What is a look-alike domain?
A look-alike domain is a web address registered to pass for a firm's own at a glance: one letter swapped, a letter added or dropped, a hyphen, a word or another ending.
Last read from the sources at the foot of this page.
What does look-alike domain mean?
The threat actor may send you a link to a fraudulent website that closely mimics an official site, using deliberate misspellings that look almost identical to a legitimate URL.
The name can be bought from any registrar in minutes. What makes it dangerous is rarely the website. It is the mail records: a look-alike that receives and sends email can carry an invoice, a change of bank details or a request to sign in.
DMARC does not help here. A look-alike is a different domain with records of its own, so a firm at p=reject on its real domain can still be imitated by a name one letter away.
For a firm we watch, the names made from its own are read every hour. Each day's public list of newly registered names is matched against its name overnight. A LeakTrace reading asks which names made from the firm's own are registered, whether each is set up for mail and whether its page copies the firm's site.
Where does it show up in a reading?
In a LeakTrace reading it is read under “Look-alike names”: web addresses an attacker could register to look like yours, each checked: is it registered, is it set up for mail.
A look-alike set up for mail, alone or with a copy of the firm's site, is listed as an open way in; a copy without mail is listed as partly closed.
Which pages use this term?
Where does this come from?
- Canadian Centre for Cyber Security, Don't take the bait: Recognize and avoid phishing attacks (ITSAP.00.101)cyber.gc.caRead 1 November 2026
See what is open before anyone else does.
We read your domain externally and show each way in with a check anyone can re-run.