What is lookalike domain phishing, and how do you stop it?

Lookalike domain phishing doesn't forge your domain. It registers a different one that looks almost the same, then sends mail that passes every authentication check. Your filters see a properly authenticated message from a new domain. Your staff see a name they trust.

What is a lookalike domain?

A lookalike domain, sometimes called a cousin domain, is a domain chosen to be confused with a real one. The target might be your own domain, used to fool your staff, or a supplier's, used to redirect payments.

Take a fictional company, Brightwater Supply, that sends mail from brightwatersupply.com. Here are the main techniques an attacker could use against it:

Microsoft describes the same idea in its anti-phishing documentation: an example impersonation of contoso.com is ćóntoso.com, and even contosososo.com might be seen as an impersonation attempt.

How homoglyph (IDN) attacks work

Domain names can contain non-ASCII characters through internationalized domain names (IDNs). In DNS, each such label is stored as an ASCII-compatible "A-label." RFC 5890 defines the prefix "xn--" that "appears at the beginning of every A-label."

So brightwаtersupply.com, with a Cyrillic а (U+0430) in place of the Latin a, is really xn--brightwtersupply-zdn.com in DNS. If a mail client or browser shows the Unicode form, the two names look the same.

The Unicode Consortium documents this problem in Unicode Technical Standard #39. Its own example is "paypal" spelled with Cyrillic а characters, which it calls a mixed-script confusable. UTS #39 also defines a "skeleton" algorithm that maps confusable characters to a common form, which is how detection tools compare a suspect name with a protected one.

Why don't SPF, DKIM and DMARC stop lookalike domains?

Because the attacker owns the domain. SPF, DKIM and DMARC prove that a message was authorized by the domain in the From address. They say nothing about whether that domain is the one the reader thinks it is.

The DMARC standard is direct about this. RFC 9989, section 2.2 says: "DMARC can only be used to combat specific forms of exact-domain spoofing directly." It continues that it "does not address the use of visually similar domain names or abuse of the RFC5322.From human-readable display name." Display-name attacks are listed as out of scope in section 2.4.

Microsoft makes the same point: impersonation "can pass email authentication checks (SPF, DKIM, and DMARC) if the attacker created a lookalike domain and published valid DNS records."

That doesn't make DMARC pointless. A DMARC reject policy on your real domain forces attackers to move to lookalikes, which are easier to spot and to filter. Our guide on moving DMARC from none to reject covers that step, what is email spoofing explains the exact-domain attacks DMARC does stop, and how to stop spoofing of your domain sets out the full defense.

How do lookalike domains get used?

Lookalike domains are a standard tool in business email compromise. A typical pattern:

1. The attacker learns who you pay, often from a compromised mailbox or public information.
2. They register a lookalike of the supplier's domain and set up authentication so their mail is delivered cleanly.
3. They reply into a real conversation, or start a new one, from the lookalike address with the supplier's display name.
4. They ask for a change of bank details, an urgent payment, or a login to a fake portal.

The same approach targets your own staff with a lookalike of your domain: a "CEO" asking for gift cards, or "IT" asking for a password reset.

How to detect lookalike domain phishing

No single control catches every variant. Layer them.

Turn on impersonation detection

• Microsoft 365: Domain and user impersonation protection is part of anti-phishing policies in Microsoft Defender for Office 365. Microsoft states that anti-phishing protection for all cloud mailboxes "doesn't include impersonation protection." If you have Defender for Office 365, add your own domains and key partner domains as protected domains, and your executives and finance staff as protected users. By default, no domains or users are protected and the default action is "Don't apply any action," so this needs configuring.
• Google Workspace: Under Apps > Google Workspace > Gmail > Safety > Spoofing and authentication, Google offers protection against "domain spoofing based on similar domain names" and "spoofing of employee names" (Google Workspace Admin Help). The default action is to keep the message in the inbox and show a warning; you can choose spam or quarantine instead.
• At your filtering gateway: Ask whether the gateway checks for lookalikes of your domains and how it handles them.

