Lookalike domains are web addresses deliberately registered to resemble a legitimate brand's domain so victims mistake them for the real thing. Attackers use them to send convincing phishing emails, host fake login pages, and intercept payments — and they work because the human eye skims domains instead of reading them character by character.
What a lookalike domain actually is
A lookalike domain (also called an impersonation domain or spoofed domain) is any registration crafted to be visually or cognitively confused with a target. The goal is to borrow trust the real brand has already earned. If a customer trusts `example.com`, they'll extend that trust to `examp1e.com` or `example-support.com` without a second thought — which is exactly the reaction attackers engineer.
These domains rarely exist for their own sake. They are infrastructure for a larger attack: a phishing campaign, business email compromise, credential harvesting, or fake e-commerce storefronts that take money and deliver nothing.
The main types of lookalike domains
Attackers have a well-worn toolkit. Recognizing the categories helps you predict what to defend against.
- Character substitution (typosquatting): Swapping visually similar characters — `rn` for `m`, the digit `1` for lowercase `l`, `0` for `o`. `exarnple.com` reads as "example" at a glance.
- Homoglyphs and IDN attacks: Using non-Latin characters that render identically to Latin ones. A Cyrillic "а" looks exactly like a Latin "a." These internationalized domain names (IDNs) can produce addresses that are pixel-perfect copies of the real one.
- Omission and transposition: Dropped or swapped letters that fingers type by accident — `exmple.com`, `examlpe.com`. These catch people who mistype the address directly.
- TLD swaps: Keeping the exact brand name but changing the extension — `example.net` or `example.co` instead of `example.com`. Cheap to register and easy to overlook.
- Combosquatting: Appending believable words — `example-login.com`, `example-billing.com`, `secure-example.com`. Because the real brand name is fully intact, these are especially convincing.
- Subdomain tricks: Placing the brand in a subdomain of an attacker-controlled domain — `example.com.login-verify.net`. The eye latches onto "example.com" and ignores the real registered domain at the end.
- Hyphenation and doubling: `ex-ample.com`, `exaample.com` — small distortions that survive a quick read.
Why lookalike domains succeed
The attack exploits how people read, not a flaw in any software. Three mechanisms do most of the work.
Recognition beats verification. The brain pattern-matches a familiar word rather than parsing each character. Under time pressure — an urgent email, a payment deadline — nobody audits a URL letter by letter.
Truncation and trust cues hide the truth. Email clients and mobile browsers shorten displayed addresses. A long combosquatted or subdomain-based URL often shows only the part the attacker wants you to see. Add a padlock icon and the illusion is complete.
A valid TLS certificate looks legitimate. Free certificates are trivial to obtain for any domain an attacker controls. The padlock proves the connection is encrypted — not that the site is who it claims to be. Many users conflate the two, and attackers rely on that confusion.
Email authentication gaps. If your real domain hasn't published strong SPF, DKIM, and DMARC records, attackers can spoof it directly. But even with those in place, a lookalike domain is a separate registration the attacker fully controls, so it can pass its own authentication checks and sail past basic filters.
How lookalike domains fuel phishing
Once a lookalike is registered, the attacker assembles the rest of the machine:
- MX records get configured so the domain can send and receive email — enabling phishing that appears to come from your company or that targets your staff and vendors.
- A TLS certificate is issued, giving the fake site a padlock and an `https://` address.
- A cloned login or checkout page is deployed, often a pixel-perfect copy of your real site pulled straight from your public HTML.
- The campaign launches — emails, SMS, ads, or malicious links — driving victims to the lookalike to enter credentials, card numbers, or approve fraudulent payments.
The credentials or payments captured then feed account takeover, wire fraud, or resale on criminal markets. A single convincing lookalike domain can power thousands of individual attacks.
How to spot a lookalike domain
Train yourself and your team to slow down and check the parts that matter.
- Read the domain right-to-left from the TLD. The true owner is the label immediately left of the final `.com`/`.net`. In `example.com.login-verify.net`, the real domain is `login-verify.net` — not example.
- Look for extra words and hyphens. Legitimate brands rarely route logins through `brand-secure-login.com`.
- Watch for character oddities. A domain that looks right but was pasted from an email may contain homoglyphs invisible to the eye.
- Distrust the padlock as proof of identity. Encryption is not authenticity.
- Check the sender path, not the display name. Display names are free text; the actual sending domain is what counts.
- Be suspicious of urgency. Deadline pressure paired with a link is the classic phishing signature.
The problem: your customers won't do any of this reliably, and neither will busy employees. Manual vigilance doesn't scale — you can't ask every user to audit every URL. That's why the real defense is finding these domains before they're used against you.
How to stop lookalike domains
Prevention runs on two tracks: harden what you own, and detect what attackers register.
Lock down your own domain.
- Publish and enforce SPF, DKIM, and DMARC with a reject policy so your legitimatedomain can't be spoofed outright.
- Register the obvious variants yourself — common misspellings, key TLD swaps, and hyphenated forms. It's cheaper to own `example.net` than to fight someone who does.
- Enforce strong authentication (MFA, phishing-resistant where possible) so stolen credentials alone can't unlock accounts.
Detect the ones you can't pre-register. You cannot buy every permutation — the combinatorial space of homoglyphs, combosquats, and TLDs is effectively infinite. What you can do is watch for registrations as they happen. This is where undoppel.io does the work for you: it generates the full range of typo, homoglyph, TLD-swap, and combosquat permutations of your domain, then checks which ones actually exist — resolving DNS, inspecting MX records to see which are mail-ready, reading WHOIS registration details, and watching certificate transparency logs for freshly issued TLS certs on lookalike names.
Those signals matter because they tell you not just that a lookalike exists, but how far along it is. A newly registered domain with MX records live and a TLS certificate issued is a domain being armed for phishing — the window to act is now, before the campaign launches. Catching it at registration, rather than after your customers report a scam, is the difference between a takedown and a breach.
What to do next
Find out which lookalike domains already target your brand. Run a free scan at undoppel.io — enter your domain and see the typosquats, homoglyphs, combosquats, and TLD variants that exist right now, which ones are configured to send email, and which have certificates suggesting an active phishing setup. Start there, then prioritize takedowns and defensive registrations based on what's actually live rather than guessing.