Why we built this.

A business we ran closed after our email address was spoofed and used in someone else's scheme. We didn't know that was possible until it had already happened.

That's the short version, and it's the honest one. Nobody broke into our systems. Nobody guessed a password. Someone put our name on messages they sent, and by the time we understood what was happening, the damage was done.

The part that stayed with us is how ordinary it was. No alarm, no warning, no moment where software said "this is happening now." Everything we later learned to look for had been sitting in public records the whole time, where anyone could read it, if they knew it was there and what it meant.

What we did about it

We started with the piece that was entirely ours: our own domains. Today, an email that uses our exact address and didn't come from us is rejected before it reaches anyone. That took months of monitoring first: finding every service that legitimately sends mail as us, then tightening in stages, knowing at each step what it could affect.

Then we did the part that costs nothing and helps most: we told people plainly. We only ever email from atxworks.dev. Anything from a name that looks close isn't us. That single sentence, said early, is worth more than most security software, because it moves the decision to the person reading the message.

And we watch. We check our own names regularly, the same way we would for anyone paying us to. That's how we know that atxworks.net exists, is registered to someone else, has mail records and no website. We don't know who owns it. The record is behind a privacy service, so the address on it belongs to that service, not to a person. We won't guess, and we won't sell you a story we can't prove.

What you can control, and what nobody can

This is the honest map. Most of the damage sits in the first column, which is the good news.

• Yours to controlWhether a stranger can send email using your exact address. Whether your customers know which address is really yours, and what you'll never ask them to do. Whether anyone is watching for new imitations. Which look-alike names you own yourself.
• Ours to push onReports to the company that sold a copycat domain and the company hosting it. Most impersonation sites break those companies' own rules and come down within days when the evidence is good. We file with evidence attached and follow up, but no one can promise an outcome they don't decide.
• Nobody's to controlWho registers a name that resembles yours. Who hides behind a privacy service. Whether someone tries again next month. We won't pretend otherwise, and any service that does is selling you a feeling.

So the work is simple, even when the situation isn't: close what closes, tell people what you can't close, and keep looking.

How we work

Four promises, so you know what to expect from us before you ever pay us anything.

• Public records onlyEvery check reads records that are public by design. We never sign in to anything of yours and never ask for a password. The one exception is a managed change, where you give us access to your DNS settings after a signed agreement that says exactly what we'll change.
• We report what an address has, not what its owner isOwnership is hidden on most domains. Putting a guessed name in front of your lawyer or the FBI would do you real harm, so we don't.
• A person reads everything before it's sentWhen our watching finds a look-alike, a human reviews the notice and sends it. Nothing goes out automatically in your name or ours.
• Changes are staged, never flippedSwitching on email enforcement carelessly bounces your own invoices. We ramp it over 60 to 90 days with the reports watched at each step, and we tell you what could still break and how we would catch it.

Why the plan is free

There isn't one, and we would rather say why than let you wonder. A business we ran closed because of exactly this, and the fix was tedious rather than difficult. Watching somebody else close over something that takes an afternoon to understand isn't a business model we want. So the finding, the plan and the tools are free, and they stay free. If the work turns out to be more than you want to carry, we're here and we charge for that. If it doesn't, you owe us nothing and we still hope you tell someone.

Who we're

ATXworks.dev is a small studio in Austin, Texas. We build the tools we need ourselves and then offer them to people who need the same thing. Write to us and a person answers, not a ticket system: hello@copycatcheck.com.

Check your business See exactly what we check