Guide · Lookalike domains
How to check whether your domain is being impersonated
A lookalike domain is prepared in silence: registration, certificate, copy of your login page, then the campaign. Here is how to spot it at each step with public tools. A lookalike domain is prepared in silence: registration, certificate, copy of your login page, then the campaign. Here is how to spot it at each of those steps with public tools, and what continuous monitoring adds.
- Guide
- Guide
- Steps
- 7 ·10 min read
- Published
- Last updated
- Related services
- Lookalike domainsManaged takedownDark-web mentions
In one sentence
To find out whether your domain is being impersonated, generate its plausible variants, look them up in domain registries and certificate logs, examine their DNS and content, then request the removal of those imitating your brand.
There are hundreds of plausible variants of a domain name: one letter missing, two letters swapped, a character from another alphabet, a neighbouring extension, an added keyword such as “login”, “secure” or “hr”. An attacker registers only one or two; the work consists of looking at the right ones at the right time.
The good news: registering a domain and issuing a certificate leave public traces. Someone watching those traces sees a campaign being prepared days before the first email.
Steps
The seven steps
- 01
Generate the variants
List the permutations of your domain: common keyboard typos, doubled or missing letters, homoglyphs (“rn” for “m”, Cyrillic characters), added hyphens, .co, .net, .fr, .io extensions, and combinations with keywords from your business. Free permutation generators exist; keep the list, it will serve for every check.
- 02
Check the certificate logs
Public Certificate Transparency logs record every certificate issued. Search them for your brand and your variants: a certificate for “your-brand-login.example” issued yesterday is the earliest signal of a phishing page in preparation.
Also search for your product names and internal abbreviations, not only the company name.
- 03
Check WHOIS, RDAP and DNS
For each registered variant: creation date, registrar, name servers, presence of MX records. A recently created domain, at a lax registrar, with MX records set up, is ready to send emails in your name.
- 04
Examine the content
Open the page in an isolated environment, or through a capture service. Login form, logo, copied notices: it is impersonation. Parking page or unrelated site: note it and re-check; domains are often “armed” later.
- 05
Lock down your own email
Publish SPF, sign with DKIM and move DMARC to a “reject” policy with aggregate reports. It does not stop a lookalike domain from existing, but it prevents direct spoofing of your exact domain and gives you reports on who tries to use it.
- 06
Document and request removal
Timestamped screenshots, DNS records, headers of the emails received. Write to the registrar (abuse), to the host and, for an active page, to browsers and blocklists. A precise request with evidence is handled far faster than a vague report.
- 07
Monitor continuously
A manual check holds for a moment. Registrations and certificates arrive every day; automate the watch on your variants, brands and keywords, and have every new domain qualified before acting.
Why a lookalike domain is registered weeks before it is used
A brand-new domain is suspicious to email filters and browsers. Attackers let it “age”, host neutral content, obtain a certificate, then switch the page when the campaign starts. That latency is your window: between registration and use, the domain is visible and nothing has been sent yet.
What automated monitoring adds
It runs steps 1 to 4 continuously: variant generation, reading of registries and certificate logs, DNS resolution, page capture. It ties every domain to a record (registration, certificate, MX, capture, timeline) and an analyst decides whether to request a takedown, keep watching or close.
Frequently asked questions
Should we register all the variants of our domain ourselves?
Register the most obvious ones (frequent typos, main extensions); it is impossible to cover them all. Monitoring complements defensive registration.
Is a parked domain with no content dangerous?
Not yet, but it is ready to become so. Note it, watch its certificate and MX records, and prepare the takedown request for the day it switches.
Is DMARC enough against phishing?
It protects your exact domain against direct spoofing. It does not protect against a lookalike domain, which has its own perfectly valid SPF and DKIM.
See the domains imitating you today
An exposure assessment includes searching the variants of your domains in registries and certificate logs.
Bespoke offering: one price per service, no public price, no packages.