Lookalike domains: how to spot phishing emails that copy someone you trust

Most phishing emails are easy to dismiss. The dangerous ones look exactly like a message from someone you already deal with: your bank, your landlord, a colleague, a supplier. The trick is usually in the sender's domain, which is almost, but not quite, the real one.

What a lookalike domain is

A lookalike domain differs from a real one by a character or two, chosen so your eye skips over the difference:

• Swapped letters: paypa1.com instead of paypal.com
• Doubled or dropped letters: amazonn.com, gogle.com
• Digits for letters: micros0ft.com, neirmai1.com
• Extra words: microsoft-support.com, paypal-billing.net
• Different endings: yourbank.co instead of yourbank.com

There is a harder variant that uses characters from other alphabets which look identical to Latin ones, such as a Cyrillic "а" in place of a Latin "a". In some fonts those are impossible to tell apart.

Warning signs beyond the domain

The domain is the strongest signal, but phishing messages tend to share other habits:

• Urgency. "Your account will be closed today." "Payment overdue."
• A changed detail. New bank details for an invoice, a new contact person, a new link to "log in again".
• A display name that does not match the address. The name says your bank, the address says something else.
• A first message from an address you have never seen, claiming to be someone you know well.

What to do with a suspicious message

1. Do not click links or open attachments in the message.
2. Read the full sender address, not just the display name.
3. Contact the person or company another way, using an address or phone number you already have, not one from the email.
4. Never confirm payment changes by replying to the email that requested them.

How Neir helps

Neir webmail has two warnings for exactly this, both on by default.

Lookalike domain warnings. When a message arrives from a domain that is one or two characters away from the domain of one of your contacts, webmail shows a banner naming the contact domain it resembles. For example, mail from examp1e-corp.com when you have a contact at example-corp.com. The check is based on the contacts you have saved, so keeping your contacts list up to date makes it more useful.

First-time sender warnings. Webmail flags a message from an address that has never written to you before. That is often harmless, but when the message claims to be from someone you know, it is a useful moment to stop and check.

These checks catch the common tricks, not all of them. The Cyrillic-character variant in particular is not detected, so the habits above still matter.

If you already clicked

• Change the password for the service the phishing message imitated, from its real website.
• Turn on two-factor authentication where you can. Neir supports authenticator apps.
• If you entered payment details, contact your bank straight away.

Photo: Wikimedia Commons, public domain.