Skip to content
Back to Blog
DMARC.WS Team··8 min read

Lookalike Domains: How Attackers Impersonate Your Brand and How to Detect Them

SecurityPhishingDomain MonitoringBrand Protection

What Are Lookalike Domains?

Lookalike domains (also called typosquat domains or cousin domains) are domain names that closely resemble a legitimate domain. They're designed to trick people into thinking they're interacting with a trusted brand.

Examples for example.com:

  • examp1e.com (letter "l" replaced with number "1")
  • exarnple.com ("m" replaced with "rn")
  • example-login.com (added word)
  • exmple.com (missing letter)
  • examlpe.com (swapped letters)
  • éxample.com (Unicode/IDN homograph)

These domains are used in phishing campaigns, business email compromise (BEC), credential harvesting, and brand abuse.

How Lookalike Domains Are Used

Phishing Emails

An attacker registers examp1e.com, sets up a mail server, and sends emails from security@examp1e.com to your customers. The email warns about a "security incident" and links to a credential harvesting page.

Because the domain is legitimately owned by the attacker, the email passes SPF, DKIM, and DMARC for examp1e.com. Your DMARC policy on example.com can't help — the attacker isn't spoofing your domain, they're using their own lookalike.

Business Email Compromise

An attacker studies your organization and registers a lookalike of your CEO's email domain. They email the finance team from ceo@examp1e.com requesting an urgent wire transfer. The domain looks close enough that busy employees don't notice the difference.

Fake Websites

The attacker hosts a clone of your login page at https://login.examp1e.com. Phishing emails link to this page, where victims enter their real credentials.

Customer Confusion

Even without malicious intent, lookalike domains can be registered by cybersquatters hoping to profit from your brand's traffic, or by competitors trying to intercept your customers.

Types of Lookalike Techniques

Character Substitution

Replacing characters with similar-looking ones:

  • 0 for o, 1 for l, vv for w
  • rn for m, cl for d

Character Addition/Removal

  • Adding characters: examplee.com, eexample.com
  • Removing characters: exampe.com, exmple.com

Character Transposition

Swapping adjacent characters: exapmle.com, examlpe.com

Homograph Attacks (IDN)

Using Unicode characters that look identical to ASCII:

  • Cyrillic а (U+0430) looks like Latin a (U+0061)
  • Cyrillic е (U+0435) looks like Latin e (U+0065)

Modern browsers and email clients have IDN homograph protections, but they're not foolproof.

Word Addition

Adding common words:

  • example-support.com
  • example-login.com
  • myexample.com
  • example-secure.com

TLD Variations

Using different top-level domains:

  • example.net, example.org, example.co
  • example.io, example.app
  • Country codes: example.com.br, example.co.uk

Detection Strategies

Automated Monitoring

The most effective approach is automated scanning that regularly checks for newly registered lookalike domains. These tools:

  1. Generate permutations of your domain using known attack techniques
  2. Check whether each permutation is registered
  3. Resolve DNS to see if the domain has active infrastructure
  4. Check for MX records (email capability)
  5. Alert you when new lookalikes appear

DNS Monitoring

Track new domain registrations that match patterns related to your brand. Certificate Transparency (CT) logs can also reveal lookalike domains that have obtained TLS certificates.

DMARC Reports as an Early Warning

While DMARC can't prevent lookalike domain attacks (the attacker uses their own domain), your DMARC reports can sometimes reveal them. If attackers test by spoofing your actual domain before switching to a lookalike, you'll see the attempts in your failure reports.

Brand Monitoring Services

Commercial services monitor domain registrations, social media, app stores, and the web for brand impersonation. These go beyond simple domain permutation checking.

What to Do When You Find a Lookalike

1. Assess the Threat

Not every registered lookalike is malicious. Some are parked, some are legitimate businesses with similar names. Check:

  • Does it have active DNS records?
  • Does it have MX records (can it send email)?
  • Does it host a website? If so, is it impersonating your brand?
  • Was it recently registered? (WHOIS data)

2. Document Everything

Screenshot the domain's website (if any), record DNS configuration, save WHOIS data, and note the registrar. This documentation supports takedown requests and legal action.

3. Request Takedown

  • Registrar abuse complaint: Most registrars have abuse reporting procedures. File a complaint citing trademark infringement and/or phishing.
  • UDRP (Uniform Domain-Name Dispute-Resolution Policy): A formal arbitration process for trademark-related domain disputes. Costs ~$1,500 and takes 2–3 months.
  • Legal action: For persistent or high-impact cases, consult legal counsel about cease-and-desist letters or court orders.

4. Block and Warn

  • Add the domain to your organization's email blocklist
  • Warn employees about the lookalike, especially if BEC is suspected
  • If customers are being targeted, consider a security advisory

5. Defensive Registration

Register obvious typos and common TLD variations of your domain. This is cheaper than fighting takedowns after the fact. At minimum, register:

  • Common misspellings
  • Popular TLD alternatives (.net, .org, .co, .io)
  • With and without hyphens

Prevention Best Practices

For Your Organization

  1. Register defensive domains: Buy obvious lookalikes before attackers do
  2. Monitor continuously: Set up automated scanning for new lookalikes
  3. Train employees: Teach staff to verify sender domains carefully, especially for financial requests
  4. Implement DMARC at reject: While it doesn't stop lookalikes, it stops spoofing of your actual domain, forcing attackers to use lookalikes (which are easier to detect)

For Your Customers

  1. Communicate official domains: Tell customers exactly which domains your emails come from
  2. Use BIMI: Display your brand logo in authenticated emails so the absence is noticeable
  3. Security page: Maintain a page listing your official domains and how to report suspicious emails
  4. Don't use lookalike-prone patterns: Avoid using multiple similar domains yourself, as it trains customers to accept domain variations

Summary

Lookalike domains are a growing threat that DMARC alone can't solve. DMARC protects your exact domain from spoofing, but attackers can register similar-looking domains and send fully authenticated email from them.

The defense is layered: defensive domain registration, automated monitoring for new lookalikes, employee training, and rapid response when threats are detected. Combined with strong DMARC enforcement on your real domain, these measures significantly reduce the risk of successful impersonation attacks.