What Is a Lookalike Domain?

What Is a Lookalike Domain?

A lookalike domain is a registered domain name built to resemble a legitimate one closely enough that a reader mistakes it for the original. Unlike header spoofing, where an attacker forges the sender address of a domain they do not own, a lookalike is a domain the attacker controls outright, so it can carry its own DNS records, a valid TLS certificate, and passing email authentication, which makes it core infrastructure for brand impersonation.

Phishing is the lure, and the lookalike domain is the infrastructure the lure points to.

How lookalike domains work

A lookalike attack has three steps.

1. Register. The attacker generates a variant of the target name and registers it through an ordinary registrar. ATT&CK classifies the technique as domain acquisition (opens in new tab), covering homoglyphs and alternate top-level domains, and academic studies call it domain squatting (opens in new tab).
2. Equip. The attacker adds the signals a user expects from a real site: a cloned login page, a valid certificate, and mail exchanger records that turn the domain into a collector for misaddressed email.
3. Deliver. Traffic arrives through paid search, SMS, and email. In January 2025, sponsored Google results (opens in new tab) for Microsoft Ads sent advertisers to a phishing page on ads[.]mcrosoftt[.]com, a domain imitating ads.microsoft.com. On a phone screen, a link to exarnple-support[.]example reads as the real brand at a glance.

Whatever the channel, the lookalike is where the lure converts into a stolen password or a malware download.

Why lookalike domains are hard to stop

Lookalike domains exploit gaps in email authentication, browser protections, and abuse response.

• Authentication covers only your own domain. DMARC does not address visually similar domain names (opens in new tab). Because the attacker owns the lookalike, it is trivial to publish (opens in new tab) valid SPF, DKIM, and DMARC records for it, so a filter that treats a passing result as a sign of legitimacy has no reason to stop the message.
• Browser protections are partial. Chrome shows Punycode (opens in new tab) for mixed-script confusable labels, yet attackers still register convincing lookalikes using Unicode characters absent (opens in new tab) from its confusables list. Defensive registration has limits too, because no company can register every variant.
• Attackers rebuild faster than abuse processes respond. Operators of the Tycoon2FA phishing platform generated large numbers of campaign subdomains (opens in new tab), used them briefly, and kept parent domains for weeks or months.

After Europol and Microsoft seized 330 backbone domains (opens in new tab) in March 2026, volume returned to pre-disruption levels. ICANN's 2024 amendments (opens in new tab) require registrars and registries to act on well-evidenced abuse but do not specify the action or its timing.

Types of lookalike domains

Attackers alter spelling, substitute lookalike characters, add words, or change where the brand appears in a domain name.

• Typosquatting. A domain that exploits a typing error, such as a dropped letter, a doubled letter, or a transposition. For example, dhll.com doubles a letter in DHL.
• Homoglyph and IDN homograph. Attackers replace a character with one that looks the same, such as Cyrillic "а" for Latin "a" in apple.com, or ASCII pairs like "rn" for "m" in exarnple.
• Combosquatting. Attackers leave the brand intact and add words or hyphens, as in bankname-login[.]example.
• Level-squatting. Attackers place the brand in a subdomain of an attacker-owned domain, as in apple.com.recover[.]support, where the brand name is the first thing a skimming reader sees.
• TLD swapping. The identical label under a different top-level domain, such as example.co for example.com.
• Bitsquatting. A domain one bit different from the target, such as micposoft[.]com, which catches traffic through memory bit errors (opens in new tab), with no user mistake involved.
• Soundsquatting. A domain that sounds like the target (opens in new tab) when spoken, such as "night" for "knight," so it requires no typing error at all.
• Phantom squatting. A domain that large language models hallucinate for a brand (opens in new tab) and attackers register to intercept AI-generated traffic.

Attackers also stack techniques. The hybrid exarnple-secure.com.login[.]example combines a homograph, a combosquat, and a subdomain placement, so it can slip past detectors built for a single pattern.

