Lookalike Domains: How Typosquatters Register Near Misses of Your Brand

The short answer. For a few dollars anyone can register a domain that reads as yours at a glance. Research on real brands consistently finds dozens to hundreds of live lookalikes each, a large share configured to send email. You cannot prevent the registrations. You can find them, monitor for new ones, and make sure the ones that matter cannot impersonate your mail.

---

The shapes a lookalike takes#

There are more variations than most people expect, and they are not equally dangerous.

Typos. A doubled letter, a dropped letter, adjacent keys. These catch real human error, which makes them the most reliably trafficked.

Extension swaps. Your name on a different extension. Cheap, obvious, and effective because people assume the brand owns every version.

Hyphen and word order. Adding a hyphen, reversing two words, adding "login", "secure", "support" or "billing" as a prefix or suffix. These are aimed at phishing rather than mistyping, and the added word is chosen to fit the message they plan to send.

Character substitution. Swapping the letter l for the digit 1, or O for 0. Reads correctly in most fonts at a glance.

Homograph attacks. The sophisticated version. Non-Latin characters that render identically to Latin ones, most commonly Cyrillic, encoded through Punycode. The rendered domain can be visually indistinguishable from yours. We covered the underlying character rules in What Characters Are Allowed in a Domain Name.

---

How many exist#

Measured studies tell a consistent story.

A June 2026 scan of 24 well-known brands across banking, insurance, energy, telecoms, retail, logistics, fintech and SaaS found 591 live lookalike domains, with 48% having email-sending capability configured.

That second figure is the one to sit with. A parked lookalike is a nuisance. A lookalike with MX records is a phishing campaign waiting for a reason to start.

Fortra's domain impersonation research reported an average brand being targeted by roughly 40 lookalike URLs per month during the first half of 2023, which gives a sense of ongoing rate rather than a static count.

Independent studies of permutation scanning find that a majority of generated variants resolve to something live, but that a meaningful share are never indexed by search engines, so they are invisible to anyone checking by searching for their own brand.

The uncomfortable implication: the lookalikes most likely to be used against you are the ones least likely to show up in a Google search for your name.

---

Why you cannot just stop it#

Registering a domain that resembles another is not automatically illegal. Registries do not pre-screen for similarity, and there is no mechanism to reserve every variant of a name.

Defensive registration does not scale either. The permutation space for even a short brand runs to thousands of variants across hundreds of extensions. Buying them all would cost more per year than most companies spend on security in total.

So the realistic posture is not prevention. It is detection, prioritisation, and making impersonation ineffective.

---

What actually works#

Make your email impossible to spoof

This is the highest-value action and it is free. SPF, DKIM and a DMARC policy set to reject mean that mail claiming to come from your exact domain gets rejected by receiving servers.

That does not stop a lookalike domain sending its own mail. It does stop the much easier attack of spoofing your real domain, and it means an attacker has to use a visibly different address, which raises the chance someone notices.

Apply this to every domain you own, including ones that never send mail.

Register the few that matter

Not all of them. The common typo, the matching .com if you use something else, and the plural or singular. Three to five registrations, chosen deliberately.

Monitor for new registrations

New lookalikes appear continuously. The useful signal is a newly registered domain resembling yours that has just acquired MX records, because that is the moment a dormant registration becomes an active threat.

Watch certificate transparency

Every publicly trusted certificate is logged. An attacker setting up a convincing phishing site will usually obtain a certificate, and that issuance is public the moment it happens. It is one of the few genuinely early signals available for free.

Escalate the ones being used

A domain merely registered is usually not actionable. A domain actively impersonating you is. The UDRP exists for trademark-infringing registrations, registrar abuse reports work when there is active phishing, and hosting providers generally act quickly on credible reports.

---

Finding yours#

Generate the plausible permutations of your name, check which are registered, then check which of those resolve and which have mail configured. The registered-and-resolving-with-MX set is your actual problem list, and it is usually far smaller than the full permutation list.

Our bulk checker will take a list of variants and tell you which are registered, which are available and which are unknown, as four distinct states rather than collapsing them. For the ones that come back registered, an RDAP lookup shows you the registrar and registration date, and a recent registration date on a name resembling yours is worth a closer look.

---

Common questions#

What is a lookalike domain?

A domain registered to resemble another, through misspelling, a different extension, added words, substituted characters or visually identical non-Latin characters. They are used for phishing, ad revenue, resale to the brand, or to intercept mistyped email.

Is typosquatting illegal?

Registering a similar domain is not automatically illegal. It becomes actionable when it infringes a trademark or is used in bad faith, which is what the UDRP process addresses. Active phishing is separately actionable through registrar and host abuse reports.

How do I find lookalike domains targeting my brand?

Generate permutations of your name, check which are registered, then narrow to those that resolve and have mail records. Certificate transparency logs are also a strong early signal, since phishing sites usually obtain certificates.

Should I buy every variation of my domain?

No. The permutation space is effectively unbounded. Register the handful with genuine traffic risk, then spend the remaining effort on email authentication and monitoring, which scale where defensive registration does not.

What is a homograph attack?

Replacing characters with visually identical ones from another alphabet, such as a Cyrillic a in place of a Latin a, then encoding the result in Punycode. The rendered domain can look identical to the real one.

Does DMARC stop lookalike domains?

It stops attackers spoofing your exact domain, which is the easier attack. It does not stop a separate lookalike domain sending its own mail, though it forces attackers onto addresses that are visibly different on inspection.