Lookalike domain monitoring: seven questions to ask before you buy

A lookalike domain monitor earns its fee on one day: the day someone registers an address a character or a word away from yours and starts writing to your customers, your staff and your suppliers as you. Everything else a monitor does is preparation for that day.

So judge every tool you are considering against it. Would it have seen that domain? How early? And what would happen in the week after the alert? A longer list of lookalikes answers none of those questions.

What lookalike domain monitoring is for

Most phishing domains are registered by the attackers themselves. Interisle Consulting Group's Phishing Landscape 2026 found that 74% of the phishing domains in its study were registered maliciously, against 26% that were legitimate sites someone had compromised. For a brand, that means the attack usually starts with a purchase: an address that looks like yours, bought before anyone is targeted.

Lookalike domain monitoring works in the gap between that purchase and the first victim. It watches for the purchases, and for what the domains are used for next. That might be a copy of your website, a fake login page for your staff or your customers, or an email to your finance team or a customer about “new bank details”. By the time someone reports it, the cost is already yours: payments sent to the wrong account, passwords to reset, customers who no longer trust your emails.

Still deciding whether lookalikes are worth the worry? Start with how to stop lookalike domain attacks. This guide is for choosing how.

1. Does it catch more than typos?

Typos are the variants everyone thinks of first: a swapped letter, a missing letter, an extra hyphen. They are real, and any monitor must catch them. On 16 September 2026 the Solicitors Regulation Authority warned that a fake website at raj-law[.]co[.]uk was impersonating a law firm whose genuine site is rajlaw.co.uk. One hyphen, in a conveyancing scam aimed at a property deposit.

The domains that do the most damage, though, are often ones a typo list would never contain:

• Your exact name on a different ending. In one case we have written up, an attacker registered a private-equity-backed software group's exact brand name on a different domain ending and put a near-identical copy of its website there.
• Your name with a word added. Addresses like yourbrand-invoices.com or yourbrandpay.com read naturally, which is the point. In an invoice fraud case we worked on, the lookalike simply added a product word to the company's brand name.
• A variation on your company name. On 16 September 2026 the Financial Conduct Authority warned that themoneycompass[.]net was cloning an authorised firm whose genuine email address, as the FCA lists it, is at moneycompassltd.co.uk: a word added, a word dropped and a different ending.
• Characters that look identical, such as a Cyrillic “а” where your name has a Latin “a”.
• Every name you trade under: your legal company name, product names, and the brands of any business you have acquired.

Check each vendor's list against those five shapes.

Ask the vendor: “Show me the lookalikes you would watch for my domain.”

2. When does it first see the domain?

Timing is what you are paying for. A monitor that first hears about a lookalike from a blocklist or a customer complaint is telling you about an attack that has already reached someone.

Two moments come earlier. The first is registration, when the domain is bought and appears in public registration data. The second is when a security certificate is issued for it, so that the site will show a padlock. Certificates are logged publicly too, and issuing one is usually one of the last steps before a site is used. A good monitor sees both, including a certificate issued for an address that carries your brand in a subdomain of an otherwise unrelated domain.

Be clear about what that early sight buys you. Takedown has to wait until the domain is used, because registrars and hosts act on evidence: a copy of your site, a fake login page, or email sent in your name. Early sight means that when the evidence appears, the domain is already on your watchlist with its details gathered, and the takedown starts straight away instead of from scratch. In the software group's case, the lookalike was flagged when it was registered, matched again when its certificate was issued, confirmed when the copied site went live, and taken offline before any customer, prospect or employee was known to have used it.

Ask the vendor: “For a lookalike registered this morning, when would I hear about it: at registration, when a certificate is issued, or when someone reports it?”

3. Does it watch lookalikes that never host a website?

Some of the most expensive lookalikes never host a page at all. They exist to send email: an invoice with new bank details, a request from “the CEO”, a note to a customer about a changed payment arrangement. On 18 September 2026 the SRA warned that fraudsters were writing from an address at tmjlegals[.]co[.]uk, one letter away from a law firm's genuine tmjlegal.co.uk, in correspondence about property purchases that invited the recipient to transfer funds in instalments. The notice names an email address and no website.

A domain like that has nothing on it for a website-watching tool to see. Its email set-up gives it away: whether it has been configured to send and receive mail, and when that changes. That was the whole shape of the invoice fraud case above. The lookalike existed purely to send and receive email, and the evidence for its takedown came from its mail records, because there was no website to point to.

DMARC on your own domain is worth having, and it protects mail that claims to come from your exact address. A lookalike is a different domain with its own records, so it sits outside your DMARC policy's reach.

Ask the vendor: “Which lookalikes of my domain can send email today, and will you tell me when that changes?”

4. Does it notice when a quiet domain wakes up?

Most lookalikes are quiet when they are registered: parked, empty, or pointing nowhere. Some stay that way. Others are held until they are needed, and only get a website, email or a certificate shortly before they are used.

