Lookalike domains: finding the fakes and taking them down

How lookalikes are generated

• Typosquatting — one character swapped, dropped, doubled or transposed: paypa1, goggle, your brand with the "i" and "l" exchanged. Attackers enumerate the keyboard-adjacent variants of your name systematically.
• Combosquatting — your brand plus a trust word: brand-support, brand-verify, secure-brand-login. These read as plausible sub-brands and pass a casual glance.
• Homoglyphs and IDN tricks — characters from other alphabets that render identically (a Cyrillic "а" in place of a Latin "a"). The browser shows your name; the DNS record is a different domain entirely (the punycode form starts xn--).
• TLD and subdomain swaps — your exact name on a cheap or less-scrutinised extension (.top, .xyz, .click), or your brand as a subdomain of a throwaway domain: brand.evil-example.com.

Behind the domain sits usually a phishing kit: a packaged clone of your login or checkout flow that forwards entered credentials to the operator in real time. Kits are reused across hundreds of lookalike domains, which is why tracking the kit — its file hashes, its exfiltration endpoint, its tell-tale asset paths — pays off more than chasing domains one at a time. Take down the kit's infrastructure and every domain using it goes dark together.

Detection: see the domain before the campaign

A lookalike has to be born in public. Registrations are visible, and the moment the operator puts the site behind HTTPS — which victims expect — a certificate is issued and logged in Certificate Transparency (CT) logs, which are public and searchable. A monitoring routine that works:

• Generate the variant space of your brand (typo, combo, homoglyph, TLD swaps) and watch those names in CT logs and new-registration feeds.
• Alert on any certificate issued for a variant, and on DNS for a watched name starting to resolve. A certificate plus an A record plus a login-page fingerprint is a phishing site in staging.
• Fingerprint what resolves: page title, favicon hash, form field names, and asset paths matched against your real site and against known kit signatures.
• Grade before you panic: a parked variant with no content is a watch item; a credential-harvesting clone is an incident. Severity decides speed.

This is the detection loop DomainGuard runs continuously — it finds lookalike domains impersonating your brand and tracks the kits behind the pages, so the human work starts at "here is a live fake, here is the evidence" instead of at a customer's confused email. The free scan will show you what is already out there under your name; most brands that run it find at least parked variants they did not know about.

The takedown evidence pack

Registrars, hosts and CDNs act fastest on requests that do their analyst's job for them. A pack that works contains:

• Identity: your trademark or, failing a registration, proof of your established brand and the real domain's history.
• The fake, documented: full URLs, timestamped screenshots of the clone next to your real page, the phishing form's destination (where credentials are sent), and the domain's registration and hosting details.
• Harm, stated plainly: the page harvests credentials or payment data by impersonating you. Abuse desks triage on harm; "this infringes our trademark" queues behind "this is stealing passwords today."
• Every door knocked: registrar abuse desk (domain suspension), hosting provider (content removal), CDN if one fronts it, plus Safe Browsing / SmartScreen reports so browsers start warning even before the domain dies.

Realistic expectations: responsive hosts remove credential-phishing content within hours; registrar suspension takes longer and varies by jurisdiction and evidence quality; some bulletproof operators will not move at all, and there the browser blocklists and your own customer warning do the protective work. File everywhere in parallel, and keep the pack — the same kit will be back under a new name, and the second filing is faster with the first one's evidence attached.

Prevention that lowers the temperature

• Defensive registrations of the highest-risk variants of your own name, on the main TLDs — cheap for the obvious typos of a valuable brand.
• DMARC at enforcement (p=reject) with SPF and DKIM aligned, so lookalike email from your actual domain fails — and publish a monitored abuse contact.
• A public "we will never" page: tell customers exactly how you contact them and what you never ask for, and link it from your real login page. It gives a suspicious customer somewhere to land that is yours.
• Continuous watching, not a one-off sweep — the variant space regenerates with every campaign, and kits migrate. Pair it with the rest of your perimeter hygiene: the same week a lookalike goes live is a good week to re-check your own site's posture with a vulnerability scan.