Lookalike domain

A lookalike domain is any domain designed to be mistaken for a legitimate one. It is an umbrella term that covers typosquatting, combosquatting, homograph and homoglyph domains, and the same brand name under a different top-level domain. Lookalike domains sit behind most phishing websites and many business email compromise attacks.

How it works

Attackers choose the technique that best fits the lure:

• Misspellings: a missing, doubled or swapped letter.
• Extra words: the brand plus login, support, pay or a country name.
• Another extension: the brand name under .net, .co, .shop or a country code.
• Similar characters: letters from other alphabets, or rn for m.
• Subdomain tricks: examplebank.com.account-check[.]net, where the real brand appears at the start of a longer, unrelated domain.

The same domain is often set up for both web and email, so it can host a fake login page and send convincing mail. Many are registered in batches, used in a short campaign and then abandoned.

Example

An illustrative set of lookalikes for a fictional brand that uses examplebank[.]com: examp1ebank[.]com, examplebank-online[.]com, examplebank[.]help and examplebank.com-secure[.]info. Each could host a copy of the login page or send emails that appear to come from the bank.

How to spot it

• Read the domain from right to left: the part just before the extension is the real owner.
• Compare it with the brand's published list of official domains.
• Check whether the domain is newly registered or hides its owner.
• Check that an email sender's domain matches the one the organization normally uses.

What brands can do

• Monitor registrations, certificate transparency logs and DNS changes, such as a parked domain suddenly gaining mail records or a website.
• Prioritize: active phishing first, then domains with mail records, then parked ones.
• Register the most likely variants defensively, and enforce DMARC on your real domains.
• Report abusive domains for takedown and to browser blocklists.

Phishvoid monitors lookalike domains for your brand, verifies which ones are abusive and handles the takedown; contact the team to set it up. More detail: Typosquatting and homoglyph domains explained.

Read more: Typosquatting and Homoglyph Domains Explained