How it works
Lookalike domains are easy to mistake for the real one: swapped or missing letters (exmaple.com), “rn” instead of “m” (exarnple.com), a different extension (example.shop instead of example.com), a hyphen or an add-on such as example-login.com. Internationalized domain names add accented letters and characters from other scripts that look almost identical in the browser (homoglyphs).
Typosquatting bets on typing mistakes: whoever mistypes ends up on the other domain. Phishing and invoice fraud rely on a quick glance instead: an email from billing@examp1e.com can pass SPF, DKIM and DMARC – for the attacker’s own domain. The protection on the real domain doesn’t come into play.
Why it matters
Lookalike domains are the tool of choice for CEO fraud and fake invoices: attackers write to customers, suppliers or accounting from an almost identical address, often as a reply in a real email thread they have been reading. Bank details get “updated” and payments go to strangers.
Add phishing pages with the client’s logo, stolen credentials and brand damage. Because the domain belongs to a third party, neither DMARC nor your own DNS settings help – only early detection and reporting do.
How to prevent it
- Register the obvious variants of key client domains yourself (other extensions, common typos) and redirect them to the real domain.
- Look at newly registered variants with a website or mail server right away, and report abuse to the registrar (contact via RDAP) and the hosting provider.
- Report phishing pages to Google Safe Browsing and give customers, staff and accounting a concrete heads-up.
- Always confirm changed bank details through a second channel, for example by calling back a known number.
- Lock down the real domain with DMARC p=reject so attackers have to fall back on lookalikes – which can be monitored.
How DomainWarn detects it
The Look-alike domains check generates up to 250 variants of the registrable domain (homoglyphs, other extensions, typos, hyphens, common add-ons, accented letters as IDN) and checks them daily via DNS: a website (A or AAAA record) or a mail server (MX) means active, name servers only means parked. It uses no WHOIS lookups or third-party databases.
The first run sets the baseline; whatever already exists then counts as existing and raises no warning. A variant registered later that is active is a warning and appears in the timeline; parked variants and ones that disappear again are notices. DomainWarn never reports your own monitored domains or variants marked as “ours”.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.