Lookalike domains: what to do when one turns up

What is a lookalike domain?

A lookalike domain is a domain name that closely resembles another organisation's domain, such as brand-login.example or bramd.example for brand.example. Resemblance on its own is not abuse: what matters is what the domain serves (nothing, a parked page or a web page) and whether mail is sent from it. Whoever registered it controls its DNS and can publish SPF, DKIM and DMARC records of their own, so mail from it can pass authentication, and the DMARC policy on your domain does not cover it.

The difference might be as simple as two swapped letters or as subtle as Unicode characters that look like standard Latin letters. A lookalike works on human perception rather than a technical weakness: a user who receives an email from accounts@brancl.example (“cl” in place of “d”) is unlikely to spot the difference at a glance, especially on a phone. The same applies to links in emails, chat messages and social media posts.

What should I do if I find a lookalike of my domain?

Record it first: what it serves (nothing, a parked page or a web page), its DNS and WHOIS details, and the headers of any mail you have received from it. Resemblance is not abuse, so ask for a takedown only once spoofed mail has been seen from the domain. Then use the route that fits: the registrar's abuse desk, Nominet's Dispute Resolution Service (DRS) for a .uk domain, or the Uniform Domain-Name Dispute-Resolution Policy (UDRP) for most generic domains such as .com.

1. Record what it serves. Take screenshots of what the domain serves (nothing, a parked page or a web page), capture the headers of any mail received from it, and note its DNS records. Use our WHOIS Lookup to record the registrar, its abuse contact, the creation date and the nameservers. Any dispute or takedown request will need this evidence.
2. Check whether it is set up for mail. Run the domain through the Security Grade check to see its SPF and DMARC records and its certificate, and the DNS Lookup for its MX records. These show what the domain is set up to do, not whether any mail has been sent from it.
3. Ask for a takedown only once spoofed mail has been seen. Resemblance is not abuse. When you hold spoofed or phishing mail from the domain, send that evidence to the registrar's abuse desk. ICANN-accredited registrars must publish an abuse contact, and the WHOIS Lookup shows it.
4. Use the dispute route for its ending. For a .uk domain, complaints go to Nominet's Dispute Resolution Service (DRS). For most generic domains, such as .com, the Uniform Domain-Name Dispute-Resolution Policy (UDRP) applies: you must show that the domain is identical or confusingly similar to your trademark, that the registrant has no rights or legitimate interests in it, and that it was registered and is being used in bad faith.
5. Report to hosting and email providers. If the lookalike domain is hosting phishing pages, report the content to the hosting provider. If it is sending phishing emails, report it to the email service provider. Google, Microsoft, and other major providers have dedicated abuse reporting channels that can disable accounts quickly.
6. Notify your users. If the lookalike domain has been used in active phishing campaigns targeting your customers or partners, issue a notification explaining the attack and advising recipients to verify the sender domain on any unexpected emails.

What are the main types of lookalike domain attacks?

The main techniques are typosquatting, where letters are swapped, doubled or replaced with keyboard neighbours; homoglyph and IDN attacks, which use visually identical Unicode characters such as the Cyrillic a in place of the Latin a; TLD variants, where the brand is registered under a different ending such as .net or .co.uk; combosquatting, which adds plausible words to the brand name, as in brand-login.example; and subdomain impersonation, where the brand name appears as a subdomain of a generic domain someone else owns.

Typosquatting (keyboard-adjacent substitutions)

Typosquatting targets common typing mistakes. Letters are swapped, doubled, or replaced with their keyboard neighbours. For example, if your domain is brand.example, someone might register barnd.example (transposed letters), bramd.example (adjacent key substitution), or brnd.example (missing character). These are cheap to register and can be set up with phishing pages within minutes.

Homoglyph and IDN attacks

Internationalised Domain Names (IDNs) allow the use of Unicode characters in domain names. This opens the door to homoglyph attacks, where visually identical characters from different scripts replace Latin letters. The Cyrillic “a” (U+0430) looks identical to the Latin “a” (U+0061) in most fonts. An attacker could register a domain using Cyrillic characters that renders identically to yours in a browser address bar. While modern browsers now display the Punycode (xn--) representation for mixed-script domains, older software and email clients may not.

