Lookalike and typosquat domain detection
Finding domains that imitate your brand is the easy part. Deciding which of the hundreds of hits deserve action today is where teams lose time.
This guide explains the main kinds of lookalike domains and shows how website category data turns a long list of matches into a short, ranked queue.
What counts as a lookalike domain
A lookalike is any domain built to be mistaken for another one. Attackers, counterfeiters and domain resellers each use a handful of tricks, and good detection looks for all of them.
Typosquats
A missing, doubled, swapped or wrong letter, aimed at people who mistype an address.
nortwindbank.comKeyboard neighbours
A letter replaced by one next to it on the keyboard, a common real typing error.
northwindbsnk.comHomoglyphs
Characters that look alike, such as rn for m, 1 for l, or 0 for o, at a glance or in small fonts.
northwlndbank.comIDN lookalikes
Letters from other alphabets that look Latin. In DNS they appear as punycode starting with xn--.
xn--northwndbank-...Combosquats
The real brand plus an extra word such as login, secure, support or refund. Often the most dangerous group.
northwindbank-login.comTLD swaps
The exact brand under another ending, such as .co, .net or a newer generic ending.
northwindbank.coSubdomain tricks
The brand placed at the start of a longer name so the real domain is easy to miss.
northwindbank.com.verify-id.netSoundalikes
Names that sound the same when read aloud or dictated, such as homophones and spelling variants.
northwyndbank.comWhy detection alone floods the queue
String matching is cheap and catches a lot. For a short or common brand name it also catches far more than any team can review by hand.
Unrelated businesses
A bakery, a law firm or a local club can share part of your name in good faith. They are matches, not threats.
Parked inventory
Many lookalikes are registered and left parked, often with ads or a for-sale notice. They need watching, not a takedown today.
Fans and critics
Review sites, forums and personal blogs that mention your brand in the name are usually lawful and need a careful approach.
Your own domains
Defensive registrations and old campaign sites appear as matches unless they are listed and excluded first.
Real attacks
A small share of hits are live phishing pages, fake shops or scam support sites. These are the ones to find quickly.
New names every day
Fresh registrations keep adding to the list. A workflow that cannot rank them falls behind within weeks.
The core idea: the question is not only "does this name look like ours?" but also "what is this site, and does that make it a risk?". Category data answers the second question at scale.
How website categories sort lookalike domains
Each domain in our database carries one or more categories from a set of 59 web filtering categories, ranked by how much of the site they describe. Read on a lookalike, the category says a lot about intent.
| Category on the lookalike | What it usually means | Typical action |
|---|---|---|
| Malware / Phishing / Suspicious | The site has been judged to host credential theft, malware or deceptive content. | Act now Block, report and request takedown. |
| Same category as your own site | A lookalike of a bank that is itself categorized as Online Banking, or a shop lookalike in Shopping. | Act now Review the page for impersonation. |
| Shopping or Marketplaces | Possible counterfeit shop or unauthorized reseller using your name. | Review Check products, logos and payment pages. |
| Cryptocurrency or Financial Services | A frequent pattern in investment and giveaway scams that borrow trusted names. | Review Look for claims and payment requests. |
| Parked / For-Sale Domains | Registered but not in use, often showing ads or a sale notice. | Watch Monitor for a change of category. |
| Adult, Gambling or Dating | Traffic capture from typing errors, with possible reputation harm. | Review Decide on legal or registrar steps. |
| Blogs, Forums or News/Media | Commentary, reviews or fan content that names your brand. | Usually leave Read before acting. |
| An unrelated business category | A different company with a similar name, such as Food & Drink for a bank lookalike. | Usually leave Note and exclude. |
| No category yet | Brand new or empty. Common in the first days after registration. | Watch Recheck after a week and a month. |
A triage matrix that combines category, age and popularity
Category is strongest when read with two other fields: how new the domain is and how popular it is among real users. The matrix below is a starting point that most teams then tune.
| Situation | Category signal | Age and popularity | Priority |
|---|---|---|---|
| Combosquat of your login brand | Malware / Phishing / Suspicious | Registered this week, no popularity | High |
| Homoglyph of your shop | Shopping, same as your site | New, no popularity | High |
| TLD swap of your brand | Parked / For-Sale Domains | Years old, no popularity | Medium |
| Parked lookalike becomes active | Parked moved to Online Banking | Old name, new content | High |
| Review site with your name | Blogs/Personal Sites | Older, some popularity | Low |
| Partial name match | Unrelated business category | Established, popular locally | Low |
| Typosquat with no content | No category yet | Registered yesterday | Watch |
Why popularity helps: attack domains are rarely visited widely before they are used. A lookalike with a long track record of real visitors is usually an established business, while a fresh name with none deserves more suspicion.
A lookalike detection workflow, step by step
This is a common shape for a brand protection or security workflow. Category data sits in the middle, after candidates are found and before people spend time on review.
List what you own
Collect your brands, product names and every domain you control, including defensive registrations. These become your seed list and your exclusion list.
Generate and collect candidates
Create permutations of each brand and scan new registrations every day. A categorized newly registered domains feed adds fresh names with a label already attached.
Match candidates against the category database
Join every candidate to the local database file. Each match returns categories, country and a popularity band in one pass, with no outside calls that could reveal what you are watching.
Score with the triage matrix
Combine name similarity, category, age and popularity into one priority. Keep the rules simple enough that reviewers understand why a domain is at the top.
Review the top of the queue
People look at the high priority domains first: screenshots, page content, payment flows and contact details. Most decisions take minutes once context is in front of them.
Act and record
Block in DNS, proxy and email security, report to the host or registrar, or prepare a dispute. Record the outcome so repeat offenders are spotted.
Recheck on a schedule
Watch parked and empty lookalikes for a change of category. A move from parked to an active category is one of the best early warnings available.
Watching parked lookalikes over time
Many lookalikes sit parked for months before anything happens. Our records for new domains are checked again after a week and after a month, then refreshed monthly with the rest of the database.
The name appears in a daily delta file, often with no category yet.
A placeholder, ad page or sale notice is common. Priority stays at watch.
Some names gain real content. A shift into your own category raises the alarm.
Most sites have shown what they are by now, good or bad.
Category changes on older lookalikes keep showing up in the monthly update.
Category changes worth an alert
- Parked / For-Sale Domains to Online Banking, Financial Services or Shopping.
- No category to Malware / Phishing / Suspicious.
- Blogs/Personal Sites to Cryptocurrency, often a sign of a hijacked or resold name.
- Any change into the same category as your main site.
Changes that are usually fine
- Parked to an unrelated business category with real content.
- An active site moving to Parked / For-Sale Domains after it closes.
- Shifts between closely related content categories on a fan or review site.
- More detail in the IAB content labels on an existing site.
Our guide to parked domain detection explains the signals behind the parked label and why parked names matter to several teams.
Four short examples
The brand here is invented. Each example shows the same name similarity score leading to a very different decision once the category is known.
northwindbank-refund.comCombosquat, phishing label
Registered three days ago and categorized as Malware / Phishing / Suspicious. No popularity.
Decision: block across email and DNS today, report to the host and registrar.
northwlndbank.comHomoglyph in your own category
Categorized as Online Banking, the same as the real bank. A login form copies the real design.
Decision: urgent takedown request and a warning to customer support.
northwindbank.coTLD swap, parked
Parked for two years with a sale notice. No change in category at the last refresh.
Decision: keep on watch and consider whether buying or disputing the name is worth it.
northwindbakery.comUnrelated local business
Categorized as Food & Drink and Restaurants & Dining, with local popularity over many years.
Decision: exclude from the queue and stop alerting on it.
Fields that make triage fast
When the category database is joined to your lookalike list, a few fields do most of the work. Keep them on the review screen so nobody has to open an unknown site to learn the basics.
| Field | Example | Use in triage |
|---|---|---|
| Primary category | Online Banking | Compare with your own category to spot impersonation. |
| Secondary categories | Financial Services | Context for sites that mix several purposes. |
| IAB content category | Personal Finance | Finer topic detail when web filtering categories are broad. |
| Popularity band | Not ranked | Separates established businesses from fresh names. |
| Country | Attributed market | Flags sites aimed at markets you serve. |
| Language | Main site language | A lookalike in your customers' language is more convincing. |
| First seen date | Registered this week | Raises priority for new names. |
| Last category change | Parked to Shopping | The single best early warning on old lookalikes. |
See how the website language and country data is attributed, and how the two category systems sit together in our dual taxonomy guide.
Who runs lookalike domain monitoring
Several teams have a stake in lookalike domains, and each reads category data in its own way. One licensed database can serve them all from the same file.
Brand protection teams
Find counterfeit shops, fake support sites and misleading resellers, and rank them for legal follow up.
Security operations
Block lookalikes used in phishing against staff and customers, and hunt for visits in DNS and proxy logs.
Fraud teams
Banks, payment firms and retailers watch for fake login and checkout pages that drive account takeover.
Legal and trademark counsel
Use category history as context when deciding whether a domain dispute or takedown is worth pursuing.
Managed security providers
Run lookalike monitoring for many clients with one data set and per client seed lists.
Security product makers
Embed categories in brand monitoring, email security and threat intelligence tools under an OEM licence.
Actions after a lookalike is confirmed
The right response depends on what the site is doing. Category data helps choose the path, while the final decision stays with your team and, where needed, your lawyers.
Protective steps
- Add the domain to DNS, proxy and email block lists.
- Warn customer support so they can recognize reports.
- Search logs for staff or customers who already visited.
- Tell customers where to find the real site, without naming the fake one.
Removal steps
- Report abuse to the hosting provider with evidence.
- Report to the registrar through its abuse contact.
- For trademark cases, consider a domain dispute policy such as the UDRP for generic endings.
- For parked names, weigh monitoring against buying the name.
Legal note: a category is evidence of what a site shows, not proof of bad faith or infringement. Take legal advice before relying on trademark rights in a dispute.
Limits to plan for
Category data makes lookalike triage much faster. It does not remove the need for a person to look at the riskiest sites, and a few patterns need extra care.
Cloaking
Some phishing sites show harmless content to most visitors and the lure only to targets. Confirm high risk names directly.
Domain level labels
Categories describe whole domains. Lures hosted on a page of a large trusted platform need URL level checks.
Short lived attacks
Some campaigns last hours. Pair categories with threat feeds and email security for the fastest cases.
Good faith users
Critics, fans and similarly named businesses have rights too. Read before acting on anything that is not clearly harmful.
Quick glossary
Short definitions for the terms in this guide, handy when you explain the workflow to legal, fraud or leadership colleagues.
Typosquatting
Registering a misspelled version of a known name to catch typing errors.
Combosquatting
Adding words to a real brand name, such as login or support, to look official.
Homoglyph
A character that looks like another, used to make a fake name look real.
Punycode
The ASCII form of an international domain name, starting with xn--.
Seed list
The brands and domains you protect, used to generate and match candidates.
Delta file
A daily file of new and changed domains, so monitoring stays current.
Frequently asked questions
What is a typosquat domain?
A domain that copies a real brand with a small typing error, such as a missing, doubled or swapped letter. It catches people who mistype an address and is often used for phishing, ads or resale.
How does website category data help with lookalike domains?
Detection finds many lookalikes, and most are harmless or dormant. A category on each one shows whether it is parked, a phishing page, a shop, a fan blog or an unrelated business, so teams act on the few that matter first.
Is a parked lookalike domain dangerous?
Not yet, but it can become dangerous quickly. A change from parked to an active category such as Online Banking or Shopping is a strong signal that the name is being put to use.
What is a homoglyph or IDN lookalike?
A domain that uses characters from other alphabets that look like Latin letters. In DNS these names are stored in punycode starting with xn--, so detection should check both forms.
Can category data prove that a domain infringes a trademark?
No: a category describes what a site is about, which helps with prioritizing. Infringement and bad faith are legal questions, so take legal advice first.
How often should lookalike domains be checked again?
At registration, after about a week and after about a month, because many sites add content after launch. After that a monthly refresh catches most changes, as explained in domain categorization for cybersecurity.
Rank every lookalike by what it really is
Over 120 million categorized domains, about 300,000 new domains categorized every day and files that run inside your own systems. Match your lookalike list without sending it anywhere.