How can you detect lookalike domains in your brand?

Someone registers yourcompany-support.com or yoürcompany.com overnight. By morning, they're sending phishing emails that look like they came from you. Your customers click. Your brand reputation takes the hit. That's why detecting lookalike domains before they cause damage is worth building into a regular routine.

Here's a practical workflow you can put together without a huge budget.

Step 1: Know what you're looking for

Attackers don't just swap one letter. They use a handful of well-worn tricks. Common patterns include character substitution (rn for m, 0 for o, l for 1), extra words added around your brand name (yourcompany-help.com, secure-yourcompany.net), missing letters or doubled letters (yourcmpany.com, yourcompanny.com), and homograph swaps that replace standard letters with visually identical Unicode characters. Write down the 10 to 20 most likely variations for your brand. That list becomes your baseline for monitoring.

Step 2: Run automated variation checks

DNSTwist is a free open-source tool that generates hundreds of typosquatting permutations of your domain and checks which ones are already registered or resolving. You can run it manually on a schedule or pipe its output into an alert. If you'd rather not run your own tooling, commercial brand protection platforms (like MarkMonitor or DomainTools) do this automatically and send alerts when a new lookalike domain appears. Paid services typically start around $500 to $2,000 per year depending on how many domains you're watching and how fast you need alerts.

Step 3: Watch Certificate Transparency logs

Every time someone registers an SSL certificate for a domain, it gets recorded publicly in Certificate Transparency (CT) logs. That means you can watch for certificates issued to suspicious domains before those domains even start sending email. crt.sh lets you search CT logs for free. Search for your brand name and set up a periodic check. If you see a certificate issued to yourcompany-billing.com that you didn't register, that's a red flag worth investigating immediately.

Step 4: Read your DMARC reports

Still your own DMARC reports won't show lookalike domains directly, but they do show you every source claiming to send as your exact domain. If something shows up in those reports that you don't recognize, investigate it. That's a sign someone may be abusing your actual domain, which is a related but distinct problem from lookalike abuse.

Step 5: Set up Google Alerts

It's low-tech, but it works as a supplementary layer. Set up Google Alerts for your brand name combined with terms like "phishing", "scam", or "support". If your customers start complaining online about a fake site, you'll find out faster. This won't catch registrations before they happen, but it can surface active abuse you might have missed.

What to do when you find one

Not every lookalike domain is actively malicious. Some are parked, some are defensive registrations by competitors, and some are just squatters hoping you'll buy them. If you find a domain that's sending email impersonating your brand, report it to the registrar and to Google's Safe Browsing. If it's actively phishing your customers, you can also contact your legal team about a UDRP (Uniform Domain Name Dispute Resolution) complaint. For urgent situations, our SOS hotline is free and we can help you figure out the right next step.

The honest truth is that you can't register every possible variation of your domain. But you can make sure that active abuse gets spotted quickly, and that's what this workflow is designed to do.