brand and asks for a wallet connection, password or recovery phrase. ▸ The page has a field asking for a recovery (seed) phrase or private key. Legitimate sites never need it. ▸ The name combines acmewallet with "claim", "wallet" (acmewallet-claim.example). ▸ The domain was registered 2 days ago.
Status: website is live. Registered 2 days ago via Example Registrar, Inc. Hosted: 93.184.216.34 (AS64500, EXAMPLE-HOSTING, NL) First seen 2026-10-21 19:54 UTC · checked 2026-10-21 21:24 UTC. These are indicators observed from public data. They are not a finding about any person.
  • View evidence
  • Get takedown report
  • Mark legitimate
  • Mute similar
An alert as the team sees it in Telegram. Illustrative: made-up brand and domain, produced by Plumbline's own scanner and message code.
🔴 Evidence: acmewallet-claim.example Active threat · imitates acmewallet.example (Acme Wallet)
Why it was flagged ▸ The site imitates your brand and asks for a wallet connection, password or recovery phrase. ▸ The page has a field asking for a recovery (seed) phrase or private key. Legitimate sites never need it. ▸ The name combines acmewallet with "claim", "wallet" (acmewallet-claim.example). ▸ The domain was registered 2 days ago. ▸ The page prompts you to connect a wallet.
What is there now Status: website is live since 2026-10-21 21:24 UTC Page: https://acmewallet-claim.example/ (HTTP 200) Title: Acme Wallet - Connect wallet The page asks for a recovery phrase, asks to connect a wallet.
Registration and hosting Registered 2026-10-19 21:24 UTC (2 days ago) Registrar: Example Registrar, Inc. Registrar abuse contact: abuse@registrar.example Addresses: 93.184.216.34 Network: AS64500, EXAMPLE-HOSTING, NL Host abuse contact: abuse@host.example
Certificate Issued by Let's Encrypt, logged 2026-10-21 20:26 UTC Valid 2026-10-21 20:24 UTC to 2027-01-18 21:24 UTC Names: acmewallet-claim.example Certificate Transparency id 16056294642
First seen 2026-10-21 19:54 UTC · checked 2026-10-21 21:24 UTC (just now). These are indicators observed from public data. They are not a finding about any person.
The evidence view behind the first button. Illustrative data.
Report to the registrar To: abuse@registrar.example 
Subject: Report: domain showing indicators of brand impersonation (acmewallet-claim.example)

Hello,

I am writing on behalf of Acme Wallet, which operates acmewallet.example. We would like to report a domain registered through your service that shows indicators of imitating our brand.

Domain: acmewallet-claim.example
Status when checked: website is live
Registered: 2026-10-19 21:24 UTC (2 days before this report)
Registrar: Example Registrar, Inc.
First observed by our monitoring: 2026-10-21 19:54 UTC
TLS certificate: issued by Let's Encrypt, valid 2026-10-21 20:24 UTC to 2027-01-18 21:24 UTC, logged 2026-10-21 20:26 UTC (Certificate Transparency id 16056294642)
Hosted at: 93.184.216.34
Network: AS64500, EXAMPLE-HOSTING, NL
Page observed at: https://acmewallet-claim.example/ (HTTP 200)
Checked: 2026-10-21 21:24 UTC

What we observed:
- The site imitates your brand and asks for a wallet connection, password or recovery phrase.
- The page has a field asking for a recovery (seed) phrase or private key. Legitimate sites never need it.
- The name combines acmewallet with "claim", "wallet" (acmewallet-claim.example).
- The domain was registered 2 days ago.
- The page prompts you to connect a wallet.
- The page contains a field asking for a wallet recovery phrase.

We are not able to know who is behind this domain and make no claim about any person. We ask that you review the domain against your abuse and acceptable-use policies and take the action you consider appropriate, for example suspending the domain or its name servers.

Our official website is acmewallet.example. Please reply to this message if you need more information or a different format.

Thank you,
Acme Wallet
A takedown report for the registrar, from the second button. The customer sends it; Plumbline never does. Illustrative data.

Each alert has four buttons: view the evidence, get the takedown reports and the links to public phishing report forms, mark the domain legitimate, or mute look-alikes of the same kind. Only the project owner and its administrators can change things; anyone in the linked group can read.

