How do you check for lookalike / typosquat domain threats?

Why is the threat serious?

A lookalike domain does no harm by itself; the real danger is what is done with it:

• Invoice fraud (BEC): an "our IBAN has changed" email to your customer from accounts@yourcompany-ltd.com. This is the scenario in which SMEs in Northern Cyprus and Türkiye lose the most money.
• Phishing your staff: a password reset email signed "IT department", sent from a similar domain.
• Fake site / fake app: a login page built with your brand's logo that collects customer information.
• Reputation: when a customer is defrauded, it is clear whom they will hold responsible.

This attack works even if your DMARC record is correct, because the attacker uses their own domain, not yours. That is why email security and lookalike checks complement each other; neither replaces the other.

Which variants are generated?

A good check tries the following derivations (examples based on arvenova.ai):

• Typos: arvenoa.ai, arvneova.ai, arvenovaa.ai
• Character swaps: arvenove.ai, arvenoba.ai
• Homoglyphs: arven0va.ai (zero), arvenova mixed with a Cyrillic "а"
• Additions and omissions: arvenova-ai.com, arvenovaai.com, arvenova-support.com, my-arvenova.com
• Extension changes: arvenova.com, arvenova.net, arvenova.co, arvenova.com.tr
• Hyphens and punctuation: arve-nova.ai, arvenova.a.i

Two questions are asked for every candidate: is it registered (does an A record resolve), and can it send email (is there an MX record)? A lookalike with an MX record is the one most likely to have been set up for phishing.

A real example: Fjordex output

The output below was taken for arvenova.ai on 24 October 2026 with the Fjordex connector's find_lookalike_domains tool, and has not been modified:

{
  "domain": "arvenova.ai",
  "check": "lookalike_domains",
  "summary": { "critical": 0, "high": 0, "medium": 1, "low": 0, "info": 0 },
  "findings": [
    {
      "id": "brand.lookalike_registered",
      "title": "Look-alike domain registered: arvenova.com",
      "severity": "medium",
      "evidence": "arvenova.com resolves to ['199.36.158.100'].",
      "recommendation": "Verify ownership; if not yours, consider a takedown/abuse report or defensive registration.",
      "category": "brand"
    }
  ],
  "observations": {
    "candidates_tested": 57,
    "registered_lookalikes": [
      { "domain": "arvenova.com", "a": ["199.36.158.100"], "has_mx": false }
    ]
  }
}

How to read it: 57 variants were tested and only one is registered. arvenova.com is our own defensive registration and redirects to arvenova.ai; has_mx: false shows that it cannot send email. The tool cannot know that, so it rates the finding "medium" and says "verify ownership". That is the right behaviour: a finding is not a decision; a human makes the decision.

If the same output showed a domain with has_mx: true that does not belong to you, that is a "high" situation, and the steps below apply.

What to do when a finding comes up

1. Verify ownership. The domain may belong to you, a former agency or a subsidiary. Check WHOIS and your own records.
2. Collect evidence. Screenshots, DNS records, the site's content if there is any, and samples of emails sent. Keep them with timestamps.
3. File an abuse report. Report the trademark infringement / phishing to the domain's registrar and to the hosting provider. Most registrars have an abuse form; your trademark registration certificate speeds up the process.
4. Warn customers and staff. A short, clear notice: "We only write from @arvenova.ai addresses; always confirm IBAN changes by phone."
5. Block it on your mail server. Add the lookalike domain to your inbound mail rules so it cannot reach your staff.
6. Register defensively. Buy the 5-10 most likely variants yourself (especially .com, .net, .co and your country extension) and redirect them to your main domain. The annual cost is low.
7. Repeat regularly. New lookalikes are registered every month; that is what monthly monitoring is for.

How lookalike checks relate to DMARC

DMARC prevents your domain from being spoofed: an attacker cannot write as info@arvenova.ai. A lookalike check makes attacks with similar domains visible: the attacker writes as info@arvenova.co. Full protection needs both. Fjordex's full_scan tool delivers both in the same report, and the ArveNova Tier 1 assessment includes both checks as well.