Lookalike domains and typosquatting: what to do

A lookalike domain is registered to be mistaken for yours. Typosquatting first meant catching visitors who mistyped an address. The same names now also carry email and login pages that pass for yours at a glance. No one has to break into your systems to do this: the domain is someone else's, registered legally, and only its use is abusive.

How lookalikes are made.

Most lookalikes come from a handful of simple changes. For example.com:

The last row matters more than it looks. An FBI warning about criminals who pose as companies to defraud their suppliers lists company-usa.com, companygroup.com and co-pany.com as the kind of addresses used to impersonate company.com. Open-source tools such as dnstwist generate all of these variants automatically, for attackers and defenders alike.

Why they work.

• A glance is all most addresses get. A reader who sees a familiar name and a familiar logo rarely checks every letter of the address.
• A lookalike that receives mail enables invoice fraud. With a domain one letter off, a fraudster can write to your customers as you, or to you as a supplier, ask for new bank details, and receive the replies.
• Your DMARC policy does not cover it. DMARC lets receivers reject mail that falsely claims to come from your exact domain. A lookalike is a different domain, with its own owner, who can give it valid SPF, DKIM and DMARC records. Mail from it passes authentication.
• The padlock does not help either. HTTPS shows that the connection is encrypted to that domain, not that the domain belongs to you. Certificates for lookalikes are issued like any other.

Lookalikes in other alphabets.

Internationalised domain names can use letters from other scripts, and some are almost identical to Latin ones: the Cyrillic а and е look the same as the Latin a and e. еxample.com with a Cyrillic е is a different domain, stored as xn--xample-2of.com. Unicode publishes a list of these confusable characters. Chrome, for example, uses it to show the encoded xn-- form instead of the Unicode letters when a name mixes scripts or resembles a popular domain.

Find the ones registered against you.

1. Generate the likely variants of each domain you use, with a tool such as dnstwist or the check described below.
2. See which exist and what they do. A name that resolves is registered. One with MX records can receive email, which makes it the most useful kind for invoice fraud. A web page that copies your login page is a phishing site.
3. Find out who owns them. A WHOIS or RDAP lookup names the registrar and its abuse contact: ICANN Lookup covers generic endings such as .com, and the registry's own search covers country endings such as .se. The owner's personal details are often hidden.
4. Rule out your own. Marketing, a former agency or a supplier may have registered some on your behalf. Compare with your list of domains before you report anything.
5. Watch certificate transparency. Every publicly trusted certificate is recorded in public logs, which search services such as crt.sh make searchable. A new certificate for a lookalike can mean a site is about to go live.
6. Repeat it. Lookalikes can be registered at any time, so a single check goes out of date.

Reduce the risk.

• Register the closest variants yourself: your name under the endings your customers expect, such as .se, .com, .eu and .nu, and the single-letter typos of your main domain. You cannot register every variant, so start with the ones closest to the addresses you actually use.
• Lock down the ones you own. A domain that never sends mail should publish v=spf1 -all and a DMARC policy of p=reject, so no one can send mail in its name. The DMARC guide shows the two records.
• Never change bank details on an email alone. Confirm by phone, using a number you already have, not one from the message. The FBI warning above gives the same advice for checking who really sent an email.
• Tell customers and staff which domains you use, and that you do not ask for changed payment details by email.
• Enforce DMARC on your real domains anyway. It stops spoofing of the exact address, which pushes attackers onto lookalikes, and lookalikes can be found and taken down.

Get a lookalike taken down.

1. Keep the evidence: screenshots of the page, the email with full headers, and dates.
2. Report it to the registrar's abuse contact. ICANN requires every registrar it accredits to keep an abuse contact and to investigate reports promptly. The address is shown in the RDAP lookup.
3. Report it to the host of the web page or mail server.
4. Report phishing pages to Google Safe Browsing and Microsoft, so browsers that use their lists warn visitors.
5. Use a dispute procedure if the name infringes your rights:
   • For .com and other generic endings, the UDRP. You must show that the domain is identical or confusingly similar to your trademark, that the holder has no rights or legitimate interest in it, and that it was registered and is used in bad faith. At WIPO a case normally takes about two months and costs USD 1,500 for up to five domains with one panelist. The result is a transfer or cancellation, never damages.
   • For .se, ATF, administered by WIPO for Internetstiftelsen. The right can be a trademark, a company name, a surname or another name protected in Sweden, the domain must have been registered or used in bad faith, and the holder must lack any right to it. A case takes about three months and ends in transfer or deregistration.
6. Report fraud to the police if money or data has been lost.

What TrustSek checks.

The attack surface module generates up to 400 lookalikes of the domain, most plausible first: other endings, look-alike characters, missing, swapped, neighbouring-key and extra letters, hyphens, and the name with words common in phishing, such as login or secure. The method follows dnstwist. It counts the lookalikes that resolve in DNS. For up to 30 of them, it checks whether they can receive email, naming those that can in the finding, and asks Google Safe Browsing and URLhaus whether they are listed for phishing or malware.

Only the most serious of the three is reported. A lookalike counts as malicious only when one of the two lists names it; a mention in a threat report is not enough. The check against those lists needs the sources to be configured and answering, and when neither answers, the lookalikes are counted but never reported as clean.

The scan never connects to a lookalike: it uses DNS and the two lists. It has limits. It does not generate Unicode lookalikes, a registered domain that does not resolve is not counted, and it is a snapshot at the time of the scan, not continuous monitoring. Read more about the external attack surface.

Questions

Should we register every lookalike of our domain?

No. A single name has hundreds of variants, and new endings keep appearing. Register the closest variants of the addresses you actually use, and handle the rest by checking and reporting.

A lookalike is registered but shows no website. Is it harmless?

Not necessarily. A domain can send and receive email without a website, and a lookalike may be registered well before it is used. Check whether it has MX records, and check again later.

Is typosquatting illegal?

Registering a similar name is not unlawful in itself. Using it for fraud is a crime, and a name that infringes a trademark or company name can be transferred through the UDRP, ATF or a court.

See which lookalikes are registered

The free check counts the registered lookalikes of your domain and names the ones that can receive email, alongside the five other modules.

Your domain

Check your domain

Free, no sign-up. Takes about 30 seconds.