Lookalike domains and typosquatting

A lookalike is a domain that a person could mistake for yours: a dropped letter, two letters swapped, a neighbouring key, a zero for an o, rn for m, a hyphen inserted, a login- prefix, or the same name under a different ending. People register them for three reasons.

Why they exist

• Typo traffic. Mistyped addresses land on a page of adverts or a redirect to a competitor.
• Misaddressed mail. A lookalike with MX records receives every message sent to a mistyped address, which can include invoices, password resets and attachments. This is the quiet one.
• Phishing. login-yourbank.co.uk or yourbrand.support with a copied logo is the standard opening of credential theft and invoice fraud.

Finding them

The lookalike finder generates the permutations, resolves each one and checks for MX records, and sorts the ones that can receive mail to the top. Registered variants are not all hostile; many are unrelated businesses or defensive registrations by the brand itself. The ones to look at first are variants with MX records, brand-plus-prefix names, and recently registered names (open the Registry facet to see the date).

What to do

• Register the closest variants yourself before someone else does: the obvious typos and your name under .co.uk, .uk and .com at least. They cost less than a single incident.
• Keep DMARC at enforcement on your real domain. Lookalikes can imitate you, but with p=reject they cannot spoof your exact domain, which removes the most convincing attack.
• Report imitation. Registrars publish an abuse contact (shown on the Registry facet), and Nominet runs a dispute service for .uk names used in bad faith. Hosting providers and the big browsers' safe-browsing programmes also take reports of live phishing pages.
• Train the people who pay invoices to check the sender domain character by character when bank details change.