Use display-name and first-contact warnings

Attackers rely on the display name. Show people when a "colleague" is actually external:

• External sender tags in Outlook. Microsoft's Set-ExternalInOutlook adds an External icon to messages from outside your organization. It can take 24 to 48 hours to appear after you enable it.
• First contact safety tip. Available in anti-phishing policies for all Microsoft 365 cloud mailboxes, it shows "You don't often get email from…" on unfamiliar senders. Microsoft recommends turning it on. A lookalike domain is, by definition, a new sender.
• Gmail employee-name protection. Flags messages that use a name from your directory but don't come from your domain.

Read the address, not the name

Train staff on a short routine for any request involving money, credentials or data:

1. Expand the sender and read the full address, letter by letter.
2. Compare it with the address in a previous genuine thread or your contacts.
3. Treat an "External" tag or first-contact tip on a supposed colleague as a red flag.
4. Check headers if unsure. The Email Header Analyzer shows the From, Return-Path and authentication results, including the domain that actually passed DKIM.
5. Verify payment or bank-detail changes by phone, using a number you already had.

Defensive registrations: worth it?

Registering lookalikes of your own domain removes the easiest options from attackers. It can't remove all of them, because the number of variants is effectively unlimited.

A reasonable short list:

• Your main name in the top-level domains your customers know, such as .com, .net and your country domain.
• The most obvious typos: one missing letter, one doubled letter, adjacent-key swaps.
• Hyphenated and unhyphenated forms.
• Common "service" variants if you use them, such as -billing or -support.

Then lock each one down so it can't be abused if someone spoofs it:

Redirect the web addresses to your real site. You can check each parked domain with the DMARC Checker.

Our research on the top 1,000 domains found that 38.3% don't enforce DMARC on their main domain. Parked defensive domains are even easier to forget.

What to do when you find a lookalike of your domain

Finding one isn't unusual, and it isn't always malicious. Some are registered by domain resellers or by people with a similar name. Act on evidence, in this order:

1. Check whether it can receive or send mail. Run the name through the MX Lookup. A lookalike with MX records and SPF set up is being prepared for email, which is a stronger warning sign than a parked page.
2. Block it at your filter. Add the exact domain to your organization's blocked senders list so mail from it is stopped or quarantined. Use your filter's block list, not individual mailbox rules, so everyone is covered.
3. Warn the people most likely to be targeted. Finance, payroll, executives and their assistants. Tell them the exact name and what it looks like next to the real one.
4. Tell your customers and suppliers if the domain imitates you. They are the ones who will receive the fake invoices. A short notice with your real domain and a call-back number is enough.
5. Report abuse. Send the evidence, such as full message headers, to the registrar's abuse contact listed in the domain's registration data, and to the host if it serves a phishing page.
6. Keep records. Save the messages with headers. If money moves, you'll need them for your bank and for any police report.

If a lookalike of a supplier's domain targets you, tell the supplier straight away. Their other customers are probably receiving the same messages.

Next steps

• Check whether your platform's impersonation protection is licensed and turned on, and add your own and key partner domains.
• Enable external-sender tags and the first contact safety tip, or Gmail's similar-domain and employee-name warnings.
• Register a short list of obvious lookalikes and publish null MX, -all SPF and DMARC reject on each.
• Agree a call-back rule for any change to payment details.
• Make sure your real domain enforces DMARC, so attackers can't skip the lookalike step. The free DMARC Checker shows where you stand, and iBlockSpam's phishing and spoofing protection adds a filtering layer before mail reaches your users.

iBlockSpam's Lookalike Domain Watch does the checking for you: it looks for typo and look-alike versions of your domain every day and alerts you when one is registered or gets a mail server. It detects them; it can't take them down.

Browse our other phishing and threat guides.