A logistics company’s customer receives a message about a change of bank account number. The logo, footer and signature all match, while the sender address differs from the real one by a single letter: instead of “examplecorp.com” it reads “examplecrop.com”. The customer pays, the company finds out during debt collection, and the IT team checks the DMARC record, which has been working correctly for a long time.
Typosquatting, the registration of domains deceptively similar to a brand’s domain, is cheap for the attacker and hard for the victim to notice. In email cybersecurity it is a gap that no DNS record on the company’s side closes, because the lookalike is someone else’s domain with its own records. The defence consists of detecting such domains, assessing which are dangerous, and quickly blocking or taking them over.
What is typosquatting?
Typosquatting is the registration of a domain that differs from a brand’s domain by a typo or another small detail, so that the recipient takes it for the real one. The attacker uses such a domain in emails, on fake login pages or to distribute malware.
The MITRE ATT&CK knowledge base describes this in technique T1583.001 (Acquire Infrastructure: Domains), version 1.4, last modified on 18 September 2026. According to the description, adversaries may choose domains similar to legitimate ones, including through homoglyphs or a different top-level domain, and typosquatting may be used to deliver payloads through drive-by compromise. Domains can be purchased and in some cases acquired for free. MITRE also lists the takeover of expired domains, which defenders may trust because of their history.
In a broader sense, typosquatting covers any domain built to imitate a brand, not just a typo. What matters is the goal, misleading the recipient, rather than a particular technique.
What techniques do attackers use to build lookalike domains?
Attackers modify the brand name so that the difference escapes a quick read: they drop or swap letters, replace characters with similar ones, change the top-level domain or append a word. The table below shows variants of the example domain “examplecorp.com”.
| Technique | Example | What gives it away |
|---|---|---|
| dropped letter | examplcorp.com | shorter name, visible when reading slowly |
| swapped letters | exmaplecorp.com | disturbed order, easy to overlook |
| doubled letter | exampplecorp.com | repeated character |
| visually similar character | examp1ecorp.com, exarnplecorp.com | digit instead of a letter, “rn” instead of “m” |
| different top-level domain | examplecorp.co, examplecorp.eu | the end of the address |
| added word or hyphen | examplecorp-invoices.com | an extra element that sounds credible |
| deceptive subdomain | examplecorp.com.account-login.net | the real domain sits at the start, not at the end of the address |
| diacritic | exämplecorp.com | “ä” instead of “a”, almost invisible in a small font |
The last row shows that a lookalike domain does not have to contain an error. For a company that registered its name without diacritics, the name with “ä” is a separate, available domain. The “deceptive subdomain” row, in turn, belongs to the broader sense from the definition section: nobody registers a typo of the brand’s domain here; the attacker puts the brand name in a subdomain of their own domain.
What do attackers use lookalike domains for?
Attackers use lookalike domains above all for messages that should look like the company’s correspondence and for pages that should look like its services. MITRE ATT&CK lists phishing, drive-by compromise and command and control among the uses.
The scale in Poland is visible in the description of the CERT Polska Warning List: phishing sites are registered in large numbers, used shortly after registration and then abandoned for new addresses. For a defender this means that a domain can be dangerous from its first hours and stops being useful to the attacker before an ordinary legal procedure even begins.
The scenarios that directly cost money or access are invoices with a swapped account number, requests for an urgent transfer from the supposed board, and fake login pages for mail, a customer system or a partner portal. The same impersonation pattern is described in the article on spear phishing.
Why don’t DMARC, SPF and DKIM protect against typosquatting?
DMARC, SPF and DKIM protect against the use of your own domain, while a lookalike domain is a different domain that the attacker configures at will. It can have valid SPF records, DKIM signatures and a DMARC policy, so a message from it passes all three checks.
The RFC 9989 specification of May 2026, which replaced RFC 7489, says so directly in its anti-phishing section: DMARC can directly combat only spoofing of the exact same domain and does not address visually similar domain names or the sender’s display name. Deploying DMARC is therefore necessary but not sufficient.
How to configure SPF, DKIM and DMARC for your own domain is covered in the guide to email security. Typosquatting requires an additional layer that looks at domains outside your control. The difference between impersonating the real domain and a lookalike is also explained in the article on spoofing.
What are IDN homograph attacks and do they affect .pl domains?
