A lookalike domain is any domain name registered by someone else that a reasonable person could mistake for yours. Misspellings are the best-known variety, and we cover them in our guide to typosquatting. This page is about the wider family: names spelled correctly but carrying an extra word, sitting in a different extension, using a hyphen, swapping in a foreign character, or hiding your brand inside someone else’s subdomain. These carry most of the phishing and invoice fraud we see, because they do not depend on the victim mistyping anything. The attacker sends the link. This guide, part of our domain name security guide, covers the families, the uses, lookalike domain detection, triage, and takedown in the order that works fastest.
The families of lookalike domains
The most common form is the brand plus a keyword: yourbrand-login, yourbrandsupport, yourbrand-pay, yourbrandhr or yourbrand-invoices, in .com or any other extension. The added word tells the recipient what the page is for. Second is the same name in a different TLD (top-level domain, the extension after the final dot): yourbrand.co, yourbrand.net, yourbrand.app, or a country-code extension in a market where you operate. Third is hyphenation and word order, such as your-brand.com or yourbrandinc.com. Fourth is the homoglyph (a character that looks like another character), whether rn for m or an IDN (internationalized domain name) using a Cyrillic letter indistinguishable from the Latin one. Fifth is the subdomain trick: the attacker owns an unrelated domain and creates yourbrand.example.com so that your name appears first in the address bar. Sixth is combosquatting with a partner name, such as yourbrand-docusign, which borrows the credibility of a vendor your staff deal with daily. A mature detection program looks for all six, not only the first.
How lookalike domains are used
Nearly every use comes down to one of two aims: get the target to enter credentials, or get the target to send money. Credential harvesting uses a brand-plus-login name hosting a copy of your sign-in page, usually with a valid certificate. BEC (business email compromise, the fraud in which an attacker impersonates an executive, vendor or colleague to redirect a payment) uses a lookalike that may never host a website at all. It needs only MX (mail exchange) records so that mail from [email protected] delivers and replies come back to the attacker. Invoice fraud is the same mechanism aimed at your customers, with someone else’s bank account on the attached PDF. Fake job offers use a brand-plus-careers name to collect identity documents from applicants. The common thread is that the domain exists to be believed for a few minutes, which is why detection and takedown have to be measured in hours.
What the research shows
Lookalike registration is deliberate, not incidental. Interisle Consulting Group counted 1,542,922 unique domain names used for phishing between May 2024 and April 2025 and found that 77% were maliciously registered rather than compromised; new gTLDs hold 11% of the domain market but 51% of phishing domains, according to the Interisle Phishing Landscape 2025 report. APWG recorded 892,494 phishing attacks in the third quarter of 2025 against 427 unique brands, with an average BEC wire-transfer request of $48,115, in its Phishing Activity Trends Report for Q3 2025. Among large companies the names are already gone: CSC found that 80% of homoglyph domains resembling Forbes Global 2000 brands are owned by third parties, and that 42% of those carried MX records in 2024, in its 2024 Domain Security Report. The FBI Internet Crime Complaint Center recorded 21,442 business email compromise complaints and $2,770,151,146 in BEC losses in 2024, per its 2024 Internet Crime Report. A lookalike with mail configured is the standard tool behind those complaints.
Where lookalike domains show up: detection sources
No single feed catches every family, so a working program combines several. Zone files (the registry’s daily list of every registered name in an extension) and newly observed domain feeds derived from them catch brand-plus-keyword, different-TLD, hyphenated and IDN registrations within a day of creation, provided your matching rules include keywords and partner names, not only the bare brand. Certificate Transparency logs (public, append-only records of every TLS certificate issued by a trusted certificate authority) are the best source for subdomain tricks, because yourbrand.example.com never appears in a zone file but does appear in the certificate requested before launch. Passive DNS (historical records of which names resolved to which addresses) lets you pivot from one confirmed lookalike to the rest of the attacker’s infrastructure by shared IP address or nameserver. DMARC (Domain-based Message Authentication, Reporting and Conformance) aggregate reports show who is sending mail as your exact domain, and often reveal the same actors. Your own mail gateway logs and help desk count too; the first notice is often an employee forwarding a suspicious message. Our phishing domain monitoring guide describes how to set up the feeds.
Triage: deciding which ones matter today
Detection produces far more names than any team can act on, and most registered lookalikes are parked or dormant. Triage answers four questions in order. Does the domain resolve? A name with no address record and no nameservers is a watch-list entry, not an incident. Does it have MX records? A lookalike with mail configured can be used for BEC without hosting a page, and we treat MX on a brand-plus-keyword name as an active threat even when the website is blank. Does it have a certificate? A newly issued certificate usually means a credential page is coming within days. What is on it? Fetch the page from an isolated system and record the content and redirect chain. A resolving domain with MX records, a fresh certificate and a copy of your login page is a same-day takedown; a parked name in an obscure extension is a monthly review item and a candidate for a UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaint later if it starts to move.
Takedown routes, from fastest to slowest
Takedown is a set of parallel requests, not a single filing, because each route removes a different part of the attack. Start with the registrar abuse report. Every ICANN-accredited registrar publishes an abuse contact. Include the domain, the date and time observed, screenshots with the URL visible, full headers of any email sent from it, your trademark registration number, and a plain statement of which of the registrar’s terms the use violates. Registrars suspend phishing domains on evidence; they do not investigate for you. At the same time, report to the hosting provider identified from the IP address, because removing the content stops the harm even if the registrar is slow. Next, ask the certificate authority named in the certificate to revoke it. Then submit the URL to the browser safe-browsing programs so that a warning appears for anyone who clicks before the host acts. These four steps commonly resolve an active lookalike within a day or two.
The slower routes transfer ownership or recover money. The URS (Uniform Rapid Suspension, a faster and cheaper procedure available only for new gTLDs) suspends a clear-cut infringing name for the rest of its term but does not transfer it. A UDRP complaint takes longer and costs more but transfers the domain to you, so the next attacker cannot re-register it. Litigation under the ACPA (Anticybersquatting Consumer Protection Act, the US federal statute) is the only route that awards damages, and suits cases where the registrant is identifiable and the harm is large. Our comparison of UDRP, URS and ACPA sets out the differences in cost, time and outcome. Where the same actor poses as your company on social platforms or marketplaces, our guide to brand impersonation covers those channels.
Prevention: blocking the names before they are registered
Takedown is reactive, and the same actors re-register under a new extension the week after a suspension. The preventive layer is domain blocking: a registry-level service that prevents anyone from registering your trademark string, and in some products its homoglyph variants, across hundreds of extensions for a single fee. Blocking does not stop brand-plus-keyword registrations, which is why blocking and monitoring belong together, but it removes the different-TLD and IDN families almost entirely. Our guide to domain blocking compares the products, including GlobalBlock, which blocks trademark strings across a large set of extensions, and AbuseShield, which suspends abusive registrations of your name as they appear. Contact us for a quote.
What DNAccess does about lookalike domains
We run lookalike domain detection for clients through DNShield domain name monitoring, which watches new registrations, certificate issuance and DNS changes for the brand strings, keywords and partner names we agree on, and we triage the results so that your team sees only the names that need action. When a lookalike is live, we file the registrar, hosting, certificate and safe-browsing reports with the evidence each requires, and advise on whether a URS, UDRP or ACPA action is worth pursuing. For prevention we arrange domain blocking. If you have found a lookalike domain targeting your company, contact us with what you have observed.