What Is a Look-Alike Domain and How Does It Fool You?

A look-alike domain is a domain name built to imitate a real, trusted one. By changing a character or two, attackers create an address that reads as legitimate at a quick glance but actually belongs to them.

It is the engine behind a huge amount of email impersonation. The trick is simple. Your eyes read what they expect to see, and the small difference slips by.

How a look-alike domain fools the eye

Your brain auto-corrects familiar words, so a near-perfect copy passes inspection, especially on a small phone screen or in a busy moment.

Common manipulation tactics:

• Character swaps. Replacing a letter with a similar one, like the number 0 for the letter o, or rn to look like m.
• Added or dropped letters. A doubled letter or a missing one, such as compny or companyy.
• Extra words. Tacking on a word, like company-support or company-billing.
• Different endings. Swapping the top-level domain, for example using .co instead of .com.
• Subdomain tricks. Placing the real name in a subdomain so company.attacker.com looks reassuring at first.

Each tweak is small on its own. That is the point.

Why look-alike domains are so effective

These domains work because they target trust and habit, not technology.

• Trust transfers instantly. If a message looks like it is from a known vendor or coworker, people lower their guard.
• We skim, not read. Few people inspect a full email address before acting.
• Mobile hides detail. Phones often show only a display name, concealing the real address entirely.
• They pair with a good story. A look-alike domain plus a believable request is a complete attack.

This is a core technique in business email compromise, where a convincing fake address carries a fraudulent payment or data request.

How to spot a look-alike domain

Build these habits, and teach them to your team.

1. Read the full address, not the display name. The name shown can be anything. The address after the @ is what matters.
2. Check character by character on anything involving money or sensitive data.
3. Compare against a known-good address you already have on file.
4. Be extra careful on mobile, where the real address is often hidden.
5. Hover over links to see where they truly lead before clicking.

When something feels even slightly off, verify the request through a separate channel. Spotting these subtle clues is closely related to learning how to spot a phishing email.

Why manual checking is not enough

Even careful people miss look-alike domains. The differences are designed to be invisible, and no one can inspect every address in a busy inbox. People are also fastest exactly when they are most rushed, which is when mistakes happen.

That is where automation matters. CIVRA detects look-alike domains for you, comparing incoming senders against the domains you actually trust and flagging the near-misses a human eye glides over. It also analyzes sender identity and behavior, scans attachments, and reads the intent of a message, so an impersonation attempt is caught before anyone has to judge it. It works alongside Microsoft 365 and Google Workspace with a Chrome extension and an Outlook add-in. See the features page for how it fits a small team.

How to reduce your own exposure

You can also make your business a harder target.

• Register common misspellings of your own domain so attackers cannot grab them.
• Set up email authentication such as SPF, DKIM, and DMARC to make spoofing your domain harder.
• Tell partners and customers which domains you actually use, so they can spot fakes.
• Standardize your sending domains instead of using many variations that blur the line.

FAQ

What is the difference between a look-alike domain and spoofing?

A look-alike domain is a separately registered domain that resembles a real one, so messages genuinely come from the fake address. Spoofing forges the real address without owning it. Both aim to impersonate a trusted sender.

What is typosquatting?

Typosquatting is registering domains based on common typos of a popular name, like a doubled or missing letter. It is one way attackers create look-alike domains that catch people who mistype or skim.

Why are look-alike domains hard to catch by eye?

The changes are intentionally subtle, such as a swapped character or an extra word, and our brains auto-correct familiar names. On mobile, the real address is often hidden behind a display name, making it even harder.

Can I protect my own domain from being imitated?

Yes. Register common misspellings, set up SPF, DKIM, and DMARC, and standardize the domains you send from. These steps make it harder for attackers to impersonate your business convincingly.

Stop look-alike impersonation before it reaches your team. Start with CIVRA or see options on our pricing page.