A one-off scan is a photo. Your exposure is a video. A report listing every registered lookalike of your domain, most of them parked, is accurate on the day it runs and silent about the one that gets email set up next week.

So a monitor has to keep re-checking every lookalike it has found, and alert on change: a parked domain that starts serving a website, a domain that gains mail records, a site whose content starts to resemble yours. Attackers change their set-ups mid-campaign too. In the invoice fraud case, the attackers added another email-sending platform partway through, the change in the domain's mail configuration was caught, and the new provider was added to the takedown.

Ask the vendor: “How often do you re-check a domain you have already found, and what changes trigger an alert?”

5. Will it find a copy of your website on an address that looks nothing like yours?

Every question so far starts from your domain name. Some attacks leave it out. A copy of your website can sit on an unrelated domain, on a hacked site, or on a free hosting platform with your brand as the project name, which involves no domain registration at all (here is what to do when you find one).

For those, a monitor has to watch for your website itself turning up elsewhere, as well as for names that resemble yours. A vendor should be plain about the limit: this covers copies that carry your content. An email-only lookalike carries none, which is why question 3 stands on its own.

Ask the vendor: “If someone copied my site onto an address with no resemblance to my name, how would you find out?”

6. Will your team act on its alerts?

A monitor that alerts on every registered lookalike will soon be ignored. Plenty of registered lookalikes are harmless: held by domain investors, parked for resale, or bought years ago by your own marketing team. A useful monitor separates those from the few being set up for use, and says why.

Look for three things. Each alert says in plain English what was found and why it matters. Each shows the evidence behind the judgement. And each arrives where your team already works, whether that is email, Slack, Teams or your SIEM.

Ask the vendor: “Show me a real alert. What would my team do with it in the next ten minutes?”

7. What happens after the alert?

This question decides whether you have bought protection or a to-do list.

When a lookalike is used against you, it comes down when someone with control over it acts: the registrar that sold it, the host serving it, the email provider it sends through, and the warning services built into major browsers and email filters. Each has its own abuse process, its own queue and its own idea of what evidence it needs.

By hand, that is slow and it grinds you down. Someone gathers the screenshots, registration details and emails, then writes a report for each provider in the form that provider wants. Reports come back as “not our customer” or “contact the registrar”. Someone phones help desks, re-sends the same evidence, and checks every day whether the site still loads and the mail still flows, because a closed ticket can still mean a live domain. When the attacker registers the next one, it starts again. In most mid-market companies that lands on the head of IT or the security lead, and the work they were hired to do waits.

So ask every vendor who owns the week after the alert:

• Is the evidence captured with the alert, or do we collect it?
• Is takedown included, a separate service, or charged per takedown?
• Who follows up until the domain is actually offline, and how do we know it is?
• Does monitoring carry on afterwards, to catch the same attacker's next domain?

This is the part DefendDomain runs for you: evidence is captured with every alert, one click starts the takedown across up to 12 channels at once, and the follow-ups, checks and escalation are handled until the domain is offline. Takedowns are unlimited on every plan, or we can manage the whole service for you. Book a demo to see it on your own domain.

Can you monitor lookalike domains yourself?

Partly, and for a small business it is a sensible start. Free tools will generate typo variants of your domain, and you can add your own list of other endings, brand extensions and legal names. Then someone has to check every variant, every day: whether it has been registered, whether it has email set up, whether a website has appeared and what it shows. On top of that, they have to watch newly issued certificates for your brand, search for your own content turning up elsewhere, decide which hits matter, and run the takedown above by hand.

Each step is doable. Together they add up to a part-time job that is in nobody's job description, and the gaps show on the day it matters: the variant nobody thought to add, the domain that got email set up on a Friday afternoon, the report still sitting in a queue.

If you are small, a middle route is to run our free domain threat analysis every week or two. It shows which lookalikes of your domain are registered and which can send email. It won't alert you to changes or run a takedown, but it turns “a customer told us” into “we noticed” for a good share of cases. If a lookalike would cost you customers, payments or credentials, you need the continuous version.

How to run the evaluation

Put every tool on your shortlist through the same test:

1. Give each vendor your main domain, plus the legal and trading names you use.
2. Ask which lookalikes they already see registered today, and which of those can send email.
3. Ask them to walk you through one real detection, from first sight to the domain being offline, and to show you where the evidence and the follow-ups sit.
4. Get the terms for takedown in writing: included, charged per takedown, or extra.
5. Compare what each one finds against your own baseline from the free analysis.

If you want to see how named vendors in this category compare, we have written up how DefendDomain compares, including where each of the others is the better buy.

Why the timing matters

The cost of a lookalike domain is set by how long it works against you: the invoices it sends, the passwords it collects, the customers and staff it reaches. Early detection and early takedown keep that window short, so choose the monitor that will already be watching on the day a lookalike is used against you.

To see what is already registered around your domain, run a free domain threat analysis.

Frequently asked questions