Domains, platforms, and web abuse
Lookalike domain
A lookalike domain is a hostname chosen to be mistaken for a trusted one, whether by a small spelling change, a different top-level domain, an added word, a visually similar character or the brand name placed in a subdomain.
The main techniques
- Typos and transpositions: one character dropped, doubled, swapped or replaced by a keyboard neighbour.
- Homoglyphs: characters that look alike, such as a digit 1 for a lowercase l, or letters from another script that render identically.
- Combosquats: the real name with an extra word, such as login, secure, support or help.
- TLD swaps: the right name under a different ending.
- Subdomain abuse: the brand's full domain used as a subdomain of something else, so the left-hand side of the address reads correctly.
What they are used for
Phishing pages, credential harvesting, malware delivery, business email compromise sender addresses, advert fraud and simple traffic diversion. Some are registered and parked for later use, which is why a registration that resolves to nothing is still worth recording.
Finding them
Permutation-based scanning generates candidate names from the brand and checks whether they are registered. It misses names that contain the brand inside a longer string or in a subdomain, which is where certificate transparency logs and passive DNS help, because they show hostnames as they are issued certificates and resolved rather than as they are registered.
Acting on them
Priority follows harm: a lookalike serving a live sign-in form outranks one that is parked. Evidence for the registrar or host should include the hostname, registration and DNS data, the certificate, and a capture of the page with a timestamp.
Related terms
Sources
External guidance is general. Adapt it to your legal, regulatory and operational requirements.