How to defend against lookalike domains

Defense combines detection, hardening, reporting, and trademark remedies, and no single control covers every variant.

1. Generate and test variants. dnstwist (opens in new tab) generates homoglyph, hyphenation, and other variants of your domain, reports which ones resolve, and compares page fuzzy hashes to flag variants serving a copy of your site. A perfect page match is unlikely, so review near matches by hand.
2. Watch registrations and certificates. Monitor Certificate Transparency logs (opens in new tab) for new certificates and score each against your brand keywords. Load newly registered domain feeds into your SIEM and match them against resolver logs. RDAP lookups separate attacker registrations from your own defensive ones.
3. Harden what you own. Publish DMARC on every domain you own, including parked and non-sending ones (opens in new tab), because an unprotected domain is open to spoofing. Passkeys bind sign-in to the real domain, so a cloned login page on a lookalike generally cannot complete it. Register the highest-value variants yourself and watch their traffic.
4. Report to the registrar first. Under the 2024 RAA amendment (opens in new tab), a registrar must confirm receipt of an abuse report and "take reasonable and prompt steps to investigate and respond appropriately."
5. Pursue trademark remedies. Where the domain infringes a trademark, the Uniform Rapid Suspension System (opens in new tab) (URS) handles the most clear-cut cases through suspension, and the Uniform Domain-Name Dispute-Resolution Policy (opens in new tab) (UDRP) allows cancellation or transfer when you prove confusing similarity, no legitimate interest, and bad faith.

How Doppel helps

Doppel is the Agentic Social Engineering Defense (SED) platform unifying Digital Risk Protection (DRP) and Human Risk Management (HRM). Its Brand Protection detects lookalike domains through new registrations and DNS changes, then dismantles the impersonation infrastructure behind them across domains, social, ads, dark web, apps, and messaging.

The Doppel Threat Graph links each lookalike domain to the fake accounts and scam ads running alongside it, so the takedown targets the full campaign instead of one disposable domain. Doppel's agentic AI correlates those signals, prioritizes them by risk, and executes takedowns through registrar integrations and escalation paths, routing only novel or escalated cases to analysts. Each dismantled domain feeds the Threat Graph, so respun replacements match faster and attacking your brand grows too costly.

Request a demo to walk through lookalike detection and the takedown workflow against domains targeting your brand.

Frequently asked questions about lookalike domains

What is a lookalike domain?

A lookalike domain is a registered domain name that attackers design to pass for a legitimate one at a glance. They build it by misspelling the original, substituting visually identical characters, appending words such as "login," placing the brand in a subdomain, or changing the top-level domain. Because the attacker owns the registration, the domain can host a cloned site, hold a valid certificate, and send email that passes authentication checks.

What is a lookalike domain in cybersecurity?

In cybersecurity, a lookalike domain is attacker-controlled infrastructure used to impersonate a trusted organization. It typically hosts a credential-harvesting page, delivers business email compromise messages, or serves malware, and attackers steer targets to it through email, text-message, or paid-search lures. Defenders track the technique as MITRE ATT&CK T1583.001, Acquire Infrastructure: Domains.

What is the difference between a lookalike domain and typosquatting?

Typosquatting is one type of lookalike domain that exploits a spelling or typing error, such as a dropped, added, swapped, or transposed character. The broader lookalike category also covers homograph domains built from confusable characters, combosquats that keep the brand intact and add words, and domains that reuse the exact name under a different top-level domain. The labels overlap in practice, and top-level domain swaps are sometimes treated as typosquatting (opens in new tab). Treat typosquatting as the narrowest label and lookalike domain as the umbrella.

What is an example of a lookalike domain attack?

In a case reported in December 2025, the owner of scotaibank[.]com, a misspelling of Scotiabank, held a portfolio of nearly 3,000 lookalike domains (opens in new tab), including gmai[.]com, one letter short of Gmail. A mail server on gmai[.]com collected email that people sent to mistyped Gmail addresses, and the domain supported business email compromise campaigns. Because the operator owned the domain outright, the mail arrived without any spoofing.