Abstract: Aspects of the disclosure relate to identifying domain name lookalikes. A computing platform may generate a plurality of lookalike domain names for an input domain name. The computing platform may generate, by applying a hash algorithm to the plurality of lookalike domain names, a dictionary index. The computing platform may identify a first domain name. The computing platform may identify, by performing a lookup function in the dictionary index using the first domain name, that the first domain name is a lookalike domain name corresponding to the input domain name. The computing platform may send, to a user device, one or more commands directing the user device to display a user interface that includes the lookalike domain name, which may cause the user device to display the user interface.

Abstract: Aspects of the disclosure relate to dynamic message analysis using machine learning. A computing platform may apply a security scoring process to an endpoint relationship to compute a weighted security score for the endpoint relationship. Subsequently, the computing platform may determine a weighted grade for the endpoint relationship based on the weighted security score for the endpoint relationship. Based on identifying that the weighted grade exceeds a predetermined threshold, the computing platform may tag the endpoint relationship as compromised. Subsequently, the computing platform may monitor an electronic messaging server to detect messages corresponding to the compromised endpoint relationship.