Lookalike Domains and Executive Impersonation: How UK Organisations Detect and Respond

Some of the most damaging attacks on UK organisations involve no malware and no technical exploit at all. An attacker registers a domain that looks almost identical to yours, such as a swapped letter, an extra hyphen or a different top-level domain, sets up email on it, and writes to your finance team as your managing director, or to your customers as your accounts department, asking for a payment to a new bank account. The email passes every technical check, because it genuinely comes from the domain it claims to. The domain is just not yours.

This article explains how lookalike domain and impersonation attacks work, why common email controls do not stop them, and how organisations can detect and respond quickly.

How lookalike domain attacks work

Attackers use several techniques to create convincing domains:

• Typosquatting: small misspellings, such as a missing or doubled letter.
• Character substitution: swapping letters that look alike, such as "rn" for "m", or using internationalised characters from other alphabets (homoglyphs).
• Additions: appending words such as "-invoices", "-secure" or "-uk" to your brand name.
• Alternative top-level domains: registering your name under .com, .co, .net or newer extensions if you only own .co.uk.

The domain is then used for business email compromise and invoice fraud, credential phishing pages that mimic your login portal, fake recruitment campaigns, or fraudulent web shops. Increasingly, generative AI makes the accompanying messages fluent and well targeted, using details scraped from LinkedIn and your website, and voice cloning adds a convincing follow-up call.

Why DMARC is necessary but not sufficient

SPF, DKIM and DMARC are essential. The NCSC recommends that organisations implement them, and a DMARC policy of reject stops attackers sending email that claims to come from your exact domain. But DMARC protects only the domains you own. A lookalike domain has its own DNS, and the attacker can publish perfectly valid SPF, DKIM and DMARC records for it. Your recipients' mail systems will see a properly authenticated message from a domain that happens not to be yours.

Defence against lookalikes therefore needs two further layers: detecting the domains early, and making sure people and processes catch what technology misses.

Detecting lookalike domains early

Most lookalike domains are registered days or weeks before they are used. Early detection gives you time to block and take down. Useful signals include:

• Newly registered domains that are similar to your brand.
• Certificate Transparency logs: public logs of TLS certificates. Attackers who set up an HTTPS phishing site generate certificate entries that can be monitored.
• DNS changes: a lookalike domain acquiring MX records is a strong indicator it is about to be used for email.
• Reports from staff, customers and suppliers: often the first sign, so make reporting easy.

Responding to a lookalike domain

When you find a lookalike domain, act on several fronts at once:

• Block: add the domain to email and web filtering blocklists so staff cannot receive mail from it or visit it.
• Warn: alert finance, customer-facing teams and, where appropriate, customers and suppliers.
• Report: forward suspicious emails to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk, which can lead to malicious sites being taken down. If money has been lost, report to Action Fraud and your bank immediately.
• Request takedown: registrars and hosting providers operate abuse processes. Takedown requests are more effective with clear evidence of malicious use, such as phishing content or fraudulent emails, than for a domain that is merely similar.
• Consider defensive registration: registering the most obvious variants of your domain is inexpensive compared with the cost of fraud.

Protecting executives

Executives are impersonated because their authority makes requests hard to refuse. Reduce the information attackers can use: review what is published about executives' roles, assistants and travel. Monitor for executives' corporate credentials appearing in breach data and infostealer logs, since stolen credentials and session cookies allow attackers to send email from the real account, which is even harder to spot. Strong identity controls based on zero trust principles, including phishing-resistant MFA, reduce that risk.

Bringing it together

Lookalike domain defence works best as part of wider security operations. Detection signals should flow into the same place as your other security alerts, as described in our managed detection and response buyer's guide, and staff awareness should cover AI-generated impersonation as well as traditional phishing.

Preparing a response playbook

Impersonation incidents move fast, especially when a payment is involved, so it pays to decide in advance who does what. A simple playbook should name the person who confirms whether a domain or message is malicious, who updates email and web filters, who contacts the bank if money has been sent, who informs customers or suppliers, and who submits takedown requests. Keep template wording ready for customer warnings and for abuse reports, including the evidence registrars and hosts usually ask for: full email headers, screenshots of phishing pages and the dates you observed activity.

Time matters most when funds have been transferred. Banks may be able to recall or freeze payments if they are told quickly, so the first call should be to your bank's fraud team, followed by a report to Action Fraud. Preserve evidence, including the original emails with headers, rather than deleting them.

After each incident, review what happened. Was the domain registered long before it was used, and could earlier monitoring have caught it? Did a payment process have a gap? Did staff report quickly, or hesitate? Each answer strengthens the next response.

It is also worth checking your own domain portfolio. Expired domains that once belonged to your organisation can be re-registered by attackers and used to impersonate you convincingly, sometimes still appearing in old supplier records. Keep domains you no longer use registered, or at least ensure they are removed from every system that might still trust them.

How Pyralink helps

Email authentication, payment verification processes and incident response remain the practical controls, so impersonation attempts are caught by people and processes as well as technology. Pyralink no longer offers a lookalike-domain monitoring product. Contact us if you want to talk about the risk.

Frequently asked questions

What is a lookalike domain?

A lookalike domain is a domain registered to closely resemble a legitimate one, using misspellings, character substitutions, added words or different top-level domains, usually to support phishing or fraud.

Does DMARC stop lookalike domain phishing?

No. DMARC prevents attackers spoofing your exact domain, but a lookalike domain can have its own valid SPF, DKIM and DMARC records.

How do I report a phishing email in the UK?

Forward it to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk. If you have lost money, contact your bank and report to Action Fraud.

Can lookalike domains be taken down?

Often, when there is evidence of malicious use such as phishing content or fraudulent emails. Requests go to the registrar and hosting provider through their abuse processes.

How can we protect executives from impersonation?

Combine verification processes for payment and urgent requests, monitoring for lookalike domains and leaked credentials, phishing-resistant MFA, and awareness training that covers AI-generated messages and voice cloning.

Sources: NCSC: Phishing attacks, defending your organisation; NCSC: Email security and anti-spoofing; NCSC: Report a scam email; Certificate Transparency; Action Fraud.