1. A method comprising: parsing a character string associated with the suspected domain name of the suspected domain to identify a character in the character string that has a known likelihood of being deceptively substituted for a corresponding legitimate character in a legitimate domain name of the legitimate domain wherein the generating comprising substituting the identified character with the corresponding legitimate character generating an alternate domain name from a suspected domain name; submitting the alternate domain name to a domain name server for resolution; when the alternate domain name is resolved, assigning, a first non-zero likelihood that the suspected domain name is a counterfeit of the legitimate domain; retrieving, by the processor, a first webpage associated with the suspected domain name; retrieving, by the processor, a second webpage associated with the alternate domain name corresponding to the first web page associated with the suspected domain name; computing similarity between a first webpage associated with the suspected domain name and a second webpage associated with the alternate domain name, wherein the second webpage corresponds to the first web page associated with the suspected domain name; in response to the computing, assigning, a processor, a second non-zero likelihood that the suspected domain name is a counterfeit of the legitimate domain, wherein the second non-zero likelihood is greater than the first non-zero likelihood: determining that the first webpage comprises a request for input of personal information; and in response to the determining, assigning, by the processor, a third non-zero likelihood that the suspected domain is a counterfeit of the legitimate domain, wherein the third non-zero likelihood is greater than the second non-zero likelihood.
6. The method of claim 1 , further comprising: preventing access to the suspected domain name in response to the assigning the second non-zero likelihood.