What Lookalike Domains Actually Do: A Look at 44,000 of Them

Most advice about typosquatting talks in generalities. We can do better. VigilDNS continuously monitors the lookalike-domain space for the brands it protects, so we pulled the aggregate numbers from our own corpus: 44,934 lookalike permutations generated across 237 brands, and what the registered ones are actually configured to do. The single most important finding: a large share of registered lookalikes are set up to handle email. Our June figure for that share was too high, and the correction below replaces it: on the September 2026 corpus, more than a third of registered lookalikes have a working mail server.

How to read this data

These figures are aggregate and anonymized. They come from the permutation sets VigilDNS generates and monitors for real brands, so the population skews toward names worth impersonating rather than a random sample of the internet. We are not naming any brand or domain. The point is the shape of the threat, not any individual case. Unless marked otherwise, numbers are a snapshot taken on 2026-06-12 and will drift as the corpus grows.

The funnel: from permutation to live threat

For every brand, an engine generates the plausible lookalikes, and only some of them turn out to be registered, fewer still are live, and fewer again are dangerous. Here is how 44,934 generated permutations narrowed down.

Finding 1: more than a third of registered lookalikes have a working mail server

This finding is corrected. In June we reported that 12,263 of 24,539 registered lookalikes (50%) had mail servers configured, but that count included domains publishing a null MX, which accept no email. On the 2026-09-29 corpus, with null MX and MX targets that cannot take mail (localhost, ~, 0.0.0.0) excluded, 14,482 of 39,889 registered lookalikes (36%) have a working mail server. It is still the finding that matters more than the website numbers, because a mail-capable lookalike does not need a web page to do damage. It can send invoices, payment-change requests, and password-reset lures that appear to come from your brand. This is the infrastructure behind business email compromise, and it is why SPF, DKIM, and DMARC on your own domain are necessary but not sufficient: those protect your exact domain, while a lookalike authenticates perfectly as itself. The only way to catch this class is to watch for the lookalike domain. We explain the distinction in is someone spoofing my email domain.

Finding 2: a third are live, and a third are high-risk

About 33% of registered lookalikes returned a live web response, and about 30% scored 70 or above on our 0-100 risk scale. The two groups overlap but are not identical: a domain can be high-risk because it is mail-capable, newly registered, or hosted on suspicious infrastructure even without a live page. The takeaway is that a meaningful minority of registered lookalikes are not harmless parking, and the parked majority can be activated at any time, which is why we track them for change rather than dismissing them. See domain parking.

Finding 3: the techniques attackers actually use

Counting only registered lookalikes, the permutation techniques break down like this. Note how far down the list classic homoglyphs and character swaps sit: additions, TLD swaps, and character replacements dominate, which is consistent with attackers favoring plausible-looking names over obvious misspellings.

This is the data behind a point we make often: detection built only on simple typos misses most of the space. The biggest buckets are additions and TLD swaps, the building blocks of combosquatting, where the brand is spelled correctly and a word or a new ending is bolted on. See what is typosquatting and bitsquatting for the techniques themselves.

Finding 4: where the infrastructure lives

By hosting country of the resolving IP, registered lookalikes concentrated in the United States (13,492), then Germany, Australia, Canada, the Netherlands, France, the United Kingdom, and the British Virgin Islands. The long tail of offshore hosting is a reminder that takedowns can be slow or impossible in some jurisdictions, which is the case for catching the domain early rather than relying on removal. See how domain takedowns work.

What this means for you

If you take one thing from this: more than a third of registered lookalikes of a brand have a working mail server, and that is true whether or not they ever serve a web page. Watching only for fake websites misses a large share of the threat. Continuous monitoring that flags lookalikes with a working mail server, captures live pages, and scores risk is what turns 44,000 raw permutations into the short list that actually needs your attention. That is what VigilDNS does, from $79 a month on the pricing page.

Frequently asked questions

Where do these numbers come from?

They are aggregate, anonymized figures from the lookalike permutations VigilDNS generates and monitors for real brands. No individual brand or domain is identified. The population skews toward brands worth impersonating, so it is not a random internet sample.

Why do so many lookalikes have a working mail server?

Many are registrar or parking-service defaults rather than a deliberate setup. The rest reflect that email is the cheapest, highest-return use of a lookalike domain: it needs no website, evades exact-domain email protections like DMARC, and powers invoice and payment fraud. A working mail server on a lookalike is worth watching even when it is a registrar default, because it can receive replies to mail sent under its name.

Does a parked lookalike with no website matter?

Yes. A parked domain can be activated in minutes, and many are mail-capable while still showing no web page. That is why monitoring tracks parked lookalikes for change instead of dismissing them.

See how many lookalikes of your own domain are already registered, and which have a working mail server, with our free typosquat checker.