Common techniques
Missing or doubled letters (example.com becomes exampel.com), swapped letters, a different extension, characters that look alike, such as rn instead of m or letters from other alphabets, and added words such as login, secure or the name of a service. The same idea is used in software repositories, where attackers publish packages with names close to popular ones.
How it is used
Lookalike domains send phishing emails that pass authentication checks because the attacker controls the domain, host fake login pages and impersonate suppliers in BEC fraud, often by registering a domain one letter away from a real supplier and replying in an existing thread. DMARC protects the exact domain but cannot stop lookalikes.
Protection
Register the most obvious variants of your main domains, monitor new domain registrations and certificates that resemble your brand, and include lookalike domains in attack surface and brand monitoring. Mail filters can flag messages from newly registered domains or from domains similar to frequent contacts.
Responding
When a malicious lookalike appears, report it to the registrar and the hosting provider, ask browsers and security vendors to block it, and warn employees, customers and suppliers. Disputes over domains that infringe a trademark can also go through procedures such as the UDRP. Train staff to check the sender's domain carefully, especially in payment requests, as part of security awareness training.
