What’s the difference between cousin domains and mirror domains?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
If someone wanted to impersonate your brand over email, they'd have two main playbooks. One is subtle. The other is almost invisible to the naked eye. Knowing which is which helps you explain the threat clearly to a security team and spot it faster when it shows up.
Cousin domains take your brand name and riff on it. They don't try to look exactly like your domain. Instead they add a word, swap in a keyword, or change the structure in a way that still reads as "your brand." Think company-support.com, companylogin.com, or company-secure.com. A real person scanning an email quickly might trust it. That's the whole point.
Mirror domains go further. They try to look exactly like your domain at a glance, using character substitution to pull it off. A zero instead of the letter O (c0mpany.com). The letters "rn" side by side where an "m" should be (cornpany.com). Or a Cyrillic "а" swapped in for a Latin "a" (compаny.com). These are the kind of tricks covered in IDN homograph spoofing and Unicode character abuse. The domain looks legitimate in a subject line or sender field, even when you stare at it.
The difference in risk comes down to intent and detection. Cousin domains are easier to spot if you pause and look closely. Mirror domains are designed so that pausing doesn't help. Your eye just fills in the right letter.
They also need different monitoring approaches. Cousin domains are caught by tracking brand-adjacent keywords. Mirror domains need visual similarity analysis that flags lookalike character patterns, not just keyword matches. A blocklist checker alone won't catch either of them reliably.
Neither type is harder to deploy. Both are cheap and fast for attackers to set up, which is why lookalike domains in general are so common in phishing campaigns. The best defenses are a strict DMARC policy on your legitimate domain (so attackers can't spoof it directly), plus ongoing monitoring for both cousin and mirror variants of your brand.
Not sure if someone is already impersonating your domain? Check your blocklist status and authentication setup with our free blocklist checker, or head to the SOS hotline if you think something's actively happening.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
