On 14 March 2023, an analyst at a financial services firm noticed an unusual certificate in the daily certificate transparency log digest: a TLS certificate had been issued for "secure-paymeent-portal.com," registered two days earlier by an entity using a privacy-protecting registrar. The certificate was for a domain that was not yet live. The analyst flagged it, and the firm's security team reached out to the hosting provider to request pre-emptive takedown. Two days later, the domain went live hosting a phishing page targeting the firm's corporate clients. The firm had already warned its clients and the hosting provider had been notified, so the campaign produced fewer victims than it would have without the early warning. The detection had come from watching the certificate logs, not from waiting for a user to report the phishing page.
Lookalike domain registration is a preparation activity that precedes phishing campaigns, business email compromise attacks, and brand fraud operations. Attackers register domains that visually resemble legitimate organisational domains before using them for malicious purposes, giving defenders a detection window: the period between domain registration and deployment as malicious infrastructure. Effective lookalike domain detection exploits this window by monitoring domain registration data and certificate issuance for patterns resembling target organisations.
Attackers use a range of techniques to create domains that appear similar to legitimate targets. Typosquatting registers domains that differ from the target by a single character: a transposition of adjacent letters (defendis.com becomes defndis.com), a doubled letter (defendis.com becomes deefendis.com), or a mistyped key (defendis.com becomes sefendis.com, with S adjacent to D on a QWERTY keyboard). These domains catch users who mistype the target domain directly.
Combosquatting adds words to the target domain, exploiting the tendency of legitimate organisations to use descriptive subdomain patterns. Defenders who see "secure-defendis.com" or "defendis-login.com" may initially read these as legitimate subdomains of defendis.com before noticing the different structure. Research published in ACM CCS 2017 found that combosquatting domains are significantly more prevalent and more dangerous than simple typosquatting, with millions of combosquatting domains active at any time.
Homoglyph attacks replace characters in the domain with visually identical characters from different Unicode code points. The Latin letter 'a' and the Cyrillic letter 'а' (Unicode U+0430) are indistinguishable in most fonts, but they are different characters that produce different domains. An organisation monitoring for typosquatting using string similarity matching alone may miss homoglyph domains because the visual similarity is not captured by edit distance algorithms that operate on byte representations.
Subdomain spoofing uses legitimate domain registrars to register domains that match the target's subdomain patterns: "mail.defendis-corp.com" mimics the pattern of "mail.defendis.com" while being a completely different domain. This technique is particularly effective in phishing campaigns where users are trained to look for specific subdomain patterns as indicators of legitimacy.
Certificate Transparency (CT) was introduced by Google as a security mechanism requiring that all TLS certificates issued by trusted certificate authorities be logged in publicly auditable logs before they can be trusted by browsers. The CT requirement, which became mandatory for browser trust in Chrome in 2018, means that every TLS certificate issued for a domain of interest to an attacker is logged in a public database within minutes of issuance.
For defenders, CT logs provide near-real-time visibility into certificate issuance across the internet. Services including crt.sh and the Certstream project provide access to CT log data, and monitoring these feeds for certificates issued to domains matching lookalike patterns for a target organisation provides advance warning of phishing infrastructure preparation. A certificate being issued for a lookalike domain is often the first observable signal that an attacker is preparing a phishing campaign, because HTTPS certificates are required for credible phishing pages and are issued before the campaign goes live.
The CT log monitoring approach has an important coverage property: because CT logging is mandatory for browser-trusted certificates, attackers who want to run credible phishing pages on HTTPS must have their domains logged. The attacker cannot opt out of CT logging without also losing the ability to present a trusted HTTPS connection to victims. This makes CT logs a reliable source for lookalike domain detection that does not have the coverage gaps of approaches that rely on monitoring specific registrars or DNS systems.
Certificate transparency logs detect domains after a certificate has been issued, which is typically after domain registration and DNS configuration but before the phishing page is deployed. DNS zone transfer data and passive DNS feeds provide an earlier signal: the registration and initial DNS configuration of a domain can be detected before a certificate is issued, extending the detection window.
Passive DNS databases collect DNS query and resolution data from a network of sensors distributed across internet infrastructure, providing a historical record of DNS lookups that reveals when domains were first resolved, what IP addresses they have pointed to, and how their configuration has changed over time. By querying passive DNS databases for domains matching lookalike patterns, analysts can identify new domain registrations that have not yet had certificates issued and that may not yet be actively hosting phishing content.
Commercial and open-source domain monitoring services aggregate registration data, CT log feeds, and passive DNS data to provide continuous monitoring for lookalike domains against a defined set of protected brand terms and domain patterns. These services reduce the analytical burden on security teams by automating the data collection and initial pattern matching, presenting analysts with a curated set of newly detected domains for triage rather than requiring them to process raw CT log feeds directly.
