# Lookalike Domain Watch URL: https://iblockspam.com/features/lookalike-domain-watch Last updated: 2026-10-10 > iBlockSpam checks look-alike versions of your domain every day and alerts you when one is registered or gets a mail server. Included in every plan. Attackers register names that look like yours, such as a missing letter or a different ending, and use them to fool your customers and staff. We check those names every day and tell you when one appears. ## Why look-alike domains matter Your DMARC policy stops other people sending mail from your exact domain. It can't stop someone registering a name that only looks like it: `examp1e.com`, `exampel.com` or `example.co`. Those domains can pass SPF, DKIM and DMARC for themselves, so they're a common tool in invoice fraud and phishing aimed at your customers and staff. Our guide on [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) shows how the attacks work. The earlier you know a look-alike exists, the sooner you can warn people and report it. ## What we check For each protected domain we build a list of likely look-alikes, riskiest first: - **Other endings:** the same name on .com, .net, .co, .io, .org, .biz and your country ending. - **Look-alike characters:** `rn` for `m`, `0` for `o`, `1` or `i` for `l`, `vv` for `w`, `cl` for `d`, and a small set of international characters that look like Latin letters. - **Typos:** a missing, swapped, doubled or extra letter, a nearby key on the keyboard, and added or removed hyphens. Every day we look each name up in public DNS. For names that are registered, we also check public Certificate Transparency logs, which show when a website certificate has been issued for the name. ## What an alert tells you You get an email when a look-alike is newly registered, or when one starts accepting email (it gets MX records). Each look-alike is rated by risk: a name with a mail server is more dangerous than a parked one. The portal lists them with what we found and when, and lets you mark names you own as known. ## What to do when one appears 1. **Check whether it's yours.** Someone in your business may have registered it. If so, mark it as known. 2. **Block it.** Add the domain to the blocked senders list in your filtering panel, so mail from it doesn't reach your users. See [allow and block lists](https://iblockspam.com/features/allow-block-lists). 3. **Warn the people it could fool.** Tell staff, and customers who pay you, to check the sender's domain carefully and to confirm any change of bank details by phone. 4. **Report it.** Send the registrar and host an abuse report with the domain name and any phishing emails or pages you've seen. Our guide on [what to do when customers are phished by a fake version of your company](https://iblockspam.com/blog/customers-phished-by-fake-version-of-your-company) walks through it. 5. **Keep watching.** If a parked look-alike later gets a mail server, you'll get another alert. ## Honest limits - **It detects; it can't take domains down.** Removal is up to the registrar, the host or a court. - **It can't see every possible name.** We check up to 150 likely variations per domain. A domain that's very different from yours, such as `example-payments.com`, won't be found. - **Registration isn't intent.** Many look-alikes are parked by domain investors or registered by the brand itself. The risk rating helps you decide which to act on. - **Public data only.** We use public DNS and Certificate Transparency logs. We can't see who registered a domain when registration details are private. ## Included in every plan Lookalike Domain Watch is included in Protect and Protect Plus for every protected domain; see [pricing](https://iblockspam.com/pricing). It sits alongside [DMARC monitoring](https://iblockspam.com/features/dmarc-monitoring), which shows who sends mail using your exact domain, and [domain monitoring](https://iblockspam.com/features/domain-monitoring), which alerts you when your own DNS records change. ## Frequently asked questions ### Which look-alike names does Lookalike Domain Watch check? Up to 150 variations of each protected domain: other endings such as .com, .net, .co and your country ending, look-alike characters such as rn for m or 0 for o, a few look-alike international characters, and typos such as a missing, swapped, doubled or extra letter. ### Can you take a look-alike domain down for us? No. Lookalike Domain Watch detects look-alike domains; it can't take them down. Each alert explains what we found and the next steps, such as reporting the domain to its registrar and host, and warning staff and customers. ### How quickly will I hear about a new look-alike? Each candidate name is checked about once a day. A name that's registered or starts accepting email is normally reported within a day of it appearing in public DNS. New finds are confirmed by a second DNS lookup before we alert you. ### What if a look-alike domain is actually ours? Mark it as known in your portal. Many businesses own their .net or misspelled names to protect their brand, and marking them stops repeat alerts for those names. --- Source: iBlockSpam, https://iblockspam.com/features/lookalike-domain-watch (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt