Key takeaways

  • Lookalike domains use typos, extra words, swapped top-level domains and visually similar characters. Anyone can register them for a few dollars, so prevention is not realistic. Detection and response are.
  • Certificate Transparency logs (RFC 9162) publicly list certificates as they are issued, which makes them an early signal that a lookalike is being prepared for use.
  • Triage by what the domain does: no website and no mail records is a watch item. A live login page or mail records is a takedown case.
  • The fastest takedown route is usually the hosting provider or registrar abuse contact, plus reports to browser and security vendors. Formal routes exist for trademark owners: the UDRP and, in US courts, the anticybersquatting provision of the Lanham Act.
  • Publish DMARC at reject so that attackers cannot send as your real domain, and tell staff and customers how you contact them. That protects people even when a lookalike is live.

What a lookalike domain is

A lookalike, or typosquat, is a domain registered to imitate yours. Common patterns include a missing or swapped letter, a hyphen, a word added such as billing or secure, a different top-level domain, and characters from another alphabet that look the same on screen. Attackers use them to host fake login pages, to send mail that passes a quick glance, and to send payment instruction changes. Our article on vendor payment fraud shows where these show up in accounts payable.

What you can and cannot control

You cannot block registrations. Registrars sell names to whoever pays, and most lookalikes are not illegal until they are used. What you can do is know about them quickly, collect evidence and move to remove the harmful ones. It also helps to register the obvious variants of your own name, particularly the common top-level domains and the likeliest typos, so the cheap attacks are gone before they start. Do not expect to buy all of them.

Watching: the signals worth having

  • New domain registrations that resemble your names. Domain-watch services and zone-file feeds report these. Generate your own variant list from your brand, product and executive names, then match against new registrations.
  • Certificate Transparency. Public logs described in RFC 9162 record issued TLS certificates. A certificate for a name that contains your brand is a strong sign someone is building a site. Search the logs, or use a monitor that does.
  • Mail and DNS activity. A lookalike that publishes MX or SPF records is preparing to send mail, which is more urgent than a parked page.
  • Your own mail logs and reports. DMARC reports show spoofing of your real domain. Display-name abuse and lookalike senders show up in your filter's reports.
  • Reports from staff and customers. Give them one easy address to forward suspicious mail to.

Triage: three questions

  • Is it live? A parked page with ads is low priority. A copy of your site or a login form is high.
  • Is it aimed at your people? Mail records, or a login page that mentions your product, say yes.
  • Can you prove it? Take dated screenshots, save the page source and headers, record the registration data, the hosting IP address and the certificate details. Do this before you report, since the page may vanish or change.

Treat evidence handling the way you would for any incident. Do not log in to the fake site with real credentials. Open it from an isolated browser.

Takedown: the routes, from fastest to slowest

  • Hosting provider. Find the host from the IP address and send the provider's abuse contact your evidence. Reputable hosts act on phishing reports within a day or so.
  • Registrar. The registrar listed in the registration data has an abuse contact. A registrar can suspend a name used for phishing.
  • Browser and security vendors. Reporting a phishing page to Google Safe Browsing gets it warned about in browsers that use the service. Email security vendors and other blocklist operators accept reports as well. This protects people while the takedown proceeds.
  • Email providers. If mail is going out, report the messages to the mailbox provider that received them.
  • Trademark route. The Uniform Domain-Name Dispute-Resolution Policy (UDRP), run through providers such as the WIPO Arbitration and Mediation Center, lets a trademark owner seek transfer or cancellation of a domain registered and used in bad faith. In US courts, the Anticybersquatting Consumer Protection Act, part of 15 U.S.C. 1125(d), gives a trademark owner a civil claim. Both need a trademark, take longer and involve fees, so they suit persistent or high-damage cases, and you should involve counsel.

If money was lost or a crime is clear, file a complaint with the FBI's Internet Crime Complaint Center. Phishing and payment fraud are crimes whether or not the domain comes down.

Make the lookalike less useful

  • Publish DMARC at reject on your real domain so no one can send as it. See our DMARC rollout article.
  • Use a callback process for payment changes, so a convincing email is not enough. See our article on callback verification.
  • Use phishing-resistant sign-in such as passkeys, since they will not authenticate to a fake domain.
  • Tell customers how you contact them and what you never ask for.

A one-page runbook helps: who watches, who decides, who files the reports, which counsel to call and how long each step may take. Our Cybersecurity team can set up the monitoring, run triage and handle takedown requests on your behalf. This article is general information and not legal advice.

Sources

This article is general information, not legal advice. Consult counsel before sending demand letters, filing a UDRP complaint or bringing a court claim. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity