Typosquatting and Lookalike Domains

The Domain That Looks Right Until You Look Closely

micosoft.com, paypa1.com, yourcompany-support.net — typosquatting and lookalike domains are one of the oldest tricks in phishing, and they still work because a domain that’s off by one character, or uses a different top-level domain, or embeds your real company name inside a longer fraudulent one, passes a quick glance almost every time. For a small business, the risk runs both directions: your customers and employees can be fooled by a lookalike of a vendor you use, and someone else can register a lookalike of your domain to target your own customers and staff.

The Common Techniques

Lookalike domains use a handful of well-worn tricks, usually in combination:

• Character substitution: swapping a letter for a visually similar one — micosoft.com (missing letter), paypa1.com (the number 1 for a lowercase L), rnicrosoft.com (“rn” mimicking “m”).
• Different TLD: registering the exact same name under a different extension — yourcompany.net or yourcompany.co instead of yourcompany.com — then using it for phishing or to intercept confused traffic.
• Combosquatting: embedding your real domain or company name inside a longer fraudulent one, like yourcompany-verify-account.com or yourcompany.com.security-check.net, designed to look legitimate at a glance in a rushed email check.
• Subdomain spoofing in email display names: pairing a real-looking display name with a fraudulent underlying address, so the visible sender name reads correctly while the actual domain is fake — a trick that defeats people who check the name but not the address.

Why This Matters More Than It Used to

Modern phishing kits make registering and standing up a convincing lookalike domain fast and cheap, and attackers increasingly pair a lookalike domain with a genuinely well-copied website, not just a crude fake login page. The old advice to “look for spelling mistakes” is no longer sufficient defense on its own — the mistakes are often deliberately subtle, and the surrounding page can be a near-perfect clone.

Protecting Your Business From Being Fooled

For your own employees and team, the practical defenses are process, not just vigilance: train people to hover over links and check the actual destination domain before clicking, not just the display text; use a password manager that only auto-fills credentials on the exact correct domain (a strong, often-overlooked defense, since a password manager simply won’t offer to fill on a lookalike); and set up DNS filtering that flags or blocks known-malicious and newly-registered lookalike domains automatically, catching what a rushed human glance misses.

Protecting Your Own Domain From Being Squatted

The flip side matters just as much: someone can register lookalike versions of your own domain to phish your customers or employees, damaging your brand and putting people who trust you at risk. A few defensive steps that don’t require a large budget: register the most obvious lookalike variants of your own domain (common misspellings, the most likely alternate TLDs) defensively, even if you never use them; set up Google Alerts or a domain-monitoring service to flag newly registered domains containing your brand name; and publish a strict DMARC policy (set to quarantine or reject, not just monitor) so email spoofed to look like it’s from your exact domain gets blocked before it reaches anyone’s inbox.

What to Do If You Spot One Targeting You

If you discover a lookalike domain actively impersonating your business, document it (screenshots, WHOIS lookup) and report it through the registrar’s abuse contact and, if it’s actively being used for phishing, to Google Safe Browsing and Microsoft’s SmartScreen reporting tools to get it flagged in major browsers. For a domain that’s a clear trademark infringement, a UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaint is the formal path to force a transfer or takedown, though it’s a slower and more involved process than an abuse report.

Testing Your Own Team Without Embarrassing Anyone

If you want a realistic read on how vulnerable your team currently is to a lookalike-domain attack, a low-drama way to find out is a simulated phishing test using a domain that mimics a vendor you actually use, sent through a legitimate phishing-simulation platform rather than a real attack. Frame results as a training opportunity, not a performance measure — the goal is identifying which specific habits need reinforcing (checking sender domains, hovering over links) before a real attacker finds the same gap. Employees who click during a simulation are exactly the people who benefit most from five minutes of direct, specific coaching on what they missed, rather than a generic company-wide reminder email that the people who need it most tend to skim past.

A Quick Gut-Check List for Any Suspicious Domain

When an email or link looks slightly off, a fast mental checklist catches most lookalikes: does the domain in the address bar (not the display name) exactly match the real company’s known domain, character for character? Is the TLD what you’d expect (.com vs. an unfamiliar alternative)? Does the URL contain the real brand name embedded inside a longer, unrelated domain? And critically — did a password manager offer to auto-fill credentials on this exact page? If it didn’t offer to fill in a saved login where it normally would, that’s often the single most reliable signal that something is wrong, even when everything else about the page looks convincing.

Part of a Bigger Phishing-Awareness Picture

Typosquatting is one technique in a broader family of social-engineering tricks that rely on a quick glance instead of careful attention — the same instinct that catches a lookalike domain also helps against SMS-based smishing and QR code phishing, both of which lean on the same “looks close enough, don’t look too hard” exploit. Building this kind of scrutiny into your team’s habits is exactly what a structured employee cybersecurity training program is for, and it pairs well with the broader social engineering awareness your team needs against manipulation tactics generally, not just domain-based ones specifically.

Bottom Line

Typosquatting and lookalike domains work because they exploit a quick glance, not careful attention — which means the fix has to be built into your tools and processes, not just employee awareness. Domain-aware password managers, DNS filtering, a strict DMARC policy on your own domain, and proactive monitoring for lookalikes of your brand close most of the gap that “just double-check the URL” leaves wide open.