An IDN homograph attack is the registration of a domain with characters from another script that look like Latin ones, for example a Cyrillic “а” instead of a Latin “a”. MITRE ATT&CK describes this variant as an “IDN homograph attack”, in which the attacker creates visually similar domains using Cyrillic or Greek characters.
Technically, a name with national characters is stored in DNS in ASCII form with the “xn—” prefix, following the Punycode encoding of RFC 3492 (March 2003) and the IDNA rules of RFC 5890 (August 2010). NASK, the .pl registry, states in its IDN registration rules that the subject of the contract is precisely the ASCII form and that a name may contain characters from only one national character set. Mixing sets is not allowed.
For .pl domains this means that a name combining Latin and Cyrillic letters will not pass registration. It does not, however, protect against a name built entirely from one set, for example Latin with “ł” or “ó”, or against domains in other registries, which set their own rules. Mechanisms for detecting confusable characters are described in the Unicode UTS #39 standard (version 18.0.0 of 27 August 2026), which distinguishes single-script, mixed-script and whole-script confusables.
How do you detect domains impersonating your company?
You detect lookalike domains by comparing new registrations, DNS records and certificates with a list of variants of the company name. A one-off check is not enough, because new domains appear every day.
In its detection guidance for technique T1583.001, MITRE ATT&CK recommends monitoring for domains created with a structure similar to your own, including under a different top-level domain, and using WHOIS databases and passive DNS. The same description notes that reputation-based detection is difficult until the domain has been categorised. A fresh lookalike usually has no bad reputation yet.
The second source of signals is public certificate logs. RFC 9162 (December 2021) describes Certificate Transparency: interested parties can regularly ask the logs for new entries, and anyone can monitor them. A certificate for a name close to your brand is a signal that someone is preparing a site with a padlock in the address bar.
In practice the process has three elements: a list of name variants (typos, similar characters, other endings), sources of data about new domains and certificates, and a rule on who assesses a hit and within what time. Without the third element, monitoring produces a list that nobody reads.
Key takeaways:
- A lookalike domain belongs to someone else, so DMARC on your own domain will not stop it.
- In the .pl domain, mixing scripts is prohibited, but variants with diacritics are possible.
- Detection relies on monitoring registrations, DNS and certificate logs, not on domain reputation.
How do you assess whether a domain you found is dangerous?
You assess a domain you found by whether it is ready for an attack: whether it has mail records, a certificate, content resembling your website and a recent registration date. The mere registration of a similar name does not have to mean an attack, because it may be a coincidence or the work of a domain speculator.
An MX record means the domain is ready to receive mail, so it can carry on a correspondence with customers who reply to a message. A certificate and a login page closely resembling yours mean preparation for credential theft. A domain registered a few days ago, with hidden registrant data and a name containing words such as “invoice”, “payment” or “login”, calls for a response within hours, not weeks.
It is worth recording the result of the assessment in three categories: watch, block internally, and report for takedown. An internal block on the mail gateway and in the DNS filter works immediately and does not depend on the registrar, which is why it comes before the takedown procedure, not instead of it.
Is it worth registering domains similar to your own?
It is worth registering a few of the most obvious variants, but this cannot close the problem. MITRE ATT&CK lists registering domains similar to your own as a preventive measure (M1056, pre-compromise) intended to deter adversaries from typosquatting.
The limitation is the number of possible variants. There are more combinations of typos, similar characters, top-level domains and added words than a company can maintain. Defensive registration makes sense for variants customers type by mistake, for the main endings in which the company operates, and for the name with diacritics if the brand contains a national letter.
Registered variants should redirect to the main website and carry records that block mail sending, that is SPF with no permitted senders and DMARC with a reject policy. A domain meant to protect the brand must not become a back door itself.
How do you take down a lookalike domain or block access to it?
The fastest route is to block access: report the site to the national CERT, to the registrar and to the hosting provider. Taking the domain over requires proceedings before an arbitration court or a common court, which take longer. The CERT Polska Warning List covers phishing websites. A domain used only for email, as in the invoice example, is reported to the registrar and to the email or hosting provider, and blocked on your own mail gateway until it is taken down.
In Poland, the CERT Polska Warning List has been running without interruption since March 2020. A phishing site can be reported through the incydent.cert.pl/phishing form, and a suspicious text message can be forwarded to 8080. A domain on the list is blocked by the telecommunications operators, companies and organisations that use it, and an entry stays on the list for six months.
