People read shapes, not hostnames
People do not read domains. They recognise shapes. rnicrosoft.com (an r next to an n) looks like microsoft.com at a glance, especially on a phone. Attackers register lookalikes of real brands for phishing pages, fake invoices, and business-email compromise. ATT&CK files domain acquisition under T1583.001. Defenders flip that around and look for those domains first. This lesson is the defensive reading of that technique.
After this section you can name the usual ways a lookalike is built, without treating the list as a shopping list of other people's brands.
How lookalikes are made
- Omission:
exampe.com.au (a letter dropped) - Repetition or addition:
exammple.com.au, example1.com.au - Transposition:
exmaple.com.au - Replacement, keyboard-adjacent:
exanple.com.au - Homoglyph:
examp1e, rn for m, or a Unicode lookalike such as Cyrillic а (an IDN homograph, shown as xn-- punycode) - Bitsquatting: a single flipped bit in memory changes one character. Rare, but real.
- Hyphenation and subdomain tricks:
example-billing.com, example.com.au-secure.net - TLD swap:
example.com, example.net, example.au when you only hold .com.au
dnstwist is a free, open-source tool that generates these permutations and checks which ones actually exist in DNS.
The examples above are shapes, not targets. A famous brand is a bad place to practise.