Home › Blog › Lookalike domains
Security · 5 October 2026 · 11 min read
Every invoice fraud, every fake payment instruction from a director and most supplier impersonation runs through a domain that is almost yours. Registering one costs a few euros and takes ten minutes. This article is about the other side of that: how the variants are chosen, how to find the ones that already exist, which of them Microsoft 365 will label or quarantine on its own, and what to do when you find one in use.
Second in a series on how business email fraud works and what stops it. The first explained how a hijacked invoice thread ends in a diverted payment. Examples here use made-up company names.
A lookalike domain is not spoofing. Spoofing forges your domain on a message that did not come from it, and SPF, DKIM and DMARC exist to catch exactly that. A lookalike is a different domain, legitimately registered by the attacker, that a reader takes for yours. Its mail is correctly authenticated, because it really does come from the domain it names. That is why the usual email checks pass, and why the defences against it are different.
Two parties can be imitated: you, to your clients and suppliers, or your supplier, to you. The first damages your reputation and your clients’ bank balances. The second empties yours. Both start with the same ten-minute registration.
Take a fictional firm, Northgate Engineering, at northgate-eng.com. An attacker who has read its invoice threads has a shortlist of variants ready before they need one.
The usual variants, for northgate-eng.com
| Technique | Example | Why it works |
|---|---|---|
| Letter swap | northgate-emg.com, nothgate-eng.com | Adjacent keys and dropped letters; the eye reads the word it expects. |
| Lookalike pairs | northgate-enq.com, northgatc-eng.com, n0rthgate-eng.com | rn reads as m, vv as w, l as I, c as e, 0 as o, especially in the narrow grey address line of a mail client on a phone. |
| Different ending | northgate-eng.co, northgate-eng.net, northgate-eng.co.uk | Few people know which endings their supplier owns. A new ending with the exact same name is the most common variant we see in real incidents. |
| Hyphen and word order | northgateeng.com, northgate-engineering.com, eng-northgate.com | Looks like a company tidying up its own branding. |
| Added word | northgate-eng-accounts.com, northgate-eng-invoices.com | Reads as a department, which is exactly who would write about an invoice. |
| Subdomain trick | northgate-eng.com.billing-portal.net | The real name is at the front; the actual domain, which decides where mail goes, is at the end. |
| Accented and foreign characters | northgàte-eng.com, nоrthgate-eng.com (Cyrillic о) | Internationalised domain names allow characters from other alphabets that are drawn identically to Latin ones. Mail clients increasingly show these as xn-- code, which looks odd enough to be noticed, so this is now rarer than the plain-ASCII variants above. |
Combine two techniques and the list runs to hundreds. Tools that generate every variant of a domain are freely available and take a second to run, for defenders and attackers alike.
The display name does the rest. Outlook shows “Sarah Mitchell” in bold and the address in small grey type, on the desktop, and only the name on most phones until you tap it. The attacker uses the real person’s name, copies the real signature block, and replies into the real thread with all its history quoted below. Nothing on the screen says new sender unless the tenant has been configured to say it.
You cannot stop anyone registering a domain that resembles yours. You can know about it, usually within a day, which is early enough.
.com, .net, .co and your country’s ending, plus the un-hyphenated form, cost a few euros each per year. Then make them harmless: an SPF record of v=spf1 -all, a DMARC record with p=reject, and a null MX record. A parked domain with those three records cannot be used to send mail that passes anyone’s checks. Do the same for every domain you own but do not send from.Exchange Online Protection, which every plan includes, authenticates inbound mail and runs spoof intelligence. Neither touches a lookalike, because a lookalike is not spoofed. The controls that do are in Defender for Office 365 Plan 1, which is inside Business Premium and Microsoft 365 E5 and an add-on to everything else.
