Lookalike Domains: How Attackers Impersonate Your Brand and How to Detect Them
What Are Lookalike Domains?
Lookalike domains (also called typosquat domains or cousin domains) are domain names that closely resemble a legitimate domain. They're designed to trick people into thinking they're interacting with a trusted brand.
Examples for example.com:
examp1e.com(letter "l" replaced with number "1")exarnple.com("m" replaced with "rn")example-login.com(added word)exmple.com(missing letter)examlpe.com(swapped letters)éxample.com(Unicode/IDN homograph)
These domains are used in phishing campaigns, business email compromise (BEC), credential harvesting, and brand abuse.
How Lookalike Domains Are Used
Phishing Emails
An attacker registers examp1e.com, sets up a mail server, and sends emails from security@examp1e.com to your customers. The email warns about a "security incident" and links to a credential harvesting page.
Because the domain is legitimately owned by the attacker, the email passes SPF, DKIM, and DMARC for examp1e.com. Your DMARC policy on example.com can't help — the attacker isn't spoofing your domain, they're using their own lookalike.
Business Email Compromise
An attacker studies your organization and registers a lookalike of your CEO's email domain. They email the finance team from ceo@examp1e.com requesting an urgent wire transfer. The domain looks close enough that busy employees don't notice the difference.
Fake Websites
The attacker hosts a clone of your login page at https://login.examp1e.com. Phishing emails link to this page, where victims enter their real credentials.
Customer Confusion
Even without malicious intent, lookalike domains can be registered by cybersquatters hoping to profit from your brand's traffic, or by competitors trying to intercept your customers.
Types of Lookalike Techniques
Character Substitution
Replacing characters with similar-looking ones:
0foro,1forl,vvforwrnform,clford
Character Addition/Removal
- Adding characters:
examplee.com,eexample.com - Removing characters:
exampe.com,exmple.com
Character Transposition
Swapping adjacent characters: exapmle.com, examlpe.com
Homograph Attacks (IDN)
Using Unicode characters that look identical to ASCII:
- Cyrillic
а(U+0430) looks like Latina(U+0061) - Cyrillic
е(U+0435) looks like Latine(U+0065)
Modern browsers and email clients have IDN homograph protections, but they're not foolproof.
Word Addition
Adding common words:
example-support.comexample-login.commyexample.comexample-secure.com
TLD Variations
Using different top-level domains:
example.net,example.org,example.coexample.io,example.app- Country codes:
example.com.br,example.co.uk
Detection Strategies
Automated Monitoring
The most effective approach is automated scanning that regularly checks for newly registered lookalike domains. These tools:
- Generate permutations of your domain using known attack techniques
- Check whether each permutation is registered
- Resolve DNS to see if the domain has active infrastructure
- Check for MX records (email capability)
- Alert you when new lookalikes appear
DNS Monitoring
Track new domain registrations that match patterns related to your brand. Certificate Transparency (CT) logs can also reveal lookalike domains that have obtained TLS certificates.
DMARC Reports as an Early Warning
While DMARC can't prevent lookalike domain attacks (the attacker uses their own domain), your DMARC reports can sometimes reveal them. If attackers test by spoofing your actual domain before switching to a lookalike, you'll see the attempts in your failure reports.
Brand Monitoring Services
Commercial services monitor domain registrations, social media, app stores, and the web for brand impersonation. These go beyond simple domain permutation checking.
What to Do When You Find a Lookalike
1. Assess the Threat
Not every registered lookalike is malicious. Some are parked, some are legitimate businesses with similar names. Check:
- Does it have active DNS records?
- Does it have MX records (can it send email)?
- Does it host a website? If so, is it impersonating your brand?
- Was it recently registered? (WHOIS data)
2. Document Everything
Screenshot the domain's website (if any), record DNS configuration, save WHOIS data, and note the registrar. This documentation supports takedown requests and legal action.
3. Request Takedown
- Registrar abuse complaint: Most registrars have abuse reporting procedures. File a complaint citing trademark infringement and/or phishing.
- UDRP (Uniform Domain-Name Dispute-Resolution Policy): A formal arbitration process for trademark-related domain disputes. Costs ~$1,500 and takes 2–3 months.
- Legal action: For persistent or high-impact cases, consult legal counsel about cease-and-desist letters or court orders.
4. Block and Warn
- Add the domain to your organization's email blocklist
- Warn employees about the lookalike, especially if BEC is suspected
- If customers are being targeted, consider a security advisory
5. Defensive Registration
Register obvious typos and common TLD variations of your domain. This is cheaper than fighting takedowns after the fact. At minimum, register:
- Common misspellings
- Popular TLD alternatives (.net, .org, .co, .io)
- With and without hyphens
Prevention Best Practices
For Your Organization
- Register defensive domains: Buy obvious lookalikes before attackers do
- Monitor continuously: Set up automated scanning for new lookalikes
- Train employees: Teach staff to verify sender domains carefully, especially for financial requests
- Implement DMARC at reject: While it doesn't stop lookalikes, it stops spoofing of your actual domain, forcing attackers to use lookalikes (which are easier to detect)
For Your Customers
- Communicate official domains: Tell customers exactly which domains your emails come from
- Use BIMI: Display your brand logo in authenticated emails so the absence is noticeable
- Security page: Maintain a page listing your official domains and how to report suspicious emails
- Don't use lookalike-prone patterns: Avoid using multiple similar domains yourself, as it trains customers to accept domain variations
Summary
Lookalike domains are a growing threat that DMARC alone can't solve. DMARC protects your exact domain from spoofing, but attackers can register similar-looking domains and send fully authenticated email from them.
The defense is layered: defensive domain registration, automated monitoring for new lookalikes, employee training, and rapid response when threats are detected. Combined with strong DMARC enforcement on your real domain, these measures significantly reduce the risk of successful impersonation attacks.