Who could pretend to be you?
Once your own domain is protected with DMARC, attackers register one that looks the same at a glance: a letter swapped, an l for a 1, .co instead of .com. This builds up to 150 of those and checks which are registered and which have mail servers.
How the variants are made
Other endings (.net, .co, .io, your country's), look-alike letters (rn for m, 0 for o, 1 for l), a letter left out, doubled or swapped, neighbouring keys, hyphens and single-bit flips.
Registered isn't always hostile
Many look-alikes are parked, held by typo collectors or owned by other businesses. Watch the ones with mail servers or your branding. We look up public DNS only; the domain and results aren't stored or logged.
How it works
Enter your domain and the finder builds up to 150 variants an attacker might register: other endings, letters swapped for look-alikes such as rn for m or 0 for o, a letter dropped, doubled or swapped with its neighbour, nearby keys, added hyphens and single-bit changes. It then looks each one up in public DNS to see whether it is registered and whether it has mail servers, since a domain that can send and receive email is what invoice fraud needs. Nothing you enter is stored.
Reading your result
- Registered with mail servers
- The ones to look at first: someone can send and receive email from an address one character away from yours. Check who owns it and warn your finance team and customers if it isn't you.
- Registered, no mail
- Often parked, for sale or owned by an unrelated business. Note it and check again later; mail can be switched on in minutes.
- Not registered
- Free for anyone to take. Consider registering the closest few yourself, starting with the other common endings of your name.
Questions
What is a lookalike domain?
A domain made to pass for yours at a glance, such as a swapped letter, a missing letter or a different ending. It is used to send invoices and password-reset emails that seem to come from your company.
What can I do about a lookalike that someone else registered?
Report abusive use to the registrar shown in its WHOIS record, block the domain in your own mail filter, and tell staff and customers which address is real. For a clear trademark case, a UDRP complaint can transfer the domain; that is a question for a lawyer.
Does DMARC protect me from lookalike domains?
No. DMARC stops forged mail from your exact domain; a lookalike is a different domain with its own valid records. You need both: check yours with the email security check.