Discovering a domain that looks like yours is unsettling — but in most cases it is not an attack. This guide explains how lookalikes come about, which techniques attackers actually use, and how to tell the harmless majority from the hostile minority.
Run any lookalike search against an established brand and you will get hits. That is normal. Domains are cheap, name collisions are common, and the internet is full of speculators who register plausible-sounding names in bulk. The mistake most companies make is not ignoring lookalikes — it is treating every one of them as an emergency.
Are most lookalike domains dangerous?
No — most lookalike domains are harmless. Parked pages bought by speculators, unrelated businesses with similar names, and plain coincidence account for the large majority. A lookalike only deserves escalation when it shows hostile signals, such as a login form combined with a visual copy of your site.
The common benign categories are worth knowing, because they explain most of what any scan will find:
- Parked domains. Registered speculatively and pointed at an advertising placeholder, waiting for someone to buy the name.
- Resellers and partners. A distributor or affiliate registers your-brand-shop.example without asking. Unwise, perhaps, but not an attack.
- Coincidences. Another company, in another country, with a genuinely similar name and no interest in you at all.
Keeping this base rate in mind is what makes the genuinely hostile cases stand out — because those look different, and they look different in specific, detectable ways.
How does typosquatting work?
Typosquatting means registering domains that people reach by mistyping or misreading a real one. Common patterns include swapped or doubled letters, missing characters, added hyphens or words such as -login, and TLD swaps where the name stays the same but the ending changes — .co instead of .com, for example.
Each pattern exploits a different failure mode. Swaps and missing letters catch fast typists. Added words like -login or -support catch people scanning a link in an email rather than typing it. TLD swaps are particularly effective because the visible brand name is exactly right — only the ending differs, and few people check endings.
What is a homoglyph domain?
A homoglyph domain replaces one or more characters with visually near-identical characters from another alphabet — for example the Cyrillic 'о' instead of the Latin 'o'. To a human reader the two names look the same, but to computers they are entirely different domains, which makes homoglyphs a deliberate deception technique rather than an accident.
That last point matters for assessment. A typo domain can be innocent — someone really did want that name. A homoglyph domain almost never is, because nobody registers a mixed-alphabet spelling of someone else's brand by chance. Homoglyphs sit much further along the suspicion scale than ordinary typosquats.
Certificates on lookalikes — and why they work in your favour
A phishing page needs the browser padlock, because a certificate warning would scare victims away. Domain-validated certificates are free and issued automatically to anyone who controls a domain, so an attacker preparing a lookalike will usually obtain one — the padlock proves only that the connection is encrypted, not that the site is honest.
Here the transparency of the modern web helps the defender. Publicly trusted certificates are recorded in public Certificate Transparency (CT) logs at issuance. That means the moment someone requests a certificate for a lookalike of your domain, the event is visible to anyone watching the logs — often before the phishing page itself goes live. A new certificate on a previously dormant lookalike is one of the clearest early-warning signals there is.
Visual cloning: the signal that matters most
The hostile minority of lookalikes tends to follow the same playbook: copy the real site's design — logo, colours, favicon, layout — and place a login form on it, so that credentials typed by a misdirected visitor land with the attacker. This combination is rarely innocent. Parked pages do not reproduce your visual identity, and resellers do not ask your customers for their passwords.
That is why a sensible assessment looks at signals in combination: a registration alone means little; a registration plus a fresh certificate deserves a look; a registration plus a certificate plus a visual clone with a login form is active impersonation and needs a response now.
What should you do about a lookalike domain?
Monitor it rather than panic. Record when it was registered and what it serves, then watch it for changes such as a newly issued certificate, content that copies your site, or a login form appearing. Escalate — to the registrar, the hosting provider or the authorities — only when there is real impersonation, because most lookalikes never become anything.
Escalation, when it is warranted, usually means abuse reports to the registrar and hosting provider, takedown requests, warning your customers through your own channels, and reporting to the relevant authorities. Those steps are effective against genuine phishing — and a waste of everyone's goodwill when fired at a parked page.
Where BrandControl fits
BrandControl, the brand protection product in TrustCtrl, automates exactly this discipline. It generates and checks typosquat candidates for your domains — including TLD swaps — detects homoglyphs, and watches Certificate Transparency logs for new certificates on lookalikes. When a lookalike serves content, it compares that content against your real site: content-clone analysis, favicon matching, visual clone detection via screenshot comparison, and detection of login pages on lookalike domains.
The tone of the output follows the reality described above: most findings are calmly presented for review, because most lookalikes are benign. Only the near-always-hostile combination — active impersonation such as a visual clone with a login form — triggers an immediate email. For the fuller picture, see the stop lookalike domains use case.
The same technique is used against software package registries, where the consequence is worse because installing a lookalike package runs code before you look at anything.