When a lookalike domain is detected, the response depends on the domain's current state and the evidence of malicious intent. A domain that has been registered but is not yet hosting malicious content may be at an earlier stage of attack preparation or may be a legitimate registration by a third party with a legitimate reason to use a similar domain. Triage should assess the registration context, the registrant information where available, and any content already deployed on the domain before escalating to takedown.
For domains confirmed to be hosting malicious content impersonating the organisation, the response typically involves registrar abuse reporting, hosting provider notification, and in some cases URL blocklist submissions to browser security services and email security providers. The speed of this response determines how many potential victims are exposed before the infrastructure is taken down. Organisations with established relationships with registrar abuse teams and hosting provider security contacts can achieve faster takedowns than those submitting cold abuse reports through public channels.
Defensive domain registration, the practice of proactively registering common lookalike variations of the organisation's primary domain, is a complementary measure that removes some lookalike domains from attackers' available inventory. This approach is effective for the highest-priority variations but does not scale to cover all possible lookalike domains. Combined with active CT log monitoring and domain surveillance, it represents a layered approach to lookalike domain risk that reduces both the attack surface and the detection-to-response time for campaigns that use domains not covered by defensive registrations.
Organisations with significant brand recognition may find that lookalike domain detection generates substantial alert volumes: large brands can have thousands of lookalike domains registered at any given time, ranging from obvious attack preparation to defensive registrations by third parties, fan sites, and organisations with legitimate reasons to use similar domain names. Managing this volume requires a triage framework that prioritises alerts based on risk signals beyond simple domain similarity.
The highest priority alerts are lookalike domains that have TLS certificates issued (indicating deployment readiness), are actively hosting web content that impersonates the organisation, or have appeared in threat intelligence as part of known attack campaigns. These domains represent immediate or imminent threats that warrant rapid response. Lookalike domains that are registered but not yet active should be monitored for changes in DNS configuration, certificate issuance, or content hosting that would elevate their priority.
Lower-priority alerts include domains registered by identifiable third parties with legitimate use cases, domains using common descriptive words that coincidentally resemble the target domain without strong impersonation intent, and domains in geographic markets where the organisation has no presence and limited brand recognition. These alerts should be recorded and periodically reviewed but do not typically require immediate escalation.
The triage decision for each detected domain should be documented with the evidence used to reach the assessment, so that the decision can be revisited if new information emerges and so that the triage team builds consistent institutional knowledge about the domain monitoring programme. Domains initially assessed as low-priority that later become active phishing infrastructure are valuable calibration data for refining the prioritisation criteria, turning each response cycle into a programme improvement opportunity. Defendis provides enriched lookalike domain alerts that include registrant information, certificate data, hosting intelligence, and threat actor association data that supports faster and more accurate triage than raw domain monitoring alerts alone. The context provided by each alert directly informs the response priority without requiring additional research from the security team.
Merger and acquisition events create a specific lookalike domain risk that organisations should account for in their monitoring programmes. When an acquisition is announced, attackers monitoring business news and corporate filings will often rapidly register lookalike domains targeting the acquiring and acquired entities, in anticipation of the increased email traffic, payment processing, and data sharing that accompany integration activities. Employees who are less familiar with the full scope of entities involved in a transaction are more vulnerable to spoofing attempts that exploit the transaction context.
Pre-announcement intelligence about pending transactions (such as leaked information about a deal being negotiated) can appear on dark web forums and may prompt domain registration activity that itself serves as a signal about information leakage. When a set of lookalike domains targeting two organisations simultaneously appear in certificate transparency logs, particularly if those organisations have no obvious existing business relationship that would explain the coincidence, this may indicate that an attacker has access to non-public information about a pending transaction or partnership.
Organisations preparing for M&A transactions should include a domain monitoring briefing as part of their integration security planning, setting up monitoring for lookalike domains targeting the combined entity before the announcement is made. The period between announcement and completion is a peak risk window: employees are processing changes, email domains are in flux, and the confusion of integration creates the social engineering opportunities that attackers actively seek. Proactive CT log monitoring during this period, with accelerated response times for detected lookalike domains, is an appropriate upward calibration of the standard monitoring programme to match the elevated risk. Defendis can be configured to monitor for lookalike domains targeting specific brand terms relevant to an M&A event, with alerts delivered within minutes of detection.
A motivated attacker can register a domain, obtain a Let's Encrypt certificate (which takes seconds via ACME automation), deploy a phishing page using a pre-built kit, and have a fully operational phishing site ready within 30-60 minutes of deciding on the target. This speed means that the window between domain registration and first victim exposure can be extremely short, particularly for campaigns that are launched immediately after the domain is set up. Effective lookalike domain detection must operate at speeds that match this deployment tempo, which requires automated monitoring of CT logs with near-real-time alerting rather than daily digest reviews.
