Lookalike domains persist because the arithmetic is overwhelmingly in the attacker’s favour. Understanding the numbers tells you which defences change the calculation and which are theatre.
What it costs to run
Domain registration $1 - $12, often on a stolen card TLS certificate $0, automated, minutes Hosting $0 - $20/mo, or a free tier A cloned site $0, wget -m the real one Sending infrastructure $0 - $50, or a compromised host Total to be operational: under an hour, under $50
Every line is commoditised. Nothing on that list requires skill that is scarce, and none of it can be denied to someone willing to spend an afternoon.
What it has to return
- Credential harvesting pays per set of working credentials, resold or used directly. A handful makes the campaign profitable.
- Invoice redirection pays once, very large. One successful payment diversion returns more than a year of registrations.
- Malware delivery pays per installation.
- Monetised parking pays fractions of a cent per visitor and is the low-effort fallback when the domain is not used for anything else.
The asymmetry is the point. A defender must consider thousands of permutations; an attacker needs one that works once.
What actually changes the arithmetic
Registering defensively raises their cost by $10 per
permutation you hold. There are
thousands. This does not scale.
Fast detection + takedown cuts the campaign's earning
window. This is the lever.
Recipient-side controls reduces the yield per sent
message. Also a real lever.
DMARC enforcement removes direct spoofing entirely,
which pushes them to registration
— a cost, not a wall.Nothing here deters, and that is not the goal
A campaign that gets four days instead of forty returns a tenth as much, against the same setup cost. The objective is compressing the earning window, not raising a barrier to entry — barriers cost twelve dollars to step over.