Short answer
A lookalike domain is registered to be mistaken for a real one: a typo (examp1e.com), an extra word (example-claim.com), another ending (example.app) or a Unicode letter that looks Latin. Scammers use them for phishing and drainer pages. You find them by generating variants of your domain and checking which are registered, and by watching new certificates and registrations.
Who this is for: Crypto teams who want to know which domains could be used against them.
Types of lookalike domains
| Type | Example | How it fools people |
|---|---|---|
| Typo (omission, repetition) | exmple.com, examplle.com | Catches mistyped addresses; hard to spot in a link |
| Swapped or replaced letter | exapmle.com, examp1e.com | 1 for l, 0 for o, rn for m |
| Other ending (TLD) | example.app, example.io | Looks like an official new site |
| Extra word | example-claim.com, app-example.com | Matches the action: claim, airdrop, support, app |
| Subdomain trick | example.com.claim-now.xyz | The real name sits at the start of a longer domain |
| Homoglyph (Unicode) | exаmple.com with a Cyrillic а | Looks identical; see homoglyph domains |
| Platform subdomain | example-claim.vercel.app | Free, instant HTTPS; see platform contacts |
Why scammers use them
A lookalike domain is cheap, gets an HTTPS certificate in minutes and survives a quick glance. Interisle Consulting found that 74% of phishing domains in its May 2025 to April 2026 data were registered by the criminals themselves, not hacked sites. WIPO handled over 6,200 domain name cases in 2025, its highest caseload on record, and notes that several of them halted phishing campaigns.
How to find them
- Generate variants. Tools such as the open-source dnstwist create thousands of typo, swap, homoglyph and TLD variants of a domain.
- Check which are registered. A DNS lookup shows which variants exist. Our free lookalike checker does both steps for one domain.
- Watch new certificates. New fakes appear in Certificate Transparency logs as soon as they get HTTPS, often before they are shared.
- Watch new registrations. Daily lists of newly registered domains catch names with your brand plus an extra word, which variant generators miss.
- Look at the page. Most registered variants are parked. The dangerous ones copy your logo or text, or ask for a wallet connection.
What to do with one
If it hosts a copy of your site or a wallet prompt, report it to the registrar and host and to wallet blocklists; see take down a phishing site. If it is parked, note it and check it again later: many fakes are registered weeks before use.
Sources
Frequently asked questions
Should I register all lookalikes of my domain myself?
Registering the closest few (common typos and your name on popular endings) is cheap insurance. There are thousands of variants, so you cannot buy them all; monitoring covers the rest.
Is a registered lookalike always malicious?
No. Many are parked or belong to unrelated owners. A lookalike becomes a threat when it hosts a copy of your site, a wallet prompt or a redirect.