Lookalike domains and phishing: how copycat names get past users
Typosquats and brand-plus-keyword domains show up in email, ads, and fake login pages. Here is how they work, what the research says, and what to check first.
Most people do not read a full URL. They glance at a logo, a familiar word, and whether the message feels urgent. That is enough for a lookalike domain to work.
A lookalike (sometimes called a cousin domain or typosquat) is a name close enough to yours that a customer or employee can mistake it for the real thing. Think a digit for a letter, a hyphen, or your brand plus a word like login, pay, or support.
Where these names show up
Phishing email is the classic path: the From name looks right, the body copies your tone, and the link goes to a near-match domain hosting a fake sign-in page. The same pattern appears in SMS, search ads, and social DMs.
Attackers do not need to break into your real website. They need a cheap domain, a template, and a recipient who does not inspect the address bar. Published industry reports put the volume high: Fortra’s brand-threat research has cited roughly 73 lookalike domains a month for the average monitored brand. Most will be harmless. A few will not.
Why the cost lands on the brand
IBM’s 2024 Cost of a Data Breach report puts the average breach at about $4.88 million when phishing is the initial attack vector. BrandShield’s 2025 CyberScam research cites about $1.7 million in average financial damage among surveyed CISOs. Those figures are industry research, not a promise of what your company would lose, but they show the scale when a convincing fake site succeeds.
Even when credentials are not stolen, support teams spend time answering “is this email from you?”, search results keep the copycat visible, and trust erodes while you prove the site was never yours.
What to check first
Start with names that combine your brand with trusted words: login, secure, account, pay, support. Then check near-typos on your main ending (.com and the endings you actually use). Prefer hits that already resolve to a website or have mail hosts over names that do not resolve at all.
A one-off lookalike check shows what is registered today. It will not tell you what appears next week. That gap, between registration and the first customer who clicks, is where monitoring earns its keep.