For generic domains such as .com, there is the UDRP procedure, adopted by ICANN on 26 August 1999 and applied by all ICANN-accredited registrars. The complainant must prove three elements: the domain is identical or confusingly similar to its trademark, the registrant has no rights or legitimate interests in it, and the domain was registered and is being used in bad faith. The outcome can be cancellation of the domain or its transfer to the complainant.
The .pl domain has its own rules, and other country-code domains follow the rules of their own registries. The .pl domain name regulations, in the version in force since 1 December 2015, refer disputes to the permanent arbitration courts indicated by NASK or to another court. Once NASK is notified of a dispute, a change of the domain’s registrant is suspended until the dispute ends, but for no longer than a year. NASK does not resolve disputes itself, and among the arbitration courts it lists the Arbitration Court for Internet Domains at the Polish Chamber of Information Technology and Telecommunications. Choosing the legal route is a decision for a lawyer, not for the IT team.
How do you build a brand protection process against lookalike domains?
You build a brand protection process like any threat detection process: with a list of what you are looking for, data sources, assessment criteria, a response path and an owner. The table below lists the stages and the signals that a given stage works.
| Stage | What it covers | Data source or tool | Who is responsible | Signal that it works |
|---|---|---|---|---|
| Variant list | typos, similar characters, other endings, diacritics, added words | own list and variant generator | security and marketing | list updated with every new brand or product |
| Monitoring | new registrations, DNS records, certificates | WHOIS, passive DNS, Certificate Transparency logs, EASM platform | security | hits assessed within the agreed time |
| Assessment | MX, certificate, page content, registration date | manual or automated analysis | security analyst | every hit has a category and an assessment date |
| Internal block | mail gateway, DNS filter, proxy server | own systems | administrators | domain blocked the same day |
| Report | national CERT, registrar, hosting | reporting forms | security | confirmation that the report was accepted |
| Legal route | UDRP for generic domains, arbitration or common court for .pl | law firm | legal department | decision to take over or to consciously let go |
| Communication | warning customers and employees | website, newsletter, intranet | marketing and communications | customers know which domains you write from |
The last row is often skipped, yet it works in the company’s favour in any dispute with a customer. A customer who knows that invoices come from one domain only will spot a lookalike faster and report it faster.
Key takeaways:
- A variant list, monitoring, assessment and same-day blocking give the most at the lowest cost.
- A report to CERT Polska blocks the site at operators before the legal route even begins.
- Taking a domain over means UDRP for generic domains or an arbitration or common court for .pl.
How can nFlo help you detect domains impersonating your brand?
nFlo implements Bitdefender GravityZone EASM, which according to the product description detects lookalike domains impersonating the brand as well as expiring certificates. During implementation we configure the monitoring scope: domains, subsidiaries and the assets of selected suppliers, and we translate the findings into an action plan.
Within the Threat Intelligence service, nFlo delivers IOCs, including domains, for deployment in SIEM and EDR systems, and monitors the dark web for mentions of the organisation and data leaks. nFlo is neither a domain registrar nor a law firm, so domain disputes are handled by your lawyer. If you want to check which domains are impersonating your brand today, contact us.
What else is worth knowing about typosquatting?
How does typosquatting differ from domain spoofing?
Spoofing impersonates the company’s real domain, for example by putting it in the sender header. Typosquatting uses a different domain registered by the attacker that only looks similar. DMARC protects against spoofing; against typosquatting you have to monitor registrations of similar domains.
Does DMARC protect against lookalike domains?
No. RFC 9989 of May 2026 states that DMARC combats only spoofing of the exact same domain and does not address visually similar domain names. A lookalike domain can have its own valid SPF, DKIM and DMARC records.
Can a .pl domain mix Cyrillic characters with Latin letters?
Not within one name that contains Latin letters. NASK rules for IDN domains allow characters from only one national character set and prohibit mixing sets. Within the Latin set, however, names that differ by a diacritic, such as ł instead of l, are possible.
Where can you report a website impersonating your company?
In Poland, a phishing website can be reported to CERT Polska through the incydent.cert.pl/phishing form, and a suspicious text message can be forwarded to 8080. Domains on the CERT Polska Warning List are blocked by the operators and companies that use it.
Does it make sense to register every similar domain?
You cannot register every variant, because the number of possible typos and top-level domains is too large. MITRE ATT&CK lists registering similar domains as a preventive measure, but it is sensible to limit it to a few obvious variants and monitor the rest.
