What this analysis does
Mailybox creates conservative typo and homoglyph-style candidates for a domain and checks public DNS signals such as MX and address records. It prioritizes variants that are actually capable of supporting email infrastructure.
Domain impersonation works because a recipient reads a sender address in under a second. The defensive question is which variants of your domain are both visually convincing and currently mail-enabled, since those are the ones that can be used immediately.
Generate variants the way an attacker would
Useful variants follow predictable patterns: character substitutions that survive a glance, insertions and omissions of a single letter, transpositions of adjacent characters, hyphenation changes, and the same second-level name registered under a different top-level domain. Each exploits how quickly people read rather than any technical weakness.
Homoglyph substitution deserves separate attention because it defeats careful readers. Characters from other scripts can render almost identically to Latin letters, producing a domain that looks correct in a mail client while resolving somewhere entirely different. These are registered as internationalized names and are easy to miss in a list.
- Single-character edits cover the majority of practical impersonation.
- Alternative top-level domains reuse the exact brand string.
- Homoglyphs can be visually indistinguishable at normal reading speed.
Mail-enabled variants are the urgent subset
A registered lookalike is a nuisance. A registered lookalike that publishes MX records is a capability, because someone has configured it to receive mail — commonly to run the reply side of a conversation-hijacking attempt. Sorting candidates by whether they appear mail-enabled focuses attention where it matters.
A domain registered but not yet mail-enabled still warrants monitoring. Registration frequently precedes use by weeks, and the interval between registration and the first MX record is the window in which a takedown or a filtering rule is cheapest to apply.
What to do with the results
Defensive registration is the strongest response but does not scale to every variant. Reserve it for the handful that are most convincing and most likely to be used against your highest-value processes, such as invoicing or executive correspondence.
For everything else, monitoring and detection are more proportionate. Feed the mail-enabled variants into gateway rules that flag external mail from near-miss domains, and give finance and payables teams a short list of the specific patterns most likely to appear in a fraud attempt.
Analyze a suspected hijacked threadAssess a suspicious message
Example: a variant configured to receive mail
Evidence supplied
Analyzing a brand domain produces a transposed-character variant that resolves and publishes MX records.
How to read the result
That variant is reported as mail-enabled and prioritized above registered-but-inactive candidates, because it can already receive replies in a conversation that appears to continue an existing thread.
Known limits
- Variant generation is heuristic and cannot enumerate every possible impersonation.
- A mail-enabled variant is not evidence of malicious intent; some are legitimate businesses or defensive registrations.
- Registration and DNS state change frequently, so results describe a point in time.
Common questions
Should I register every variant?
No. That does not scale. Register the most convincing variants against your highest-value processes and monitor the rest.
Does DMARC protect against lookalike domains?
No. DMARC protects your own domain from being spoofed. A lookalike is a different domain publishing its own policy, entirely outside your control.
How often should this be checked?
Quarterly for most organizations, and immediately after any public announcement, acquisition or campaign that raises the value of impersonating your brand.