How lookalike domains are generated — Domain Security Fundamentals

Reaching p=reject stops anyone sending as your exact domain. The obvious next move for an attacker is a domain that is not yours but reads as though it is — and it costs about ten dollars.

Why this is the default technique now

Registration is cheap, instant, and requires no verification in most TLDs.
The attacker authenticates their own domain properly. Their SPF, DKIM and DMARC all pass, because it is genuinely their domain.
Your controls are not consulted at any point. There is nothing on your side that fails.
Domains are disposable. A phishing domain is often registered, used within days, and abandoned before anyone has completed a takedown.

So the defence is not prevention — you cannot stop a registration — but detection and response. That shapes everything in this module and the next.

The permutation families

Technique	Example on "acmebank.com"	Relies on
Character omission	acmebnk.com	A typing error.
Character duplication	accmebank.com	A typing error.
Transposition	acemback.com	A typing error.
Adjacent-key substitution	acnebank.com	A typing error.
Visual substitution	acrnebank.com — `rn` reading as `m`	The reader, not a typing error.
Hyphenation	acme-bank.com	Plausibility — it looks like a legitimate variant.
TLD swap	acmebank.net, acmebank.co	The reader not checking the ending.
Subdomain shape	acmebank.com.secure-login.example	The reader stopping at the first familiar part.
Bitsquatting	acmebink.com	A memory bit-flip. Real, documented, and rare.

The line that matters is in the third column

The first four rely on the victim making a mistake, so they catch stray traffic and are relatively low yield. Everything below the line targets the reader’s eye in a message the attacker sent deliberately, and those are the ones used in business email compromise. Classifying by that distinction is more useful than classifying by the character operation.

The subdomain shape, spelled out

This one deserves its own treatment because it fools technical people who are in a hurry.

https://acmebank.com.secure-login.example/signin
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        the registrable domain here is secure-login.example
        "acmebank.com" is just a subdomain label the attacker created

The rule: read a name from the right. The registrable domain is the part just left of the public suffix, and everything to the left of that is chosen by whoever controls it. A familiar string early in a hostname means nothing at all.

Checking one

Given a suspicious domain, three lookups establish most of what you need:

dig +short A suspicious-domain.example      # is anything hosted
dig +short MX suspicious-domain.example     # can it send and receive mail
whois suspicious-domain.example | grep -i 'creation\|registrar'

Recent creation plus an MX record is the combination that should move a domain up your list. A lookalike with mail configured is a domain someone intends to send from, and the next lesson deals with how to weigh that alongside the other signals.

Look, do not touch

Passive lookups — DNS, WHOIS, certificate transparency — are observation. Fetching the site, submitting anything to it, or probing it is interaction, and it tells the operator they have been noticed. Establish what you can passively first.