Lookalike domains: how typosquatting works and how to detect it

A lookalike domain is a domain name registered to resemble yours closely enough that a busy reader will not notice the difference: dupont-imo.fr instead of dupont-immo.fr, or acme-properties.co instead of acme-properties.com. The practice is called typosquatting, and when the goal is to pass as your business in an email, it becomes domain impersonation.

This guide covers how fraudsters build these names, why the ones with a mail server come first, what public DNS records reveal, and how to detect lookalike domains without ever opening their websites.

What is a lookalike domain?

Clients, suppliers and partners learn to trust the domain after the @ in your email addresses. A lookalike borrows that trust: it is a different domain, owned by someone else, that reads like yours at a glance.

It is not the same thing as spoofing, which forges your exact domain in the sender field and which a DMARC policy on your own domain can block (see our guide to DMARC p=reject). A lookalike sidesteps that protection: the fraudster sends from a domain they really own, so the email can pass authentication checks. Those checks prove which domain sent the message, not that the domain is yours.

Not every similar name is hostile: some are held by resellers, some sit unused, some belong to you or to a legitimate business. Detection means sorting candidates by risk, not just listing them.

How fraudsters build lookalike domains

Most lookalikes come from a small set of techniques, applied mechanically to your name. Taking dupont-immo.fr as an example:

• Omission: a letter disappears, as in dupont-imo.fr. Reading quickly, the brain fills the gap.
• Transposition: two neighbouring letters swap places, as in dupotn-immo.fr.
• Doubled letter: a letter is repeated, as in duppont-immo.fr.
• Keyboard typos: a letter is replaced by its neighbour on the keyboard, and neighbours depend on the layout. On AZERTY the m sits next to the l (dupont-imlo.fr), on QWERTY next to the n (dupont-imno.fr). Clients in France and abroad make different mistakes.
• Homoglyphs: a character is swapped for one that looks the same, such as the digit 0 for the letter o (dupont-imm0.fr) or a Cyrillic letter for its Latin twin. Our article on homoglyph attacks covers this case in detail.
• Other extensions: the name stays identical but the extension changes: dupont-immo.com, dupont-immo.net, or dupont-immo.co, which is easy to mistake for .com.
• Added words: a reassuring word is attached to your name, as in acme-properties-invoice.com and acme-properties-payment.com, or, for a French audience, dupont-immo-paiement.fr and facture-dupont-immo.fr.
• Hyphens: a hyphen is removed or added, as in dupontimmo.fr or acmeproperties.com.
• Subdomain-style tricks: your full domain is placed at the start of a longer address, as in dupont-immo.fr.example.com, or its dot becomes a hyphen, as in dupont-immo-fr.com. In the first case, the real domain is example.com.

Each technique yields many candidates, and the techniques combine. Generated systematically for a single name, the variants run into the hundreds, far more than anyone checks by hand.

Why a lookalike domain is a business problem

A lookalike is rarely used to attack your systems. It is used to talk to the people who pay you, or whom you pay. The classic scenario is payment diversion: a client receives an email that seems to come from you and announces new bank details before an invoice is due. The transfer goes to the fraudster's account, and the loss often surfaces only when you chase the unpaid invoice. Our guide on payment diversion fraud walks through the full mechanism.

The same domain can also carry fake invoices to your suppliers, phishing pages copying your client portal, or requests to your staff in a manager's name. Businesses that regularly ask clients for transfers are the most exposed, which is why we pay particular attention to estate agents and property managers, who collect deposits, rents and service charges.

The damage is not only financial: a client who paid the wrong account may hold you responsible. This is brand impersonation in its most practical form: nobody touches your systems, yet your reputation is turned against you.

MX and SPF: what makes a lookalike domain dangerous

A registered lookalike is a warning sign. A lookalike that can handle email is ready for use. Two DNS records make the difference.

