Look-alike domains: spotting phishing before the first e-mail is sent
How typosquatting works, the ten ways attackers vary a domain name, why registration is the earliest warning you will get, and what to do when a look-alike appears.
The most effective phishing campaigns against small companies do not break into anything. Someone registers yourcompnay.com, waits a few days so the domain is no longer brand new, sets up a mail server, and writes to your customers, or to your own accountant, from finance@yourcompnay.com. The message looks right because it is: the attacker copied your signature from a public e-mail. Only the domain is wrong, by two letters.
Because the attacker needs the domain before anything else, the registration is the earliest signal you will ever get, usually days or weeks before the first message. Watching for it is cheap. Perimetry does it on every audit.
The ten ways to vary a domain
Given example.com, the candidate list is generated mechanically:
| Technique | Examples |
|---|---|
| Other extensions | example.co, example.net, example.org, example.io, example.shop |
| Omission | exmple.com, exampl.com |
| Transposition | examlpe.com, exapmle.com |
| Repetition | exaample.com, examplle.com |
| Homoglyphs | examp1e.com (one for l), exarnple.com (rn for m), `examp |
| Vowel swap | exemple.com, exomple.com |
| Added words | example-login.com, example-support.com, myexample.com, example-pay.com |
| Keyboard neighbours | wxample.com, exsmple.com |
| Hyphenation | ex-ample.com, exam-ple.com |
| Subdomain dot | exam.ple.com, ex.ample.com |
A single domain produces between 150 and 300 plausible candidates. Almost all are unregistered, which is good news and the reason the check is fast: an unregistered domain has no name servers, and a DNS lookup tells you so in milliseconds without contacting the registrar.
What “registered” means and does not mean
Perimetry reports a candidate as registered when it has name servers. That is the first signal, not proof of malice. Plenty of look-alikes are registered by domain investors who park them with advertisements, by competitors, or by your own company years ago. The report therefore adds two facts to each registered look-alike:
- Does it have a mail server? An MX record on a look-alike domain means somebody intends to send or receive mail as it. That is the configuration a phishing campaign needs and a parked domain does not.
- Does it have a website? The report notes whether the domain answers on HTTPS and what the page title is. A clone of your own home page is unmistakable.
A look-alike with mail set up and a copied site is a high-severity finding. A registered domain with neither is medium: worth a look, not an emergency.
The ones you own
Many companies defensively register a handful of variants and point them at the main site. Perimetry lets you list these as owned; they are then excluded from the look-alike section and checked instead as your own domains, including whether they correctly refuse mail (see SPF, DKIM and DMARC, section “Domains that never send mail”). A defensively registered domain that accepts mail is a domain an attacker does not need to buy.
When a new look-alike appears
Perimetry remembers which look-alikes were registered at the previous audit. A domain that was free last week and registered this week appears in the changes section of the report, with its name servers, mail server and web page. That is the moment to act, in this order:
- Check who registered it. The WHOIS record is usually redacted, but the registrar and the registration date are visible. A registration two days ago with a privacy service and a mail server already configured is a different situation from a five-year-old parked domain.
- Warn the people who would be targeted. Your finance team, your clients, your suppliers. A short message (“we will never e-mail you from any domain other than example.com; if you receive something from a similar address, call us”) costs nothing and defeats most campaigns.
- Block it at your mail gateway. Add the look-alike to your organisation’s blocklist so that nobody internal receives mail from it.
- Report it. If the domain hosts a copy of your site or a login page, report it to the registrar’s abuse address and to the hosting provider. Most take down obvious phishing within a day. Google Safe Browsing and Microsoft SmartScreen both accept reports; once listed, browsers warn visitors.
- Consider a dispute. For a domain that uses your trade mark and targets your customers, the UDRP procedure (and its equivalents for national extensions) usually succeeds, but it takes weeks and costs more than the domain. Reserve it for domains that stay up.
What you cannot do, and what to do instead
You cannot register every variant; the list is open-ended and extensions multiply every year. Register the handful that matter (your name on .com, .net, the national extension of each country you operate in, the two or three most likely typos) and watch the rest.
You cannot stop someone from registering a look-alike. You can make sure it does not work: publish a strict DMARC policy on your real domain so that attackers cannot simply forge your address and must use a look-alike, which is visible; and tell your clients which domain is yours, once, in writing.
What the report looks like
New look-alike domain registered: yourcompnay.com — high Registered since this week’s audit (name servers at a privacy-focused registrar). Has a mail server (
mx1.example-host.net) and answers on HTTPS with the title “Your Company — Sign in”. Treat as an active phishing setup: warn clients and staff, block the domain at your mail gateway, report to the registrar and hosting provider.
Candidates that stay unregistered are not listed; they would bury the few that matter.