The four levels

Level What it means What you get
🔴 Active threat Direct evidence of impersonation: the site imitates your brand and asks for a wallet connection, a password or a recovery phrase, or it is on a community phishing blocklist. An alert at once.
🟠 Likely impersonation A live site with a name close to yours and signs of copying: look-alike characters, your title or icon, or a very new domain. An alert.
🟡 Watch The name is registered but no site is served yet, or it shows a parking page. Nothing can be shown to be wrong yet. Listed in /findings. If it later starts serving a site you get an alert.
⚪ Low The name contains your brand word but shows no sign of imitation, for example a fan site, an unrelated business or a page that sends visitors to your own site. Kept on record, not alerted.

A name alone never reaches Active threat. Plumbline reports observations and a level, and never claims to know who is behind a site.

How detection works, and where it falls short

Certificate logs

Almost every HTTPS site needs a certificate, and certificates are published in public logs. Watch searches crt.sh for your brand words about every 15 minutes and processes only certificates it has not seen. crt.sh is a free service that is sometimes slow or unavailable. When it is, the status page and /watchstatus say so, and the look-alike checks keep running.

Generated look-alikes

For each domain Plumbline generates a few hundred likely imitations and asks the DNS whether each one is registered. This finds names that have no certificate yet, such as parked domains, and catches the most common patterns. It is a list of likely names, not every name possible.

What it will not see

  • Imitations with names unrelated to yours, on shared hosting or a hacked site, or reached only through a link in a message.
  • Sites without a certificate whose names are not on the generated list.
  • Pages that show different content to Plumbline's fetch than to a visitor, and content that needs JavaScript to appear. Pages are read without running scripts.
  • Fake Telegram accounts and bots. The public bot checks those one at a time.

Watch is an early-warning tool. It does not guarantee that a copy will be found, found quickly, or removed. False positives happen: a defensive registration, a fan site or a reseller can look like an imitator. That is why every alert shows its reasons and has a “Mark legitimate” button.

What Watch does not do

  • It does not send takedown reports. It writes them in plain, factual language; you read them and send them.
  • It does not name or accuse any person or company.
  • It uses public data only: certificate logs, DNS, registry records, and the sites themselves.
  • It never says a site is safe, and a quiet week is not proof that nothing exists.
  • It does not remove anything. Registrars and hosts decide what to do with a report.

Pricing

Plan Price Includes
Exposure report Free A one-off scan of any domain: how many look-alikes are registered and the worst three. Three a day per person. Full details are part of Watch.
Watch, Telegram Stars 2,000 ★
every 30 days		 One project, up to 3 domains or brands. Continuous monitoring, alerts to a group and individual admins, evidence and takedown reports. Renews every 30 days until you cancel.

Pay with Telegram Stars. Monitoring starts only after the payment is confirmed. If a plan ends you get three days of grace; after that monitoring pauses and your data is kept for 30 days. See the terms for refunds.

Questions

Will it flag things that are not scams?

Sometimes. Look-alikes are judged from the name and what the page does, and a name can resemble yours for harmless reasons. Active threat needs direct evidence; the other levels are indicators. Mark a domain legitimate and it is not reported again.

Do you take the site down?

No. You send the takedown reports to the registrar and the host, and you can use the public report forms that warn browsers. Plumbline never contacts anyone on your behalf, and cannot promise that a report is acted on.

How quickly will I hear about a new copy?

New certificates are searched about every 15 minutes while the certificate service is reachable, so a copy with a certificate is usually reported within the hour. A copy that only exists as a generated look-alike is found when the daily pass reaches it. Neither is a guarantee.

What do you keep?

Your project name, domains, brand words, the chats alerts go to, the findings and the payment records. A project that is not renewed is deleted 30 days after monitoring pauses. Details are in the privacy policy.

Can I monitor Telegram handles and bots?

Watch monitors websites. Telegram handles and bots are checked one at a time by the public Plumbline bot, which looks for impersonating handles.

How do I cancel?

Open /watchstatus and tap Cancel renewal, or cancel in Telegram under Settings, My Stars, Subscriptions. Monitoring continues until the paid period ends.

Who is behind this?

An individual, Joshua Mhone. There is no company behind it, no investors, and no customer list to show; see the trust center for how it is built to be questioned.

Try it first

Send /exposure example.com to the bot, with your own domain, for a free report of registered look-alikes. It takes 10 to 20 minutes, and the bot messages you when it is done.

Open in Telegram