Technical guide
How to detect lookalike domains
Name similarity starts the investigation; DNS, certificates, content, and context determine which domains deserve attention first.
The problem
Buying every variation is unrealistic. Attackers can use plausible typos, alternate TLDs, international characters, or terms such as login and support to look trustworthy.
Risks and assumptions
Phishing aimed at customers or employees.
Misdirected email captured by typo domains.
Reputational damage from copied brand identity.
Procedure
Normalize the brand
Separate labels, abbreviations, hyphens, and relevant IDN forms.
Generate plausible variants
Prioritize omissions, substitutions, transpositions, adjacent keys, and semantic combinations.
Check registration and resolution
A domain with DNS, MX, or a certificate deserves more attention than an unregistered name.
Collect minimal evidence
Review nameservers, certificate, favicon, and visible content without submitting forms.
Classify before escalating
Separate coincidence, legitimate use, parking, and possible abuse.
Limits of a manual approach
Visual similarity depends on fonts, language, and device.
Redacted WHOIS does not prove ownership.
An inactive domain may activate later, making continuous observation useful.
Example
A one-letter variant with active MX deserves more scrutiny than an unregistered string. A fresh certificate and copied favicon raise its priority further, without proving malicious intent.
Common mistakes
Calling every similar domain malicious.
Interacting with suspicious forms outside a safe process.
Checking only the brand's primary TLD.
Recommendations
Use documented priority criteria.
Preserve dated evidence and source.
Coordinate security, brand, and legal review for external action.
Frequently asked questions
Does a certificate make a site legitimate?
No. It protects transport and demonstrates technical control for issuance, not business legitimacy.
Should we buy every variation?
Usually not. Register the highest-risk defensive names and monitor the broader space.
Can phishing be confirmed automatically?
Not reliably in every case. Signals prioritize human review.
Watch brand variations
Monitor lookalike domains and preserve signals for consistent review.
Explore the moduleRelated content
Digital impersonation
Brand protection and lookalike domain monitoring
Detect lookalike domains, typosquatting variations, and impersonation signals that may affect customers, employees, and reputation.
Technical guide
What is typosquatting and how do you detect it?
Learn common typosquatting techniques, how to identify plausible variations, and which evidence to review before responding.
Free tool
Basic domain security checker
Run a point-in-time SSL, DNS, SPF, and DMARC review with clear explanations and limits; this is not a vulnerability scanner.