Lookalike domains: detecting cousin-domain phishing

Detect: monitor new registrations and certificates#

Two public data sources reveal new lookalikes, often before they are used:

• Newly registered domain feeds. Several commercial and some free services publish lists of newly registered domains. Matching them against variations of your name catches many lookalikes within a day of registration.
• Certificate Transparency logs. Publicly trusted TLS certificates are logged in public CT logs. Attackers who set up a phishing website on a lookalike domain usually obtain a certificate, which appears in the logs. Monitoring CT for names similar to yours is effective and inexpensive.

Detection is about fuzzy matching. A simple approach generates candidate variants of your domain and compares new registrations against them, plus a similarity score such as edit distance for things your generator did not anticipate.

def variants(name: str, tld: str = "com") -> set[str]:
    out = set()
    for i in range(len(name)):
        out.add(name[:i] + name[i + 1:] + "." + tld)              # omission
        out.add(name[:i] + name[i] * 2 + name[i + 1:] + "." + tld)  # repetition
        if i < len(name) - 1:                                      # transposition
            out.add(name[:i] + name[i + 1] + name[i] + name[i + 2:] + "." + tld)
    swaps = {"l": "1", "o": "0", "m": "rn", "i": "l"}
    for a, b in swaps.items():
        if a in name:
            out.add(name.replace(a, b) + "." + tld)
    out.discard(name + "." + tld)
    return out

Open source tools exist that do this far more thoroughly, including homoglyph and IDN variants. The value is in running them continuously, not once.

Respond: what to do when you find one#

1. Collect evidence. DNS records, WHOIS data, screenshots of any website, and examples of mail if you have them.
2. Check whether it is active. Does it have MX records? A website? An SPF record suggests it is set up to send.
3. Warn internally. Add the domain to inbound block or tagging rules on your own mail system so employees are protected immediately.
4. Report abuse. Registrars and hosting providers have abuse contacts and often act on clear phishing evidence. Some registries and dispute processes handle trademark-based complaints; that is a matter for your legal team.
5. Warn customers if needed. If the domain is targeting customers, a short notice describing what genuine mail from you looks like helps.

Help people and filters notice#

• Inbound filtering rules can flag or quarantine messages from domains within a small edit distance of yours, or from very recently registered domains. Treat this as a tagging rule first and tune false positives.
• External sender banners remind staff that a message came from outside, which is exactly the clue a lookalike tries to hide.
• Training with concrete examples shows staff how examp1e.com looks in their actual mail client, on desktop and on mobile.
• Payment verification processes stop the most damaging outcome even when the email itself is convincing.

Checklist#

• Defensively register the most convincing variants and lock them down with null MX, -all and p=reject.
• Monitor newly registered domains and Certificate Transparency logs for lookalikes.
• Add discovered lookalikes to inbound blocking or tagging rules.
• Report active phishing domains to registrars and hosts.
• Flag inbound mail from very new or near-match domains.
• Require out-of-band verification for payment and banking changes.

Key takeaways#

• Lookalike domains authenticate legitimately, so SPF, DKIM and DMARC cannot stop them.
• Defensive registration reduces the most convincing options; lock those domains down for email.
• Certificate Transparency and new-registration monitoring catch many lookalikes early.
• Internal filtering, banners and payment controls protect people when detection misses one.