How to detect typosquat and lookalike domains targeting you

Typosquatting is the practice of registering domains that look like yours — close enough that a customer who misreads an email link, misremembers a URL, or is sent a convincing phishing message might not notice the difference. It is the standard setup for brand-impersonation phishing, and it happens before the attack is launched.

What typosquat permutations look like

There are several well-established classes of lookalike domain, and a realistic attacker will check all of them when choosing infrastructure:

Adjacent-key typos

Characters substituted for ones physically adjacent on a QWERTY keyboard. yourapp.com → yoirapp.com (u→i), yourapp.com → yourspp.com (a→s). These are the most common targets because they look plausible in a URL bar and are easy to register cheaply.

Character omissions and doublings

A single letter dropped (yourpp.com) or doubled (yourrapp.com). At small font sizes or on mobile, these are nearly invisible to a casual reader.

Homoglyphs

Characters that look visually identical (or nearly so) to ASCII characters but have different Unicode codepoints. Classic examples:

• rn vs m — yourann.com vs youram.com
• 0 (zero) vs o (letter o)
• l (lowercase L) vs 1 (digit one) vs I (uppercase i)
• Cyrillic or Greek lookalikes: a Cyrillic а (U+0430) is visually identical to a Latin a (U+0061) in most fonts

Internationalized Domain Names (IDN) allow Unicode in domain labels. Browsers display these as Punycode (xn--) in the address bar for some scripts, but phishing emails often show the raw Unicode form, which many recipients will not scrutinize.

TLD swaps

Registering your brand under a different top-level domain: yourapp.net, yourapp.co, yourapp.io, yourapp.app, yourapp.dev. If you operate on .com, attackers will check whether .net, .org, and several new gTLDs are available and cheap to register.

Brand + keyword combinations

Adding plausible words around your brand name: yourapp-support.com, yourapp-login.com, secure-yourapp.com. The FedEx phishing pattern — impersonating a delivery notification from fedex-tracking.net or similar — is the most recognizable example. The formula is: trusted brand + transactional word = convincing phishing pretext.

How RDAP tells you if a domain is registered

RDAP (Registration Data Access Protocol, RFC 7480) is the successor to WHOIS. It is a JSON HTTP API operated by domain registries and registrars. For any given domain name, you can query RDAP to determine whether the domain is registered, and if so, basic registration data (registrar, creation date, expiry, and name servers, where the registry discloses them).

RDAP queries go through a bootstrap registry to find the authoritative RDAP server for each TLD. A simple check looks like:

curl -s "https://rdap.org/domain/yourapp-support.com"   | jq '{status: .status, registrar: .entities[0].vcardArray}'

If the domain is not registered, the RDAP server returns a 404. If it is registered, you get a 200 with registration details. No authentication is required; this is entirely public data.

Perimeter generates a bounded set of permutations for each monitored domain — adjacent-key typos, omissions, doublings, common homoglyphs, and TLD swaps across .com, .net, .org, .co, .io, .app, and others — then checks each candidate via RDAP. The candidate set is capped to stay within courteous RDAP usage limits. Candidates that are registered are flagged; newly-registered ones generate an immediate alert.

What to do when you find a registered lookalike

The right response depends on what you find. Work through this roughly in order:

1. Assess the threat level

A registered domain is not inherently malicious — the registrant could be someone who grabbed it speculatively years ago with no connection to your brand. Look for escalating signals:

• Does the domain have an MX record? (Ready to send phishing email from it)
• Does it have a cert in CT logs? (Ready to serve HTTPS content)
• Does it resolve to an IP hosting a web page that imitates your brand?

Perimeter also monitors your domain's CT logs, so if the lookalike domain obtains a cert, you may see it via CT monitoring — run a free one-shot crt.sh query on the suspect domain to check.

2. Warn your customers proactively

If you have reason to believe a lookalike is being used for phishing, notify your user base before reports come in. A brief, direct note — "we have become aware of yourapp-support.com, which is not affiliated with us; our only domain is yourapp.com" — reduces the blast radius significantly.

3. Report to the registrar

ICANN-accredited registrars are required to accept abuse reports. RDAP will tell you which registrar holds the domain. Most have an abuse contact email published at https://rdap.org/domain/yourapp-support.com in the entity with role "abuse". File a written report with the specific evidence (phishing URL, email header, screenshot). Registrar action is often slow, but it creates a paper trail.

4. Submit phishing URLs for browser safe-browsing blocklisting

Google Safe Browsing, Microsoft Defender SmartScreen, and Netcraft all accept phishing reports and will blocklist confirmed URLs in the browsers that use their feeds. This is often faster and more effective than waiting for registrar action.

5. Defensive registration for your most critical variants

For your highest-priority brand variants, consider registering them yourself. This is not feasible at scale (there are too many permutations), but for a domain like yourapp.net that you are certain would confuse users, a $15/year registration is cheap insurance. Redirect those domains to your canonical domain with a 301.

6. UDRP for clear trademark infringement

If you have a registered trademark, the Uniform Domain-Name Dispute-Resolution Policy (UDRP) allows trademark holders to challenge abusive domain registrations through arbitration without going to court. This is worth pursuing for clear-cut impersonation cases where the domain is actively being used to harm your brand.

Monitoring vs. reacting

The window between "lookalike domain registered" and "phishing emails sent" is sometimes hours and sometimes weeks. Continuous RDAP monitoring — checking your permutation set on a regular schedule and alerting on newly-registered candidates — lets you act in that window rather than after customers have already been targeted.

Perimeter's Solo and Agency plans both include lookalike monitoring. The free one-shot report runs a point-in-time RDAP check against the standard permutation set — a good starting point before subscribing to continuous monitoring.

Frequently asked

How many permutations does Perimeter check?

Perimeter generates and checks up to approximately 60 candidate lookalike domains per apex domain, covering adjacent-key typos, character omissions and doublings, common homoglyphs (rn/m, 0/o, l/1), and TLD swaps across the most common TLDs. The set is capped to stay within courteous RDAP usage limits and avoid hitting rate limits on shared RDAP infrastructure.

What is RDAP and how is it different from WHOIS?

RDAP (Registration Data Access Protocol) is the IETF standard replacement for WHOIS, specified in RFC 7480. Unlike WHOIS, which returns free-text responses, RDAP returns structured JSON and supports authentication for redacted data. Both query the same underlying registration data. Perimeter uses RDAP because it is more reliable to parse programmatically and supports the ICANN bootstrap registry for routing queries to the correct authoritative server per TLD.

Will Perimeter alert me if a lookalike domain that was already registered before I signed up becomes more threatening?

Perimeter alerts on newly registered domains — ones that appear in RDAP as registered that were not registered on a previous scan. If a domain was already registered before your first scan, it will be in your baseline and will not trigger a new-registration alert. However, if that same domain subsequently obtains a TLS certificate, Perimeter's CT monitoring may surface it separately.

Can I do anything about a lookalike domain that is registered but not yet actively phishing?

Your options before active harm are limited: you can register it defensively yourself if it is still available (it is not, since it is registered), monitor it for escalating signals (cert issuance, MX records, web content), and document its existence for a future UDRP or registrar abuse report. Most registrars will not take action on a registered domain with no demonstrated abuse.

Does Perimeter connect to lookalike domains or fetch their web content?

No. Perimeter checks RDAP to determine whether a candidate domain is registered. It does not connect to, fetch content from, or port-scan any domain — including discovered lookalikes. It also checks crt.sh to see if a cert has been issued to the lookalike domain, but that is a read from the public CT log, not a connection to the domain itself.