Lookalike domains and typosquatting: spotting a domain built to impersonate you

A lookalike domain is a domain name registered to look like yours at a glance: examp1e.com instead of example.com, example-billing.com, example.co, or a version that swaps a Latin letter for a similar character from another alphabet. Typosquatting is the oldest form of it: someone registers the domain your customers reach when they mistype yours.

Most of these registrations are harmless or parked. The ones that matter have mail servers configured, a TLS certificate, or a web page that copies your design. Those are the domains used to send fake invoices in your name, to host a fake login page, or to collect mail that was meant for you.

The good news is that you can find them yourself with a few commands, and there is a clear path to getting the dangerous ones removed.

How lookalike domains are built

Attackers and opportunists use a handful of predictable patterns:

• Character swaps: 1 for l, 0 for o, rn for m (exarnple.com).
• Omission and repetition: a missing or doubled letter (exmple.com, exaample.com).
• Added words: example-login.com, example-support.com, secure-example.com.
• Other top-level domains: example.co, example.net, example.io.
• Homoglyphs: internationalized domain names that use Cyrillic or Greek characters which render almost like Latin ones. In DNS they appear as Punycode, starting with xn--.
• Subdomain tricks: example.com.account-verify.net, where the real registered domain is the part at the end.

Because the patterns are predictable, they can be generated and checked automatically.

How to check for lookalikes yourself

The open source tool dnstwist generates permutations of your domain and checks which of them actually exist. A good first run shows only registered variants:

dnstwist --registered example.com

To see which of them serve a page similar to yours, it can compare the HTML of each site with your own using fuzzy hashing:

dnstwist --lsh example.com

For every registered lookalike, look at 3 things:

1. Mail records. A lookalike with MX records can receive mail. Check with dig MX examp1e.com +short. Mail capability is what turns a parked domain into a tool for invoice fraud.
2. Certificates. A certificate issued for the lookalike suggests someone intends to serve HTTPS from it. Certificate Transparency logs record issued certificates, and you can search them at crt.sh. Our article on Certificate Transparency logs explains how.
3. Content. Open the site in an isolated browser or check it with a screenshot service. A copy of your logo, login form or invoice portal is the clearest signal.

Then repeat the check regularly. A lookalike registered last month and quiet today can get mail records and a login page tomorrow.

Which findings deserve action

Not every variant needs a response. A reasonable way to sort them:

• Watch: registered, parked, no MX, no certificate. Note it and check again later.
• Investigate: MX records present, or a fresh certificate, or a registration date in the last few weeks.
• Act now: a page imitating your brand, a login form, or reports from customers or staff who received mail from the domain.

If a lookalike is sending mail in your name, also tell your finance team and key customers which domain to watch for. A short message ("we only invoice from example.com") prevents more damage than any takedown.

Getting a lookalike domain removed

For an active phishing page, start with the fastest routes:

• Report the URL to Google Safe Browsing and Microsoft, so browsers start warning visitors.
• Report it to the registrar of the domain. Registrars accredited by ICANN must publish an abuse contact and, under the 2013 Registrar Accreditation Agreement (section 3.18), take reasonable and prompt steps to investigate abuse reports.
• Report it to the hosting provider shown by the IP address of the site.

For a domain that infringes your trademark but is not obviously malicious, the usual path for generic top-level domains is the Uniform Domain Name Dispute Resolution Policy (UDRP). The complainant must show that the domain is identical or confusingly similar to a mark in which it has rights, that the holder has no rights or legitimate interests in it, and that it was registered and is being used in bad faith. The remedies are cancellation or transfer of the domain. This is a legal step, so involve your lawyer.

Our article on fake login pages using your brand covers the takedown process in more detail.

Reducing the damage before it happens

You cannot stop people from registering domains, but you can make lookalikes less useful:

• Register the obvious variants of your main domain: the most common typos and the top-level domains your customers are likely to type.
• Publish strict email authentication on your real domain. SPF, DKIM and a DMARC policy of quarantine or reject will not stop a lookalike, but they stop exact spoofing of your own domain and make the lookalike the attacker's only option. See SPF, DKIM and DMARC explained.
• Agree on payment verification. Any change of bank details is confirmed by phone using a number you already have, never one from the email.
• Tell customers your official domains on your website and in invoices.

Checklist

• Run dnstwist --registered against each of your domains.
• For every hit, check MX records, certificates on crt.sh and page content.
• Report active phishing to Google, Microsoft, the registrar and the host.
• Consider UDRP with your lawyer for trademark abuse.
• Register key variants and enforce DMARC on your real domain.
• Repeat the search on a schedule, not once.

How Datahorses helps

Datahorses watches your company from the outside every day, including newly registered domains that resemble yours, whether they can receive mail, and whether a page imitating your login appears. We do not enter your systems and need no access. When something changes, a person reviews it and you get the finding with clear next steps, as described in what happens when we find something. The full list is under what we guard.