Lookalike Domains in 2026: Why a Single Swapped Letter Fools Careful Staff, What Typosquatting and Punycode Homoglyphs Actually Exploit, and How to Monitor and Defend Your Brand Name

An email arrives from your regular supplier. The signature is right, the tone is right, and the thread even quotes last month’s order. It asks you to update their bank details before Friday’s payment. The only thing wrong is one letter in the sender’s domain, and almost nobody notices it. Lookalike domains are cheap to register, easy to set up and still behind a large share of business email fraud in 2026.

Why Lookalike Domains Work So Well

People do not read domain names letter by letter. They recognise the overall shape of a word, especially on a phone screen or in a busy inbox. An attacker only needs a name that looks right at a glance, and a domain costs as little as ten dollars a year. Within an hour it can have working email, a valid HTTPS certificate and a copy of your login page.

The money involved is large. The FBI’s Internet Crime Complaint Center has reported business email compromise losses of around $2.8 billion a year in the United States alone, and many of those cases start with a domain that is one character away from a real supplier, client or executive.

Email authentication proves a message really came from the domain it shows. It cannot tell you that the domain itself is the wrong one.

The Main Types of Lookalike Domain

Homoglyphs and Punycode Explained

Domain names can include letters from many alphabets so that people can register names in their own language. Behind the scenes these internationalised names are stored in an ASCII form called Punycode, which starts with xn--. The problem is that several alphabets contain letters that look exactly like Latin ones. The Cyrillic “а”, “е” and “о” are visually identical to a, e and o, yet they are different characters, so a domain built from them is a completely different address.

In 2017 a researcher showed this by registering a Cyrillic domain that Chrome and Firefox displayed as “apple.com”. Browsers have since tightened their rules. They now show the raw xn-- form when a name mixes scripts or resembles a well-known site. That protection is good but not complete: the checks are focused on popular domains, a small business name is unlikely to be on any list, and email clients and chat apps often display the friendly version anyway.

What Attackers Do With Them

• Invoice and payment fraud: the attacker copies a supplier’s domain, often after reading real emails from a hacked mailbox, and sends a change of bank details in the middle of a genuine conversation.
• Executive impersonation: a message from the “CEO” on a near-identical domain asks finance for an urgent transfer or gift cards.
• Credential phishing: a copied Microsoft 365 or client portal page on a lookalike domain collects passwords and, with a proxy kit, MFA codes too.
• Fake shops and support lines: customers searching for your brand land on a clone that takes their payment or calls them pretending to be you.

SPF, DKIM and DMARC are still essential, because they stop criminals from sending as your real domain. But the attacker owns the lookalike, so they can set up perfect authentication for it. Their messages pass every check and arrive with a green tick. That is why the defences below focus on spotting the domain, not just checking the message.

How to Find Lookalikes of Your Own Domain

• Generate the list: the free open-source tool dnstwist produces thousands of likely variations of your domain and checks which ones are registered, which have mail servers and which host a website.
• Watch certificate logs: every public HTTPS certificate is recorded in Certificate Transparency logs. Services such as crt.sh, Cert Spotter or a commercial monitor can alert you when a certificate is issued for a name containing your brand.
• Track new registrations: many security vendors and DNS filters publish feeds of newly registered domains. A domain like yours that appeared yesterday deserves a closer look.
• Ask your staff and customers: make it easy to forward suspicious messages. They often see the attack before any tool does.

Getting a Lookalike Taken Down

When you find an active fake, move quickly. Start with an abuse report to the registrar and the hosting provider, including screenshots and email headers. Many will suspend a domain that is clearly used for phishing within a day or two. Report the site to Google Safe Browsing and Microsoft so browsers start showing warnings, and add the domain to your own email and DNS block lists straight away.

For a domain that infringes your trademark but is not obviously criminal, the formal routes are the UDRP, which can transfer the domain to you and costs about $1,500 through WIPO for a single domain, and the faster, cheaper URS, which only suspends it. Both take weeks, so treat them as cleanup rather than incident response.

En resumen

Lookalike domains succeed because they attack how people read, not a weakness in your systems. You cannot register every possible typo, but you can own the obvious ones, watch for new ones, make your email warn people, and put a phone call between any request and any payment. Add password managers and passkeys and even a perfect fake gets far less from your team.

Want to know which lookalikes of your domain already exist? Contact Internet Pros for a domain impersonation scan, email authentication review and a practical plan to protect your brand and your payments.