TLD variants

If your brand operates on a .com domain, someone else might register the same name under .net, .co.uk, .org or .io. These work best on users in a particular region: a UK employee might not question an email from the .co.uk variant of their company's .com domain.

Combosquatting

Combosquatting adds plausible words to the brand name. Examples include brand-login.example, brand-secure.example, or brand-support.example. Research published by Georgia Tech found that combosquatting is even more prevalent than traditional typosquatting and is harder to detect because the permutations are nearly infinite.

Subdomain impersonation

Attackers register a generic domain and create subdomains that mimic the target brand. The victim's own DNS is never touched, so this is impersonation rather than spoofing. For example, brand.example.login-secure.example or secure.brand.attacker.example. To a casual reader, the presence of the real brand name in the URL is enough to establish trust. This technique is particularly effective in phishing emails where the full URL is truncated or hidden behind display text.

The free Lookalike Domain Scanner checks which variants of your name are registered; its page lists the techniques it uses and how it rates each result.

Real-world impact

Lookalike domains are used in real attacks. These are the uses to plan for:

• Phishing and credential harvesting. Attackers clone a login page on a lookalike domain, send a phishing email that passes SPF and DKIM (because they control the sending domain), and collect the credentials people enter. The domain looks correct at first glance, so the page does too.
• Business email compromise (BEC). An attacker registers a lookalike of a supplier's domain and sends an invoice with updated bank details to the finance team. In the FBI's 2025 Internet Crime Report, business email compromise was the second-costliest crime type, with $3.05 billion in reported losses, behind investment fraud.
• Brand and reputational damage. If customers receive phishing emails that appear to come from your organisation, trust erodes regardless of whether you were technically compromised. The perception of insecurity is enough to damage client relationships and generate negative press coverage.
• Supply chain attacks on MSPs. Managed service providers are high-value targets because a single compromised MSP can provide access to dozens of client environments. Our Q1 2026 audit of 192 UK MSPs, published in March 2026, found that 80% had an alternate brand domain (usually the .co.uk or .com counterpart) that was unprotected or not registered. The most common case, 117 MSPs (61%), was an existing alternate domain with no DMARC record, which anyone can spoof directly.

How can I detect lookalike domains of my brand?

Use three methods: automated permutation scanning, which generates variants of your domain name and checks whether each one is registered; Certificate Transparency log monitoring, which shows when a lookalike gets a TLS certificate (ShieldMarc does not monitor CT logs, so this needs a dedicated CT monitoring service); and DNS and WHOIS monitoring, which tracks changes to known variants over time. Start with lookalikes registered in the last 90 days: those are the ones ShieldMarc's lookalike monitor first emails you about. It emails again if one of them adds MX records, or if one you have acknowledged or dismissed changes (new MX records, a weaker DMARC policy, a new registration or registrar, or failing mail naming it), and that email says what changed.

Automated permutation scanning

A permutation scan gives you a snapshot of the lookalikes registered around your name today. The Lookalike Domain Scanner page explains which variants it builds and how it labels each one.

Certificate Transparency logs

Every publicly trusted SSL certificate is logged in Certificate Transparency (CT) logs. If an attacker registers a lookalike domain and obtains an SSL certificate for it (which is trivial with free providers like Let's Encrypt), that certificate will appear in the CT logs. Monitoring CT logs for certificates that match patterns similar to your brand name can show a lookalike domain as soon as it gets a certificate, which can be before anything has been sent from it. ShieldMarc does not monitor CT logs, so use a dedicated CT monitoring service if you want this signal.

DNS and WHOIS monitoring

Periodically querying WHOIS data and DNS records for known lookalike permutations lets you track changes over time. A domain that was previously unregistered and suddenly resolves to an IP address, or one whose WHOIS records change to hide registrant information behind privacy protection, may warrant investigation. Use our WHOIS Lookup to examine registration details for any suspicious domain.

