How to Detect Brand Impersonation and Lookalike Domains

How to Detect Brand Impersonation and Lookalike Domains

Detect brand impersonation by monitoring for domains that copy your name through misspellings, character swaps, and extra keywords, then checking which of those domains have active DNS, mail servers, or TLS certificates — the signals that turn a parked lookalike into a live phishing site. The fastest way to see every variant that already exists is an automated scan of your brand at dokyma.com, which generates the permutations and checks the live infrastructure for you.

Brand impersonation is when an attacker uses your name, logo, or domain to trick your customers, employees, or partners into trusting a fraudulent message or website. Lookalike domains are the delivery vehicle: a near-identical web address that hosts a fake login page, sends invoice-fraud emails, or runs a fake support scam.

What brand impersonation actually looks like

Impersonation isn't one attack — it's a family of techniques that all trade on visual and psychological confusion. The domain is the anchor, because a convincing address makes the email or landing page believable.

Here are the main lookalike patterns, each with the mechanism that makes it work:

• Character substitution (typosquatting): swapping adjacent-keyboard letters or dropping a character — `exapmle.com`, `exampl.com`. This catches typos and fast readers who don't inspect the address.
• Homoglyphs and IDN spoofing: replacing a Latin letter with a visually identical Unicode character, such as a Cyrillic "а" in place of "a". The address renders almost identically in a browser but resolves to a completely different domain.
• TLD swaps: taking your exact name and registering it under a different extension — `example.net` or `example.co` when you own `example.com`. Nothing is misspelled, so it reads as legitimate.
• Combosquatting: appending a trust word to your real name — `example-login.com`, `example-support.net`, `secure-example.com`. Victims expect brands to use words like "login" and "billing," so the extra term lowers suspicion.
• Subdomain tricks: burying your brand inside a subdomain of an attacker-controlled domain — `example.com.verify-account.net`. People read left to right and stop at the familiar name.
• Hyphenation and pluralization: `ex-ample.com`, `examples.com`, or doubled letters. Cheap to register and easy to overlook.

The domain is only step one. To phish successfully, an attacker usually configures MX records so the lookalike can send mail, and requests a TLS certificate so the fake site shows the padlock. Those two signals are what separate a harmless parked name from a weaponized one — and they're exactly what you should be watching.

Why impersonation succeeds

Brand impersonation works because trust is transferred, not verified. Customers trust the name in the "From" field and the padlock in the address bar; they rarely inspect the full domain character by character. Attackers exploit three specific gaps:

1. Visual similarity beats scrutiny. A homoglyph or a single dropped letter is invisible at a glance, especially on mobile where the full URL is truncated.
2. TLS is misread as legitimacy. A free certificate makes any lookalike show "https" and a lock icon. That padlock proves the connection is encrypted, not that the site is yours — but most users treat it as proof of identity.
3. Context primes the target. A combosquat like `example-invoices.net` arriving during your billing cycle feels expected. The domain doesn't have to be perfect; it has to be plausible in the moment.

How to detect lookalike domains

Detection means finding registered variants of your name and then judging which ones are actually dangerous. You can't do this reliably by hand — the permutation space runs into thousands of combinations per brand once you factor in substitutions, TLDs, and combosquats. This is the work Dokyma automates, but knowing the signals tells you what a good scan is checking.

Run through this detection checklist for any suspicious domain:

• Permutation coverage. Has anyone registered the obvious misspellings, homoglyph versions, hyphenations, and combosquats of your name? Enumerate them systematically, not just the few you can think of.
• TLD sweep. Check your exact name across the common and country-code extensions. A registered `.co`, `.io`, or `.net` twin is a frequent phishing host.
• DNS records (A / CNAME). A domain that resolves to a live IP is hosting something. A parked or unresolved domain is lower risk — for now.
• MX records. Mail-exchange records mean the domain can send and receive email. A lookalike with MX configured is set up for phishing or business-email compromise, and deserves urgent attention.
• TLS certificates in Certificate Transparency logs. Every publicly trusted certificate is logged in CT logs. A newly issued certificate for a name resembling yours is one of the earliest signals that an attacker is preparing a convincing HTTPS phishing page — often before the site goes live.
• WHOIS and registration age. Recently registered domains, privacy-shielded registrant details, and registrars known for abuse tolerance raise the risk score. A domain registered yesterday that already has MX and a certificate is a live threat.
• Content and visual match. Once a site is up, does it clone your logo, color scheme, or login form? A pixel-copy of your sign-in page is unambiguous intent.

The high-priority combination to act on immediately: a lookalike name that resolves in DNS, has MX records, and shows a fresh TLS certificate. That's a phishing operation being assembled in real time.

Continuous monitoring beats one-time checks

A single audit tells you what exists today. Attackers register new lookalikes constantly, and the dangerous window is short — often days between registration and an active campaign. Certificate transparency is the leading indicator, because the certificate frequently appears before the phishing email lands.

Dokyma watches these signals for your brand continuously — generating the permutation space, checking DNS and MX records, and scanning certificate transparency logs — so a new lookalike surfaces the moment its infrastructure appears rather than after a customer reports a scam.

What to do when you find one

Finding a live lookalike is only useful if you act on it. Move in this order:

1. Preserve evidence. Capture the domain, its DNS and MX records, the certificate details, and screenshots of any cloned page before it's taken down. You'll need this for a takedown request.
2. Report to the registrar and host. Abuse complaints backed by evidence of trademark impersonation and phishing are the fastest route to removal.
3. Warn your audience. If a campaign is already sending mail, a short, direct notice to customers and staff — telling them the exact real domain to trust — blunts the attack immediately.
4. Harden your own domain. Publish SPF, DKIM, and DMARC records so spoofed mail using your exact name gets rejected. Register the highest-risk variants yourself — common misspellings and the main alternate TLDs — so attackers can't.

Start with a scan

You can't defend against lookalikes you can't see. Run a free brand scan at dokyma.com to generate every realistic permutation of your name, check which ones have live DNS, mail servers, and TLS certificates, and see exactly which impersonation domains already exist before they're used against your customers.