How we find the names that copy yours

A lookalike is a domain that could be confused for your domain.

People register them for many reasons, and they can be used for impersonation.

When an attacker registers and uses a lookalike domain, they bypass every control you have set on your own domain. The lookalike is not your domain, after all. The attacker controls it, so it can pass every check of its own.

Lookalike domains distribute malware, hide malicious behavior in logs, host phishing pages, sell knock-off products, and send mail that looks like yours for business email compromise. In February 2026 Malwarebytes reported that 7zip[.]com, one hyphen away from the real 7-zip.org, served a trojanized installer that turned home computers into proxy nodes. Criminal groups register names built from their target and a word such as -sso, -servicedesk or -helpdesk, as CISA has documented.

The tricks

There are many ways to create a lookalike domain. Here are a few of the patterns we see, using an invented domain, acmebank.com. The marked characters are the ones that changed.

When you give us your domain, we watch for any lookalike that shows up. We compare each scan with the history of that name, so we can tell you more than that a new domain exists. We can tell you when a domain has changed, what the change is, and what that does to the risk.

How can these domains be found?

There are two approaches. Passive techniques read data that other people collect:

• Passive DNS data
• Whois data
• Newly registered domain feeds
• Certificate Transparency logs

New domains in those logs are compared with a set of names by fuzzy matching. It is a broad technique. The feeds are expensive, the matching takes a lot of computing, and there is a delay in getting the data, so a domain can go undetected for some time. It also has blind spots, which are below.

Active techniques work out the possible lookalikes of a name first, then check whether each one exists. They do not have the breadth of passive techniques. They are cheaper to run, and they get an answer about an exact name directly from the registry that holds it.

Why not just run a scan once in a while?

There are free tools that scan for lookalikes, and ours is one of them. A single scan does not track history or assess risk, and it only helps on the day somebody remembers to run it. A name that was harmless last month is not necessarily harmless today.

The cost of missing one is high. The FBI counted 24,768 business email compromise complaints in 2025, with $3.05 billion lost: about $123,000 for each complaint.

Why active monitoring

Active monitoring finds new domains as they appear, and it sees what the passive sources leave out:

• Mail-only lookalikes. A domain used only to send mail never needs a certificate, so Certificate Transparency logs never show it.
• Country-code endings. Many country-code registries publish no zone file, so new names there do not reach the feeds. A registry still answers when you ask about one name.
• Aged domains. An attacker can buy an old domain, or one with a good reputation. It is not newly registered, so a newly registered feed never lists it. It is registered, so we see it.
• Change over time. Most lookalikes are harmless on the day they appear. Because we hold each name's history, we see the day a quiet one starts to serve a site or take mail, and that is when it is becoming a weapon.

It has limits. Nobody can list every word an attacker might add to a name, so an unusual combination can get past a list of candidates. A free account checks each week, so a name can be in use for days before the next check. The paid levels check more often.