A lookalike domain attack is when an attacker registers a domain that differs from yours, or a partner's, by a single letter, hyphen or extension, such as exarnplefirm.com for examplefirm.com, and sends email from it. Because the attacker genuinely owns that domain, the email can pass SPF, DKIM and DMARC, so only a check that measures domain similarity will catch it.
Some versions use Cyrillic letters that look identical on screen. A sound defence has three parts: protect your own domain, detect similarity in inbound mail automatically, and confirm critical requests through an independent channel.
Why these attacks work so well
When someone opens an email, their eye does not read the address letter by letter; it recognises a familiar shape. Telling exampleholding.com from exampleho1ding.com on a busy day is hard, and on mobile devices the address is often hidden altogether, with only the display name shown.
Attackers register these domains cheaply and for a specific target. They are usually short-lived: used for a few weeks, then dropped, finishing the job before they land on blocklists. Typical scenarios include:
- Supplier impersonation: an email to accounts from an address resembling a real supplier, announcing "our new bank account". We cover the freight-sector version in logistics email fraud.
- Executive impersonation: an "urgent and confidential" payment request to finance from an address resembling your own domain.
- Customer impersonation: order or quote correspondence to sales from a domain imitating a customer's. During a tender the target is the bid file itself; see our tender email security controls.
- Fake login pages: a credential-harvesting page on a domain that resembles your company portal. Limiting the damage of a stolen password with multi-factor authentication is covered in business password security.
The cost of ignoring the problem
Lookalike domains are the infrastructure behind phishing and payment diversion fraud, and the scale of those attacks shows why this matters.
According to Türkiye's Ministry of Transport and Infrastructure, USOM, the national computer emergency response team, blocked access to 991 domains used for phishing and prevented 5,869 phishing attacks in January 2025 alone.
- The APWG Phishing Activity Trends Report for Q2 2026 recorded 1,069,681 phishing attacks in the quarter, up 10.1% on the previous one.
- The FBI IC3 2025 Internet Crime Report shows 24,768 business email compromise (BEC) complaints in the US in 2025, with total reported losses of $3.05 billion. Much of this fraud relies on addresses that imitate a trusted contact.
Protection of organisations' own domains is patchier than many assume. EasyDMARC's 2026 DMARC Adoption Report, which scanned 1.8 million domains, found that 52.1% have a DMARC record but only 411,935 domains (about 23%) enforce a quarantine or reject policy. Many organisations leave the door open even to exact-match spoofing of their own address.
Types of lookalike domain
| Type | Example (real: examplefirm.com) | Why it works |
|---|---|---|
| Letter substitution | exarnplefirm.com ("rn" for "m") | At small font sizes "rn" looks like "m" |
| Digit–letter swap | examp1efirm.com | "1" and "l", "0" and "o" are easily confused |
| Added or missing letter | examplefirmm.com, examplefrm.com | The eye fills in the gap when reading quickly |
| Hyphen or extra word | example-firm.com, examplefirm-uk.com | Looks corporate and "official" |
| Different extension | examplefirm.co, examplefirm.com.tr | Few people check the extension |
| Subdomain trick | examplefirm.com.verify-account.net | The start looks right, which builds trust |
| Homoglyph (IDN) | Cyrillic "а" instead of Latin "a" | Identical on screen; underneath it is a different name beginning xn-- |
The last row deserves attention. Internationalised domain names (IDNs) allow letters from other alphabets in domain names. Characters that look identical but have different codes cannot be told apart by the human eye; only software can see the difference.
Seven steps to defend against lookalike domain attacks
- Move DMARC on your own domain to enforcement. Once SPF and DKIM are set up correctly, monitor with
p=none, then move top=quarantineandp=reject. This stops exact spoofing of your address. See SPF, DKIM and DMARC explained for detail. How to spot spoofing attempts in the reports you receive during thep=nonephase is covered in how to read DMARC reports. - Register the most likely variants defensively. Hyphenated spellings, common extensions and the most obvious typos. You cannot register every variant, but closing the easiest ones raises the attacker's effort.
- Keep a list of key contacts. Know the real domains of the suppliers you pay regularly and the customers you correspond with; this list is the reference for any similarity check.
- Check inbound mail for similarity automatically. Your email platform should ask of every message whether the sender's domain imitates yours or a known contact's, and whether it contains international characters. It is one of the criteria to test when you choose a business email service.
- Make external senders visible. Clearly marking mail from outside the organisation makes it easier to notice an external message using a "Managing Director" display name.
- Confirm critical requests through an independent channel. Bank-detail changes, urgent payments and password requests should never be accepted by email alone; call the contact on the number you already hold. We cover this scenario in our guide to bank detail change email fraud.
- Show your team real examples. The table above is enough material for a short awareness session. For the wider set of warning signs, see how to spot phishing emails.
When you notice a suspicious domain
Forward the message to IT before deleting it; others in the organisation may have received mail from the same domain. If it imitates one of your suppliers, tell the supplier too, since their other customers may be targeted. If correspondence containing personal data was sent to that address, assess whether it counts as a personal data breach under KVKK (Türkiye's Law No. 6698 on the Protection of Personal Data, broadly comparable to GDPR); our data protection compliance team can help with that assessment. If notification is required, the deadline and steps are set out in the KVKK 72-hour breach rule.
To set up your own domain's authentication records correctly from the start, follow the eight steps in how to set up email with your own domain.
How we approach this at Digital Bridge
In our cyber security consultancy we handle lookalike-domain risk with a concrete inventory:
- Domain inventory: we list every domain your organisation owns, its SPF/DKIM/DMARC status and the current DMARC policy level, then plan the move to enforcement in stages.
- Variant analysis: we identify the variants of your domain that are easiest to imitate and help you decide which are worth registering defensively.
- Contact list and process: we document the domains of the suppliers you pay and write down the procedure for confirming bank-detail changes.
- Email platform: if your current system does not detect lookalike domains, we plan a move to one that does so on every message through our cloud migration and infrastructure consultancy.
How SmartMail catches lookalike domains
SmartMail, the business email product in our own Smart360 family, assesses every inbound message against 12 signals. Two of them target this attack directly: lookalike domain and international character checks. They sit alongside display-name and brand impersonation, Reply-To and link mismatches, SmartMail's own SPF/DKIM/DMARC and PTR verification, risky attachments and content assessment.
A concrete scenario: your purchasing team receives an email from your logistics provider's domain, except that a Latin "a" has been replaced with a Cyrillic "а". It asks for the attached proforma invoice to be paid today. The address looks identical and passes DMARC. SmartMail flags the message with a written report stating the reasons: the domain contains international characters and imitates a known contact's domain, and the content carries a payment request. If the message falls below the trust threshold your organisation sets, it is quarantined. The default threshold is 70, and before you change it SmartMail shows how many messages the change would affect.
One important detail: authentication and domain checks are run by software and keep working even if the AI usage allowance is used up, so this protection does not depend on the AI quota.
There is also a layer against the second stage of the attack. Even if a message gets through, replies such as a payment confirmation sent on behalf of the organisation can be routed through SmartMail's send approval, which puts them before one or more approvers; every step is recorded with date and time. In shared mailboxes, team notes and "flag for attention" let staff point a colleague to a suspicious message. Our article on email approval workflows explains how to set this up.
Next step
Start by seeing where your domains stand today: what level DMARC is at, which variants are exposed, and whether your inbound email platform measures similarity at all. Our cyber security team can run that assessment; you can also explore SmartMail's security analysis on the Smart360 page or contact us for a live demonstration. The other fraud types that rely on domain impersonation are gathered in our Business Email & Documents guide.