alesian.security

Resources  / Finding lookalikes

How we find the names that copy yours

A lookalike is a web address made to be mistaken for yours. People read quickly and see what they expect to see, so an address that is almost right is usually read as right. That is the whole trick, and it works on careful people too.

The tricks

Every one of these was built from an invented name, acmebank.com. The marked characters are the ones that changed.

These are the families of trick that security researchers have documented for years. We use all of them, and a few refinements of our own.

We work them out before anybody registers them

Most of the addresses that could imitate you have not been bought yet. Waiting for one to turn up in an attack means learning about it after somebody has already been fooled. So when you give us a name, we work out every variation the tricks above can make, usually thousands of them, across your own ending and the endings most used for abuse.

That list is what we watch. The moment one of those addresses is registered, it is already on the list, and we see it on the next check.

We check every one, every time

It would be cheaper to check the likely ones often and the rest now and then. We do not, because the variation nobody expected is the one that works, and a name that is checked once a week can be used for six days before anybody knows. Every variation of every name is checked on every cycle.

What we keep to ourselves

We do not publish the exact lists, the endings we cover, or the order we work through them. A list of what we watch is also a list of what we do not, and that is the one thing an attacker would want from this page.

See the variations of your own name

No account needed to see the list.

Read next

How we know a name is live → Why asking the internet once gives the wrong answer, and how we get the right one before we alert you.