7. A system comprising: a memory including instructions; and a processor, connected with the memory, to execute the instructions, the instructions cause the processor to: parse a character string associated with the suspected domain name of the suspected domain to identify a character in the character string that has a known likelihood of being deceptively substituted for a corresponding legitimate character in a legitimate domain name of the legitimate domain generate an alternate domain name from a suspected domain name; submit the alternate domain name to a domain name server for resolution; when the alternate domain name is resolved, assign a first non-zero likelihood that the suspected domain name is a counterfeit of the legitimate domain; retrieve a first webpage associated with the suspected domain name; retrieve a second webpage associated with the alternate domain name; compute similarity between a first webpage associated with the suspected domain name and a second webpage associated with the alternate domain name, wherein the second webpage corresponds to the first web page associated with the suspected domain name; in response to the compute, assign a second non-zero likelihood that the suspected domain name is a counterfeit of the legitimate domain, wherein the second non-zero likelihood is greater than the first non-zero likelihood; determine that the first webpage comprises a request for input of personal information; and in response to the determine, assign a third non-zero likelihood that the suspected domain is a counterfeit of the legitimate domain, wherein the third non-zero likelihood is greater than the second non-zero likelihood.
11. The system of claim 7 further comprising: when the alternate domain name is not resolved, generating, by the processor, one or more another alternate domain names from the suspected domain name and submitting the one or more another alternate domain names to the domain server for resolution.