# held_lookalike

The hostname looks like a well-known brand's, so it is paused for review before a certificate is issued.

## What it means

Before issuing any certificate we compare the hostname with well-known brands (banks, payment providers, large SaaS logins). This one is close enough that we paused it: the edge refuses the hostname and no certificate is requested. A person reviews every hold within one business day. When it is released the domain returns to the state it was in and you get `domain.released`.

## Why it happens

- The hostname contains a brand name or a near-spelling of one, for example `paypa1-billing.acme.com`.
- The customer genuinely is that brand, or a partner using its name with permission.
- Someone is trying to use your app to host a phishing page on a lookalike domain.

## What to do

1. If the customer is legitimate, nothing: the review releases it and the domain carries on.
2. To speed up a review, contact support with the domain id and who the customer is.
3. If the hold is upheld the domain stays held; delete it to free the hostname slot.

Creating the same hostname again does not skip the review: `POST /v1/domains` answers `422 hostname_held` while a hold is open.

- [Open this domain in the dashboard](/app/domains)
- [See the domain state machine](/docs/concepts/domain-states)

## In the API

```
"status": "held",
"status_reason":
  "held_lookalike",
"status_detail": {
  "category": "bank"
}
```