7. A system comprising: a memory including instructions; and a processor, connected with the memory, to execute the instructions, the instructions cause the processor to: parse a character string associated with the suspected domain name of the suspected domain to identify a character in the character string that has a known likelihood of being deceptively substituted for a corresponding legitimate character in a legitimate domain name of the legitimate domain generate an alternate domain name from a suspected domain name; submit the alternate domain name to a domain name server for resolution; when the alternate domain name is resolved, assign a first non-zero likelihood that the suspected domain name is a counterfeit of the legitimate domain; retrieve a first webpage associated with the suspected domain name; retrieve a second webpage associated with the alternate domain name; compute similarity between a first webpage associated with the suspected domain name and a second webpage associated with the alternate domain name, wherein the second webpage corresponds to the first web page associated with the suspected domain name; in response to the compute, assign a second non-zero likelihood that the suspected domain name is a counterfeit of the legitimate domain, wherein the second non-zero likelihood is greater than the first non-zero likelihood; determine that the first webpage comprises a request for input of personal information; and in response to the determine, assign a third non-zero likelihood that the suspected domain is a counterfeit of the legitimate domain, wherein the third non-zero likelihood is greater than the second non-zero likelihood.
7. A system comprising: a memory including instructions; and a processor, connected with the memory, to execute the instructions, the instructions cause the processor to: parse a character string associated with the suspected domain name of the suspected domain to identify a character in the character string that has a known likelihood of being deceptively substituted for a corresponding legitimate character in a legitimate domain name of the legitimate domain generate an alternate domain name from a suspected domain name; submit the alternate domain name to a domain name server for resolution; when the alternate domain name is resolved, assign a first non-zero likelihood that the suspected domain name is a counterfeit of the legitimate domain; retrieve a first webpage associated with the suspected domain name; retrieve a second webpage associated with the alternate domain name; compute similarity between a first webpage associated with the suspected domain name and a second webpage associated with the alternate domain name, wherein the second webpage corresponds to the first web page associated with the suspected domain name; in response to the compute, assign a second non-zero likelihood that the suspected domain name is a counterfeit of the legitimate domain, wherein the second non-zero likelihood is greater than the first non-zero likelihood; determine that the first webpage comprises a request for input of personal information; and in response to the determine, assign a third non-zero likelihood that the suspected domain is a counterfeit of the legitimate domain, wherein the third non-zero likelihood is greater than the second non-zero likelihood. 23. The system of claim 7 wherein the character string is entered into a browser associated with a client in a network environment through one of a manual entry from a keyboard and an automatic entry from a hyperlink.