Support Library

Lookalike Domains and Typosquatting

A lookalike domain differs from yours by a letter, a swapped pair or a different ending, such as examp1e.com or example.co. Registered by someone else and given mail servers, it can send invoices and password resets that look like they came from you.

Author
CategoryDNS Security
Length5 minute read
UpdatedNovember 1, 2026

The short answer

Treat lookalikes that have mail servers as active threats: block them in your mail filter, warn finance and support staff, and start a takedown or dispute. Register the most obvious variants of your own domain yourself, and enforce DMARC so the real domain cannot be spoofed outright.

How a lookalike domain is used

How a lookalike domain set up for email is used for invoice fraud, and how monitoring and blocking stop it Top, unmonitored: an attacker registers examp1e.com, a copy of example.com with the letter l replaced by the digit 1, adds mail servers, and sends a customer an invoice with new bank details. The customer pays the attacker. Bottom, monitored: the lookalike is spotted when it gets mail servers, it is blocked in the mail filter, customers are warned, and a takedown is filed. Not monitored Lookalike registered examp1e.com Mail servers added MX records appear Fake invoice sent New bank details Money lost Paid to attacker Customers and staff deceived DMARC does not cover other domains Monitored and blocked Lookalike spotted New registration Mail blocked Filter rule added People warned Verify bank changes Takedown filed Registrar or UDRP Messages never reach inboxes Domain suspended or transferred How a lookalike domain set up for email is used for invoice fraud, and how monitoring and blocking stop it Top, unmonitored: an attacker registers examp1e.com, a copy of example.com with the letter l replaced by the digit 1, adds mail servers, and sends a customer an invoice with new bank details. The customer pays the attacker. Bottom, monitored: the lookalike is spotted when it gets mail servers, it is blocked in the mail filter, customers are warned, and a takedown is filed. Not monitored Lookalike registered examp1e.com Mail servers added MX records appear Fake invoice sent New bank details Money lost Paid to attacker Customers and staff deceived DMARC does not cover other domains Monitored and blocked Lookalike spotted New registration Mail blocked Filter rule added People warned Verify bank changes Takedown filed Registrar or UDRP Messages never reach inboxes Domain suspended or transferred
DMARC stops spoofing of your exact domain, but a lookalike is a different domain with its own valid SPF and DKIM, so filters have to block it by name.

How DNS Panopticon detects it

Security Posture generates up to 30 lookalikes of the scanned domain: the same name under common TLDs (.com, .net, .org, .co, .io, .info, .biz, .us), letters that look alike (o and 0, l and 1, m and rn, w and vv) and single-letter typos (a missing, doubled or swapped letter). A lookalike with name servers is registered. If it uses your own name servers it is probably yours; otherwise up to 10 are checked for mail servers (MX records). The results appear on the Brand Protection card.

FindingSeverityWhen it appears
N lookalike domains are set up for emailHighSomeone else registered them and gave them mail servers, the setup used for phishing and invoice fraud. The finding lists them.
N lookalike domains are registered by someone elseMediumRegistered on other name servers, without mail. Many are parked, but any can become a phishing site.
N lookalike domains use your name serversPassProbably registered by you defensively.
No lookalike domains registered by othersPassNone of the variants checked belong to someone else.
N lookalike domains couldn’t be fully checkedNot gradedSome lookups failed.

Internationalized lookalikes, which use letters from other alphabets, are covered in Internationalized Domain Names.

How to check it yourself

Command or toolWhat it tells you
dig +short NS examp1e.comName servers mean the lookalike is registered.
dig +short MX examp1e.comMail servers mean it can send and receive email.
whois examp1e.comRegistrar, creation date and abuse contact, for a takedown request.
dnstwist --registered example.comAn open-source tool that generates many more variants and shows which are registered.

Certificate Transparency logs, searchable at crt.sh, show new HTTPS certificates for names that contain your brand, often before a phishing site goes live.

Why it matters

  • Invoice and payment fraud. Business email compromise often uses a lookalike of a supplier’s domain to change bank details on a real invoice.
  • Credential phishing. A lookalike login page with a valid HTTPS certificate is hard to tell from yours.
  • Your own protections do not apply. SPF, DKIM and DMARC protect your exact domain only. A lookalike passes its own checks.
  • Reputation. Customers who are scammed through a lookalike often blame the real brand.

How to respond

  1. Block lookalikes with mail servers in your mail gateway or Microsoft 365 / Google Workspace rules, and add them to web filters.
  2. Warn the people most targeted: finance, accounts payable and customer support. Require a call-back on a known number before any bank detail change.
  3. Report abuse. Send evidence (sample messages, the phishing page) to the registrar’s and host’s abuse contacts from WHOIS or RDAP. Active phishing is usually suspended quickly.
  4. Dispute it if it uses your trademark through the UDRP (for .com, .net, .org and most gTLDs) or the country registry’s process, which can transfer the domain to you.
  5. Register the obvious variants yourself, point them at your name servers and redirect them to your site. They then show as defensive registrations.
  6. Enforce DMARC (p=quarantine or p=reject) on your real domain, and consider BIMI so genuine mail shows your logo (see SPF, DKIM and DMARC).
  7. Monitor continuously with a brand protection service or scheduled dnstwist and Certificate Transparency checks.

FAQ

Should we buy every lookalike?

No, there are too many. Register the ones most likely to be used (the main other TLDs, obvious typos and look-alike letters) and monitor the rest.

The lookalike is parked with ads. Is it dangerous?

Less so today, which is why DNS Panopticon rates it medium. Parked domains are often sold or reused for phishing later; the step to watch for is mail servers or a certificate appearing.

Can DMARC stop lookalike phishing?

No. DMARC protects only your exact domain. It still matters, because without it attackers do not even need a lookalike.

Sources and further reading

Related support articles

Internationalized Domain NamesSPF, DKIM and DMARCBlocklisted Domains and IP AddressesCertificate Transparency and subdomains