Lookalike domains: how they work and how to get them taken down
How attackers pick a name that imitates yours, which signals show the risky ones, how to report to the registrar, and how to block them in mail.
A lookalike domain is a registered name that imitates yours closely enough to fool a quick glance, such as a digit in place of a letter, an extra word like “login”, or your name under another ending. Attackers use them to send phishing mail, to host fake sign-in pages and to impersonate your staff to your customers.
How lookalikes are made
The common tricks are a character swapped for a similar-looking one (a digit one for a letter l, or a Cyrillic “а” for a Latin “a”, called a homoglyph); a letter dropped, doubled, swapped or typed next to its neighbor on the keyboard; a hyphen or an extra word such as “login”, “secure” or “support”; and the same name under another ending.
Internationalized (IDN) names have two forms: the Unicode form that people see, which can look identical to yours, and the ASCII form that starts with xn-- and is what DNS uses. Check both. ProbeKit always shows both.
Risk signals
A registered name is not the same as a threat: most lookalikes are parked or unused. ProbeKit rates a lookalike high when it was registered in the last 30 days and has mail servers or a certificate, medium when it has mail or a real website, and low when it is parked or empty.
A name with mail servers can send mail from the day it is registered. A fresh certificate usually means someone is preparing a web page. Neither proves bad intent, which is why a monitor’s first scan only lists what already exists and later scans alert on new, high-risk names.
You never need to visit the site to judge it. DNS and the public registry data (RDAP) say whether a name exists, when it was registered and at which registrar. Do not open a suspicious page in your normal browser to find out more.
Reporting to the registrar
1. Collect the evidence: the domain in both forms, the date it was registered, the registrar, and screenshots or a copy of the phishing mail.
2. Find the registrar’s abuse contact in the registry record of the domain. ProbeKit looks it up live for you and does not store it.
3. Send a short report to that abuse address: which name the domain imitates, why it is harmful and what you found. Registrars act faster on evidence of phishing or trademark abuse than on a suspicion.
4. If the site is live, also report it to the hosting provider and to the reporting forms of the browser safe-browsing services.
5. Block the domain in your mail filter and warn the people it could reach.
Some registrars act within a day, some take weeks, and a few never answer. For a trademark you hold, a UDRP complaint is the formal route, and a lawyer should guide it.
Block lists
While the takedown runs, block the domain. ProbeKit exports the open lookalikes as a CSV with each domain in both forms, ready to add to your mail filter’s block list.
Prevention
Register the endings and the obvious typos that matter to you, publish DMARC at p=reject so that nobody can send as your exact domain (see moving DMARC to reject), and watch for new registrations. DMARC does not stop a lookalike from sending as itself, which is why watching matters.
Common questions
- Is every lookalike domain a threat?
- No. Most are parked or unused. A new registration with mail servers or a certificate deserves attention first.
- Can I make a registrar take a domain down?
- You can report it and send evidence; the decision is the registrar’s. Phishing and clear trademark abuse are the cases registrars act on most reliably.
- Does ProbeKit visit the lookalike site?
- No. It only asks DNS and the public registry whether the name exists, never the site itself.
- What does DMARC do against lookalikes?
- It stops others from sending as your exact domain. It does not stop a lookalike domain from sending mail as itself, so you still need to watch for new registrations.
Try it on your own setup:
Check a domain for lookalikes