Impersonation usually starts with a domain that reads almost right. A swapped letter, an extra hyphen, a different TLD, a word like "login" or "secure" bolted onto your brand. By the time that name shows up in a phishing report, someone has already received the email.
A permutation check gets you there first. Give it your domain and Efflux generates the plausible variants, resolves them, and tells you which ones exist.
Pay attention to the ones that resolve
Most generated names go nowhere, and that is the useful part: the short list that does resolve is the set of names somebody bothered to register and point somewhere. That is where you look.
From there you can keep going. Scan the host behind the name to see what it is serving, or capture the page to see whether it is a parked placeholder, a redirect to a competitor, or a copy of your sign-in screen.
Catch it while it is still being built
A lookalike domain is often registered and configured days before it is used. Run the check on a schedule and you see the name appear during that window, rather than after the first message goes out.
It is also worth running during a rebrand or a product launch, when the set of names worth impersonating suddenly changes.
Where to go next
Domain Permutations covers the request and how to read the report.