Combosquatting adds words to a legitimate brand's domain name (secure-bankname.com, bankname-login.com, bankname-support.com) rather than altering the brand name itself as typosquatting does. Research has found that combosquatting is significantly more prevalent than typosquatting because the resulting domains can be harder for users to immediately identify as fraudulent (the brand name appears intact), because there are many more possible combosquatting domains for any given brand than typosquatting variants, and because legitimate organisations themselves use hyphenated or compound domain patterns that train users to accept them as potentially legitimate.
Domain takedowns before active malicious use are more difficult than takedowns of confirmed malicious sites. Most registrars and hosting providers require evidence of policy violation or illegal activity to act on abuse reports, and a newly registered domain that has not yet hosted malicious content may not meet that threshold, even if its similarity to a legitimate brand is obvious. Some registrars with brand protection programmes will act proactively based on trademark claims. Organisations can also file UDRP (Uniform Domain-Name Dispute-Resolution Policy) proceedings through ICANN for clear cases of cybersquatting, but this process takes weeks and is more appropriate for high-value brand protection than emergency threat response.
Defensive domain registration, buying common lookalike variations of your primary domain to keep them from being used by attackers, is cost-effective for the highest-value brand terms but cannot scale to complete protection. A single primary domain may have hundreds of plausible typosquatting and combosquatting variations, and registering all of them would cost hundreds to thousands of pounds annually for domain fees alone, before accounting for the certificate and maintenance overhead. The standard recommendation is to defensively register the highest-priority variations (adjacent-key typosquats of the primary domain, common hyphenated variants) and rely on active CT log monitoring and rapid response capability for the long tail of possible lookalike domains.
The lookalike domains that threat actors register before phishing campaigns are not created in a vacuum: they reflect decisions about targeting, operational tools, and campaign infrastructure that provide intelligence about the threat actor's capabilities and intentions. Analysing newly detected lookalike domains for patterns that connect them to previously observed threat actor operations is an intelligence enrichment activity that adds value beyond the immediate takedown response.
Domain registration metadata, where available before privacy protection is applied, can reveal the registrar preferences and payment methods of specific threat actors. Infrastructure patterns, the hosting providers used, the SSL certificate parameters chosen, and the DNS configuration applied to new lookalike domains, often match patterns from previous campaigns attributed to known threat actors. These correlations allow analysts to connect a new lookalike domain to a known threat actor before any phishing activity is observed, providing earlier attribution than waiting for a full campaign to be launched and analysed.
The intelligence derived from lookalike domain analysis feeds back into the broader threat intelligence programme: if a specific threat actor is registering lookalike domains targeting your organisation alongside other organisations in your sector, this is intelligence about sector-wide campaign preparation that may be relevant to your industry peers. Information sharing communities, particularly sector-specific ISACs, provide appropriate channels for sharing this intelligence in ways that benefit the broader community without disclosing your own organisation's specific monitoring capabilities. This community intelligence sharing makes the entire sector more resilient against the threat actor responsible for the lookalike domain campaign. Defendis delivers lookalike domain alerts with threat actor context that enables this broader intelligence analysis, connecting individual detections to the threat actor picture your team needs.
Measuring the effectiveness of a lookalike domain detection programme requires metrics that capture both the detection coverage and the response effectiveness. Key metrics include mean time to detection (MTTD) from domain registration to alert, mean time to takedown (MTTT) from alert to confirmed domain suspension or redirect, the false positive rate (what percentage of alerted domains turn out to be legitimate), and coverage completeness (what percentage of lookalike domains targeting the organisation are being detected versus missed).
Measuring coverage completeness is methodologically challenging because missed detections are by definition unknown to the monitoring programme. An approximation can be obtained by benchmarking against third-party threat intelligence that reports lookalike domain activity, or by conducting periodic purple team exercises that register controlled test lookalike domains and assess whether the monitoring programme detects them within expected timeframes. These coverage tests reveal blind spots in monitoring rules, delays in CT log processing, or gaps in geographic coverage that routine metric tracking would not surface.
The combination of these metrics over time produces a programme maturity assessment that can identify improvement priorities: if MTTD is acceptable but MTTT is high, the bottleneck is in response process rather than detection capability. If the false positive rate is high, monitoring rules need refinement. If coverage completeness tests reveal systematic gaps, monitoring sources need to be expanded. Defendis tracks these metrics for your domain monitoring programme and provides the trend data needed for continuous improvement.
Session token theft and lookalike domain registrations both leave detectable signals before they produce incidents. Defendis monitors infostealer log markets for corporate session cookies and credentials, tracks certificate transparency logs for newly registered domains resembling your organisation's brand, and alerts your team when these signals appear. Early warning on both vectors gives your security team the time to revoke compromised sessions, block lookalike domains, and warn users before an attack succeeds.
Request a demo to see how Defendis monitors session exposure and lookalike domain registrations for your organisation.