Lookalike controls in Defender for Office 365
| Control | What it catches | What you must do |
|---|---|---|
| Domain impersonation | Inbound mail from a domain that resembles one on the list: your own domains, with one tick, and up to the custom domains you add, which should be your key suppliers and clients. | Create or edit an anti-phishing policy. Tick Include the domains I own, add the partner domains, choose the action: quarantine for your own domains, quarantine or junk for partners while you tune it. |
| User impersonation | Inbound mail whose display name or address resembles a protected person: up to 350 per policy, internal or external. Your directors, your finance team, your suppliers’ accounts contacts. | List them. External contacts are the ones people forget, and they are the ones the invoice comes from. |
| Mailbox intelligence | Learns who each user actually corresponds with and flags a sender who resembles a frequent contact but is not them. Covers the suppliers you did not think to list. | On by default, but its action is “none” by default: it watches and does nothing. Set it to quarantine or junk. Note that it does not fire if the lookalike has already exchanged mail with the user, so it must be on before the first message. |
| Safety tips | A banner above a message that resembles a protected user or domain, and the unusual characters tip for addresses with mixed alphabets or digits for letters. | Enable them in the same policy. They are what the user sees when the filter is not sure enough to quarantine. |
| First contact safety tip | A banner the first time an address writes to a user, or when it rarely does. A new lookalike is always a first contact. | One setting in the anti-phishing policy. Available in Exchange Online Protection too, without Defender. |
| External tag | An External label on every message from outside the organisation, in Outlook, on the web and on phones. | Set-ExternalInOutlook -Enabled $true. The moment a colleague in a thread acquires the tag, the thread has moved. |
| Tenant Allow/Block List | Blocks a specific domain or address you have identified. | Add the lookalike the day you find it. This is the one control that needs no licence beyond Exchange Online. |
None of the impersonation settings is switched on in a new tenant. The Standard preset security policy turns on domain and user impersonation for your own domains and users, but it cannot know your suppliers; a custom policy with the partner domains and contacts added is the configuration that catches invoice fraud.
Defender for Office 365 Plan 2 adds what you need after a lookalike has got through: Threat Explorer to find every message from the domain across the tenant, automated investigation, and the ability to pull delivered mail back out of inboxes. If a lookalike has been active for a week before anyone noticed, that is the difference between knowing which forty people received it and guessing.
.com, .net and most generic endings, and the national equivalents (Nominet’s DRS for .uk, EURid’s ADR for .eu, CIRA’s CDRP for .ca, auDA for .au). Slower and not free, but it transfers the domain to you rather than merely suspending it.Lookalike protection by plan
| Plan | Available | Missing |
|---|---|---|
| Business Basic, Business Standard | External tag; first contact safety tip; Tenant Allow/Block List; spoof protection for your own domain; message trace. | Impersonation protection of any kind. A lookalike of your director or your supplier is delivered without a banner. |
| Business Premium | All of the above plus Defender for Office 365 Plan 1: domain and user impersonation, mailbox intelligence, safety tips, Safe Links and Safe Attachments. | Threat Explorer and automated removal of delivered mail. |
| Microsoft 365 E5, or Defender for Office 365 Plan 2 as an add-on | Everything, including the tools to find and remove every message from a lookalike after the fact. | — |
A lookalike domain beats email authentication because it is authentic. What beats a lookalike is being told it is one: a quarantine, a banner, an External tag, or a colleague who checked the address because the signature said to. All of that is configuration, most of it inside a licence you may already hold, and none of it is on by default.
Configuring the anti-phishing policy with your suppliers and contacts in it, running the variant search and the certificate watch each month, parking your unused domains so they cannot be abused, and dealing with a lookalike that is already in use, are part of our incident response and hardening service. Contact us for an initial incident assessment and response estimate.
Against spoofing of your own domain, yes. A lookalike is a different domain, which the attacker owns and authenticates correctly, so those records do not apply. The controls for lookalikes are impersonation protection, safety tips, the External tag and your own monitoring.
Yes, through Defender for Office 365 Plan 1, but it is not switched on in a new tenant. The Standard preset enables it for your own domains and users; adding your key suppliers' domains and finance contacts needs a custom anti-phishing policy.
No; there are too many. Buy the exact name on the main endings and the un-hyphenated form, park them with SPF -all, DMARC reject and a null MX, and monitor the rest. Monitoring finds a new registration within a day, which is before it is used.
Usually. A registrar abuse report with evidence of fraud gets most of them suspended within days; the hosting or mail provider will act on phishing too. A formal dispute (UDRP or the national equivalent) transfers the domain to you but takes weeks and costs a fee.
Registering it is not, in most countries. Using it to impersonate you is fraud, and a trademark or registered company name gives you a dispute claim. Keep the evidence of use; that is what the registrar and the dispute panel act on.