Lookalike Domains: The Attack Your Filters Miss
Take your company's domain and swap one character. Replace an l with a capital I, an o with a zero, or add an s at the end. Most people reading quickly cannot tell the difference. Neither can your customers, your vendors, or the person in finance approving a wire transfer late on a Friday.
That is the entire trick behind lookalike domain attacks, and the reason they keep working is that they do not touch your systems at all. The attacker registers a domain that resembles yours, stands up mail or a copy of your login page, and goes after people who trust your name. Your firewall never sees it. Your endpoint tools never see it. The attack lives outside your perimeter.
How the attacks actually run
The most damaging version is payment fraud. An attacker watches a real vendor relationship, often after compromising one mailbox somewhere in the chain, then sends an invoice from the lookalike domain with updated banking details. The thread looks continuous. The name looks right. The money leaves.
The second version is credential theft: a cloned login page, a plausible "re-authenticate" mail, and working passwords collected from your own staff.
The third is customer-facing fraud that damages your name with people you never meet.
What detection looks like
Lookalike detection is a generation and comparison problem. Starting from your legitimate domain, generate plausible variations: character swaps, homoglyphs, added words, alternate endings. Then check which variations are registered, when they appeared, and what they are doing: mail records, hosted content, brand resemblance.
A parked lookalike from years ago is often background noise. A lookalike registered weeks ago with fresh mail records is a loaded weapon. Knowing about it before the first email lands is the difference between a non-event and an incident report.
What to do about it
Three moves cover most of the risk.
- Register the highest-risk variations of your own domain before someone else does. It usually costs little relative to fraud.
- Monitor the rest on an ongoing basis. New registrations are the signal that matters.
- Give finance one unbreakable rule: any change in payment details gets verified out of band (for example, a phone call to a known number), never only by reply in the same thread.
Filters that only watch your perimeter will keep missing this class of attack. The craft is watching the name itself.