A lookalike domain is a web address made to look like a real one, for example by changing a few characters or using a different top-level domain. MITRE ATT&CK describes adversaries registering domains that are similar to legitimate domains. They are often used to make phishing links and fake sites look trustworthy.
- Also Called3other nameslook-alike domain · homograph domain · cousin domain
- Related Terms3linked entriesTyposquatting · Phishing · Brand impersonation
What is a lookalike domain?
A lookalike domain is a domain name that closely resembles a legitimate one. MITRE ATT&CK describes adversaries acquiring domains for phishing, drive-by compromise and command and control, and says they often use homoglyph domains or typosquatting to mimic legitimate sites. A homoglyph is a character that looks like another character. Typosquatting relies on typing mistakes.
How does a lookalike domain work?
The attacker registers the similar name and uses it in a link, a sender address or a fake website. CISA says cybercriminals often use an email address that closely resembles one from a reputable company by altering or omitting a few characters.
MITRE also says adversaries may acquire and repurpose expired domains, which may already be allowlisted or trusted by defenders. It notes that private WHOIS services can hide who owns a domain.
Why does it matter?
A lookalike domain is a real domain that the attacker controls, so it can pass a quick glance. Registration also happens outside an organization’s own systems. Reasoning from this, an organization may not see the domain until it is used, which makes early watching of new registrations useful.
How can you detect and reduce the risk?
- MITRE suggests monitoring DNS data and WHOIS databases for newly acquired domains, and using passive DNS and domain registration tracking services.
- MITRE says an organization may choose to register similar domains of its own to discourage others from creating typosquatting domains.
- CISA says to hover over a link and check that it matches the text shown.
- CISA says to check sender addresses carefully, and to verify a message by contacting the organization using contact details from a previous statement, not from the email itself.
Is a lookalike domain the same as typosquatting?
They overlap. Typosquatting is registering a name that depends on a mistyped address. A lookalike domain is the wider idea of any name that looks like the real one, including homoglyphs and other endings.
Is a lookalike domain the same as a spoofed email?
No. In a spoofed email the sender details are faked. A lookalike domain is a real, separate domain that the attacker owns. The two can be used together.
A lookalike domain is different from email spoofing, where the sender line itself is forged.
Related pages in the Knowledge Hub
Sources
- MITRE ATT&CK: Domains: similar domains using homoglyphs or different TLD, IDN homograph, typosquatting, detection via registration databases and passive DNS, register similar….
- CISA: Sender address may imitate a legitimate business by altering or omitting a few characters; hover over links to check for spoofing.
Also Called.
- Namelook-alike domain
- Namehomograph domain
- Namecousin domain
Questions.
-
What is a lookalike domain?
A lookalike domain is a web address made to look like a real one, for example by changing a few characters or using a different top-level domain. They are often used to make phishing links and fake sites look trustworthy.
-
Is a lookalike domain the same as typosquatting?
They overlap. Typosquatting is registering a name that depends on a mistyped address. A lookalike domain is the wider idea of any name that looks like the real one, including names that use look-alike characters called homoglyphs.
-
How can you spot a lookalike domain in an email?
CISA says to hover over a link and check that it matches the text shown, and to check sender addresses carefully. Verify a message by contacting the organization using contact details from a previous statement, not from the email itself.
-
How can an organization detect lookalike domains early?
MITRE suggests monitoring DNS data and WHOIS databases for newly acquired domains, and using passive DNS and domain registration tracking services. An organization may also register similar domains of its own to discourage others.
In Our Research
- 1 Lookalike Domains: How a Single Character Difference Becomes a Brand’s Worst Nightmare May 2026
- 2 Threat Hunting for Phishing Pages March 2022
- 3 Brand Protection Solutions: A Buyer’s Guide 101 guide
- 4 How to Choose a Digital Risk Protection Service 101 guide
- 5 Takedown Service Evaluation Checklist 101 guide
- 6 Kimsuky Threat group