Lookalike domains: should you buy them?

Buy a lookalike domain when it is the name your customers are most likely to mistype or mistake for yours and nobody owns it yet; for every other lookalike, watching is enough. You can't stop every lookalike, but knowing about one lets you warn customers and report it.

What is a lookalike domain, and why does it matter?

Lookalike risk comes in two forms, addresses that look like yours and parts of your own domain that point somewhere you no longer control.

People trust your domain name. That trust is useful to attackers in two ways.

Someone registers a name one letter away from yours, or the same name with a different ending, and uses it for fake invoices or sign-in pages. Your customers don't read addresses closely, so it works. Consider buying only for this first problem, and only for the few names that matter most.

Your domain can have many subdomains, like shop. or help., each pointing to a service you use. When you stop using the service but leave the pointer, the address still points there. If someone else can then claim that spot on the service, they control a real address on your domain. That's called a subdomain takeover, and it's convincing because the address really is yours.

Fix this second problem in your own DNS records, as the steps below show.

Should you buy it or watch it?

Run each lookalike or subdomain a scan turns up through this table.

Act on a lookalike that receives email first.

How do I check?

A scan checks the most likely lookalikes of your domain and tells you which ones exist and whether they receive email. A scan lists subdomains that point to other companies and says which ones look unclaimed or about to expire.

Every check reads what your site already shows the public, plus public records about your domain, and nothing else. Reading DNS records, certificate logs and domain registration never touches your site. A Pulse sends at most 10 requests to your site and a Deep scan at most 200.

After a scan, open your things to fix and look for anything about subdomains or lookalikes. For detail on each finding, read the lookalike domains check and the subdomain takeover check.

To see by hand where Atlas's shop subdomain points, run this from a terminal.

dig +short CNAME shop.atlas.example

Check your site

How do I fix it?

1. Run a scan and write down each lookalike that exists, whether it receives email, and each subdomain flagged as unclaimed or about to expire.
2. Put each one through the table above and mark it buy, watch or act.
3. For each name you decide to buy, register it in the same registrar account as your main domain and renew it on the same schedule.
4. For each lookalike someone else owns that receives email, tell your customers which address your invoices and sign-in pages really come from, and report the lookalike.
5. Look through your DNS records and delete any that point to services you no longer use.
6. If a lookalike receives email, also lock down email sent as your own domain with DMARC and SPF.
7. Check again after you change DNS and compare the two reports.

Ask your coding assistant to find which subdomains your app still uses, then make the DNS changes yourself.

Search this project, including config files, environment examples, deployment settings and docs, for every hostname under our own domain (for example shop., help. or status.). For each one, list the hostname, the outside service it points to, and the files where it is used. Mark any hostname the code no longer uses. Do not change DNS, do not delete anything and do not contact any service. Give me the result as a table so I can decide which DNS records to delete.

Add a short public page called "How to recognise email from us". List the exact domain we send invoices, receipts and sign-in emails from, and say that we never send them from any other address. Add a link to this page in the site footer and in the footer of our transactional emails. Do not change any sign-in, payment or email sending logic.

What can't a scan tell you?

A scan checks the most likely lookalikes of your domain, so treat its list as a starting point. Don't read a short list as proof that nobody is copying your name, and don't read a lookalike that exists as proof that anyone is using it against you.

Anything a scan couldn't check is marked as not checked, never as passed.

Lockpick never changes anything on your site, your DNS or your accounts.

A Lockpick report is not a certificate and not a full penetration test. It covers what that scan could see on that day.