Lookalike (cousin) domain spoofing uses a domain visually similar to yours (examp1e.com, example-billing.com) to send mail that passes authentication for the attacker's domain while impersonating your brand.
What good looks like#
- Done: Register the most obvious typo and hyphen variants of your domain.
- Done: Monitor new registrations that contain your brand string.
- Done: Configure inbound gateway rules to flag display names matching executives from external domains.
- Done: Train finance and executive assistants specifically on this pattern.
What bad looks like#
- Seen in audits: Assuming DMARC p=reject protects against lookalikes.
- Seen in audits: Registering variants but leaving them without DMARC reject themselves.
How to move from bad to good#
Work through the good list in order and re-verify after each change. Most teams find one or two items from the bad list already present; fixing those usually produces the largest improvement.
Frequently asked questions#
How many lookalike domains should I register?
The top 10 to 20 variants by likelihood is a reasonable start; monitoring covers the long tail.