Spotting a twin domain before your customers do
Why a lookalike works at all
Nobody reads a domain character by character. Your eye catches the shape of a familiar name and fills in the rest, and that gap is where a lookalike lives. Swap one letter for a digit, or register the .co instead of the .com, and most people scanning an inbox at 9am will click without a second thought. The domain costs about a dollar and takes ten minutes to point somewhere. If a single person in your finance team pays one fake invoice, the attacker clears more than the whole scheme cost a thousand times over.
The tricks worth knowing
The cheapest one is a typo people already make on their own: a doubled letter, a dropped vowel, "amaozn" instead of the real thing. Homoglyphs go a step further, swapping a normal letter for a near-identical character from another alphabet, so the address looks right to your eye and reads as completely different to a computer. Hyphenation plays on trust, because "yourbrand-support.com" sounds official to anyone who is not already suspicious. And a plain TLD swap, your exact name on a different ending, catches everyone who trusts the word and never checks what comes after the dot.
None of these are clever. That is what makes them work. They are boring enough to slide past a busy person who has forty other things open.
Building a watch you will actually keep
Generating the variants is the easy half, and you can do it in seconds. The real work is deciding which ones matter and checking them on a rhythm you will stick to. A twin that sits registered on a blank parking page is worth a note. A twin that suddenly has a mail server attached, or starts serving a copy of your login screen, is worth dropping everything for.
So keep the routine light enough to survive a busy week. Generate the plausible lookalikes for your domain once. Flag the handful that are already registered and pointed at something live. Then re-check on a cadence, weekly if you are small, daily if you have been targeted before, and let any new registration or content change be the thing that pulls you off other work. When one turns hostile, you file the takedown with the registrar and warn the people most likely to get phished before the campaign has a chance to run.
Generate the lookalikes of your own domain in seconds with Twin Watch.