The MX record (mail exchanger) tells other mail servers where to deliver email addressed to the domain. If dupont-imo.fr has one, the fraudster can receive replies. That matters more than it seems: when a cautious client writes back to ask whether the new bank details are genuine, the question reaches the fraudster, who confirms them.

The SPF record is a TXT record listing the servers allowed to send email for the domain, which receiving servers check. Mail from a lookalike with a valid SPF record passes this check, which improves its chances of reaching the inbox.

dupont-imo.fr.  MX   10 mail.dupont-imo.fr.
dupont-imo.fr.  TXT  "v=spf1 mx -all"

These two lines, on a domain one letter away from yours, describe a domain ready to send and receive email. Neither proves bad intent on its own, but combined with a recent registration date they put the lookalike at the top of the list.

A lookalike without an MX record is not harmless for good: one can be added on the day the fraudster is ready.

What DNS records tell you, without visiting the site

Everything you need to assess a lookalike is public and can be read without contacting its server:

• Name servers (NS): whether the domain is set up, and with which DNS provider. Parked domains, shown with ads or for sale, often use recognisable name servers.
• A and AAAA records: whether the name points to a server, usually for a website.
• MX records: whether the domain can receive email.
• SPF (a TXT record): whether it declares servers allowed to send email.
• Registration date (RDAP): when the domain was created. RDAP, the successor to WHOIS, also gives the registrar and often its abuse contact. A recent lookalike deserves more attention than an old one.

Visiting the lookalike's website adds nothing to this picture and carries real risks. The page may host a phishing form or a malicious download. Your visit reveals your IP address and browser to whoever runs it, and can tell them they have been spotted. Some fraudulent sites also show different content depending on the visitor, so what you see is not reliable evidence anyway.

Spamr's free lookalike domain scan follows this rule: it generates the variants of your domain, queries public DNS and RDAP only, and never connects to the lookalike websites. Each lookalike gets a risk level (critical, high, medium or low) computed by fixed rules, with the reasons listed.

How to detect lookalike domains: manual checks or continuous monitoring

You can start by hand. Write down the most obvious variants of your name (a missing letter, the other main extensions, your name with invoice or payment attached) and look them up in a registrar's availability search. For those already registered, two command-line queries show whether they handle email:

dig +short MX dupont-imo.fr
dig +short TXT dupont-imo.fr

An RDAP lookup then gives the creation date and the registrar. For generic extensions such as .com, ICANN provides a lookup tool on its website.

Manual checks quickly reach their limits:

• You only test the variants you think of, and fraudsters think of others.
• Once the techniques are combined, the list runs to several hundred names.
• A check is valid on the day you run it. A lookalike can be registered next week, or gain an MX record next month.

Continuous monitoring answers the last point: regenerate the variants regularly, compare them with the previous results, and alert when a new lookalike appears or an existing one adds a mail server. Spamr's monitoring plans rescan your domain daily and send you an email alert when something changes.

What to do when you find a dangerous lookalike

1. Do not visit it or contact its owner. You gain nothing and you alert them.
2. Keep the evidence: the domain name, its DNS records and its registration date, with the date you observed them.
3. Warn the people at risk: clients, suppliers and staff, through a channel you already use. Tell them you will never announce new bank details by email alone, and that any such request must be confirmed by phone, on a number they already have.
4. Report it to the registrar and the hosting provider, whose abuse contacts appear in the registration data. Our guide on getting a lookalike domain taken down explains what to send.
5. Get help if money has left: contact your bank straight away and report the fraud to the police. In France, Cybermalveillance.gouv.fr assists victims. In the UK, the NCSC publishes guidance for small organisations.

Key takeaways

• A lookalike domain is a different domain that reads like yours. DMARC on your own domain does not stop it.
• Fraudsters combine a few techniques: omissions, keyboard typos, homoglyphs, other extensions, added words and hyphens.
• The dangerous lookalikes have an MX record and an SPF record: they can send email and receive the replies.
• Public DNS and registration data are enough to assess the risk: never visit the site.
• A single check is a snapshot. Detection works best as continuous monitoring.