Filter alerts to recently registered lookalikes

A permutation scan against any reasonably common brand will return dozens of registered hits. Most of them are not active phishing infrastructure. The signal that matters most is recent registration: a lookalike registered in the last 90 days deserves a look before one that has been parked for five years. ShieldMarc's first alert about a lookalike goes out only when it was registered in the last 90 days, and not when it publishes DMARC p=reject, has a very short name or sits on a TLD outside the alert list for your region. Once you acknowledge or dismiss a lookalike in the dashboard, ShieldMarc emails about it only if it changes in a way that matters (it gains MX records, weakens its DMARC policy, is registered again or changes registrar, or mail naming it fails DMARC in your reports), and the email says what changed. The rest are still listed in the dashboard for awareness, but they do not generate noise. If you build your own pipeline, apply the same filter; without it, alert fatigue makes the real attacks easier to miss, not harder.

Defensive registration strategies

While you cannot register every possible permutation of your domain, a targeted defensive registration strategy significantly reduces the attack surface.

• Register common TLD variants. At a minimum, register your brand name under .com, .co.uk, .net, .org, and any country-code TLDs relevant to your operations. Point them all to your primary domain with 301 redirects and publish v=spf1 -all and p=reject DMARC records on each.
• Register common misspellings. Identify the two or three most likely typos of your brand name and register those variants. Transpositions of adjacent letters and missing characters are the highest priority.
• Use domain monitoring services. Defensive registration is a one-time cost, but the risk changes daily as new TLDs are introduced and expired domains become available. Continuous monitoring ensures you are alerted when a new lookalike appears, even if it was not part of your original defensive set.

For every defensive domain you register, apply the same hardening you would to a parked domain: null SPF, DMARC reject, and no active mail services. DMARC for parked and non-sending domains covers the full setup.

Does DMARC protect against lookalike domains?

No. At p=reject you ask receivers to refuse mail that fails DMARC, and each receiver makes the final call (RFC 9989, section 5.4). That covers mail that uses your own domain in the From address. DMARC does nothing about lookalike domains or display-name tricks, because whoever owns a lookalike can authenticate mail from it. DMARC and lookalike monitoring are complementary controls, not alternatives.

This is the gap that brand protection fills: DMARC covers your own domain, and lookalike monitoring finds the domains that resemble it. If you have not yet configured DMARC on your primary domain, start there. What is DMARC? explains how it works, and the DMARC p=none to p=reject rollout runbook takes a domain from monitoring to full enforcement. Then use the DMARC Checker to verify your configuration.

Organisations that have reached p=reject on their primary domain sometimes assume the job is done. A lookalike domain sits outside that policy, so brand protection monitoring belongs in your security posture from the start, not as an afterthought.

Ongoing monitoring

Lookalike domain threats are not static. New domains are registered every day, and attackers frequently let domains expire and re-register them under different identities. Effective brand protection requires continuous monitoring, not a one-off scan.

A thorough monitoring programme should include regular scans of domain permutations, CT log monitoring for newly issued certificates matching your brand, and WHOIS change tracking for known lookalike domains. ShieldMarc covers the first of these: on paid plans and the 30-day free trial, its lookalike monitor re-scans the permutations of each monitored domain about once a day and records every registered lookalike's DMARC policy and MX records, plus its registration date and registrar where the registry provides them. It emails you about newly registered lookalikes, and again if one it has already alerted you about gains MX records while it is still within 90 days of registration (it re-reads MX records every day or two). One you have acknowledged or dismissed is still checked, and it emails you if that lookalike changes in one of the ways above, saying what changed. It does not watch CT logs. Learn why organisations choose ShieldMarc for unified domain security that covers DMARC reporting, DNS health, SSL monitoring, and brand protection in one dashboard.

The retirement of NCSC Mail Check has left many UK organisations without the DMARC monitoring they relied on. If you are migrating from Mail Check, this is an ideal time to adopt a platform that covers both email authentication and brand protection rather than replacing like for like.

Next steps

Protecting your brand from lookalike domains requires a combination of detection, defensive registration, and response procedures. Here is where to start:

• Scan your domain for lookalikes now with the free Lookalike Domain Scanner to see which permutations are already registered.
• Use the WHOIS Lookup to investigate the registration details of any suspicious domains you find.
• Check your DMARC record to ensure your primary domain is protected from direct spoofing while you address lookalike threats.
• Read What is DMARC? if you have not yet deployed an email authentication policy.
• Review the 2026 UK MSP DMARC audit to see how many MSPs leave an alternate brand domain without a DMARC record.