# Look-alike domains

Source: https://otinstaller.com/guides/osintverse-community/domain-investigation/05-lookalikes (page 6 of 7 of osintverse-community/domain-investigation)

Phishing and fraud campaigns register domains one letter, one TLD or one homoglyph away from the real brand.

```
ot run osintverse-community/dnstwist --domain example.com
```

dnstwist generates thousands of variants (typos, swapped letters, homoglyphs such as `rn` for `m`, other TLDs, added
words) and reports the ones that are registered, with their A, NS and MX records.

## Triage

| Signal | Why it matters |
| --- | --- |
| Has MX records | It can send and receive email, the most common use for fraud |
| Resolves to the same hosting as other suspicious domains | Same operator |
| Registered recently | Recent registrations are rarely defensive |
| Has a certificate for the name (check with `osintverse-community/crtsh-subdomains`) | Someone set up HTTPS, so it is likely in use |

> [!NOTE]
> Many look-alikes are registered defensively by the brand itself, or parked by domain resellers. Check the name
> servers and the registrant before you call one malicious.

Next: [live hosts](https://otinstaller.com/guides/osintverse-community/domain-investigation/06-live-hosts.md).

Next: https://otinstaller.com/guides/osintverse-community/domain-investigation/06-live-hosts.md