Lookalike Domain Watch

Why look-alike domains matter

Your DMARC policy stops other people sending mail from your exact domain. It can't stop someone registering a name that only looks like it: examp1e.com, exampel.com or example.co. Those domains can pass SPF, DKIM and DMARC for themselves, so they're a common tool in invoice fraud and phishing aimed at your customers and staff. Our guide on lookalike domain phishing shows how the attacks work.

The earlier you know a look-alike exists, the sooner you can warn people and report it.

What we check

For each protected domain we build a list of likely look-alikes, riskiest first:

• Other endings: the same name on .com, .net, .co, .io, .org, .biz and your country ending.
• Look-alike characters: rn for m, 0 for o, 1 or i for l, vv for w, cl for d, and a small set of international characters that look like Latin letters.
• Typos: a missing, swapped, doubled or extra letter, a nearby key on the keyboard, and added or removed hyphens.

Every day we look each name up in public DNS. For names that are registered, we also check public Certificate Transparency logs, which show when a website certificate has been issued for the name.

What an alert tells you

You get an email when a look-alike is newly registered, or when one starts accepting email (it gets MX records). Each look-alike is rated by risk: a name with a mail server is more dangerous than a parked one. The portal lists them with what we found and when, and lets you mark names you own as known.

What to do when one appears

1. Check whether it's yours. Someone in your business may have registered it. If so, mark it as known.
2. Block it. Add the domain to the blocked senders list in your filtering panel, so mail from it doesn't reach your users. See allow and block lists.
3. Warn the people it could fool. Tell staff, and customers who pay you, to check the sender's domain carefully and to confirm any change of bank details by phone.
4. Report it. Send the registrar and host an abuse report with the domain name and any phishing emails or pages you've seen. Our guide on what to do when customers are phished by a fake version of your company walks through it.
5. Keep watching. If a parked look-alike later gets a mail server, you'll get another alert.

Honest limits

• It detects; it can't take domains down. Removal is up to the registrar, the host or a court.
• It can't see every possible name. We check up to 150 likely variations per domain. A domain that's very different from yours, such as example-payments.com, won't be found.
• Registration isn't intent. Many look-alikes are parked by domain investors or registered by the brand itself. The risk rating helps you decide which to act on.
• Public data only. We use public DNS and Certificate Transparency logs. We can't see who registered a domain when registration details are private.

Included in every plan

Lookalike Domain Watch is included in Protect and Protect Plus for every protected domain; see pricing. It sits alongside DMARC monitoring, which shows who sends mail using your exact domain, and domain monitoring, which alerts you when your own DNS records change.