How to Spot a Lookalike Domain Registered Days Ago

To spot a lookalike domain registered days ago, check three things before you trust the sender: when the domain was created (an RDAP lookup), whether it is set up to send and receive mail (its MX, SPF and DMARC records), and when its first certificate was issued (Certificate Transparency logs). A sender domain that is a few days old, one character off a name you know, and already configured for email is the clearest early sign of a phishing or invoice fraud campaign.

The reason age matters so much: a lookalike domain the attacker owns passes SPF, DKIM and DMARC for itself. Authentication proves who controls the domain. It says nothing about whether the domain deserves your trust. Age is the one signal the attacker cannot fake.

Why a lookalike domain registered days ago is an active threat signal

A brand new lookalike domain has no history, so it is not on any blocklist yet and has no bad reputation to trip a filter. That blank record is the point. CISA's counter-phishing guidance tells organizations to use website reputation scoring to block new, potentially malicious sites, precisely because new domains have not yet been reported.

Real campaigns follow this pattern. The CISA and FBI advisory on Scattered Spider (AA23-320A, updated July 2025) says the group's intrusions historically began with phishing and smishing using organization-specific crafted domains, in shapes like targetsname-sso.com, targetsname-servicedesk.com and targetsname-okta.com. Each one is registered for a single target, used quickly, and dropped. The same tactic shows up outside email too, in lookalike domains used in vishing and SMS phishing.

How attackers construct lookalike domain strings

Most lookalike domains fall into six patterns. Check a suspicious sender against each one, using your own domain and your top vendors' domains as the reference.

CISA also recommends blocking rarely used top-level domains with suspicious characteristics, which removes a large share of the different ending pattern before anyone has to look. For a worked example of a campaign that passed authentication checks, see real phishing campaigns that bypass DMARC.

How to check a lookalike domain's creation date with WHOIS and RDAP

Use RDAP, the structured replacement for WHOIS. ICANN states that as of 28 January 2025, generic top-level domain registries and registrars are no longer required to provide WHOIS services, and RDAP is now the standard lookup.

1. Copy the sender domain from the message headers, not the display name. Use the From address and the Return-Path.
2. Run an RDAP query. In a browser, open rdap.org/domain/ followed by the domain. From a terminal: curl -sL https://rdap.org/domain/acrne.com
3. Find the event with eventAction set to registration. Its eventDate is the creation date.
4. Note the registrar and the nameservers in the same response. You will use them in the clustering step below.
5. Treat anything under 30 days old that resembles a known name as suspicious, and anything under 7 days old as urgent.

RDAP never touches the suspicious website, so it is safe to run from any workstation.

How to read DNS records without visiting a suspicious lookalike domain

DNS tells you whether the domain is built to send email, and you can read it without loading a single page from it.

1. dig +short MX acrne.com shows mail servers. A days-old lookalike domain with MX records is set up to receive replies, which is what invoice and payment fraud needs.
2. dig +short TXT acrne.com shows the SPF record. A fresh SPF record means the attacker has authorized servers to send as this domain.
3. dig +short TXT _dmarc.acrne.com shows the DMARC policy. A strict policy on a three day old domain is not reassuring. It means the attacker configured authentication so their mail passes.
4. dig +short NS acrne.com shows nameservers. Compare them with the registrar data from RDAP.

If you want the full background on reading these records, our guide to reading DMARC and DNS records safely walks through each one.

How to query Certificate Transparency logs for a lookalike domain

Every publicly trusted TLS certificate is recorded in public Certificate Transparency logs, so the logs show when a domain got its first certificate. Search crt.sh for the domain, or from a terminal run curl -s 'https://crt.sh/?q=acrne.com&output=json'.

• A first certificate issued within hours or days of registration means a login page or landing page is likely live or about to be.
• Certificates for subdomains such as login., sso. or portal. on a lookalike domain point to credential phishing.
• Search for your own brand name with a wildcard to find lookalike domains you have not seen yet.

Lookalike domain signals and what each one means

No single signal proves intent. The combination does.

When to escalate versus monitor a suspected lookalike domain

Escalate immediately when a lookalike domain is under 30 days old and it has already sent mail to your users, especially anything about payments, bank details, credentials or MFA. Monitor when the domain is registered but has no MX records, no certificate, and no mail in your logs.

• Escalate: pull every message from that domain out of user mailboxes, block the domain at the mail and web layers, and warn finance and the executive team by name. Follow your playbook for how to prevent business email compromise.
• Preserve evidence first: save the RDAP output, DNS results, certificate records and full message headers before the attacker takes the domain down.
• Report it: send the evidence to the registrar's abuse contact listed in the RDAP response.
• Monitor: add the domain and its nameservers to a watchlist and re-check MX and certificates weekly. CISA offers a Domain Doppelgänger service that looks for evil twin domains similar to one you submit.

For your own domain, CISA recommends setting DMARC to reject. That stops exact spoofing of your name. It does nothing against a lookalike domain, which is why the checks above matter.

Detect lookalike domains faster with AegisAI

Running RDAP, DNS and certificate checks by hand works for one suspicious email. It does not scale to every message from every vendor. AegisAI connects to Microsoft 365 and Google Workspace by API and reads each inbound message after delivery, before users see or click it, weighing who the sender really is against who they appear to be. See how it works on our business email compromise protection page, or book a demo.

Frequently asked questions

How do you spot a lookalike domain registered days ago?

Look up its creation date with RDAP, check its MX, SPF and DMARC records with dig, and search Certificate Transparency logs for its first certificate. A domain that resembles a known name, is days old, and is already set up for email should be treated as hostile until proven otherwise.

What is a lookalike domain, and how is it different from typosquatting?

A lookalike domain is any domain built to resemble a real one closely enough to deceive. Typosquatting is one kind, based on typing mistakes. Lookalike domains also include swapped characters, homographs, added words like sso or billing, and different top-level domains.

Does DMARC protect against a lookalike domain attack?

No. DMARC protects domains you own. The attacker owns the lookalike domain and sets its SPF, DKIM and DMARC records, so their messages pass authentication.

How can I check a domain creation date without visiting the site?

Run an RDAP query at rdap.org/domain/ followed by the domain, or with curl from a terminal. The registration event shows the creation date. The lookup goes to the registry, not to the suspicious website.

What DNS records show that a new domain is ready to send phishing email?

MX records mean it can receive replies. An SPF record in TXT means servers are authorized to send as it. A DMARC record means the attacker has set up authentication so their mail passes checks.

When should a suspicious lookalike domain be escalated instead of monitored?

Escalate when it is new and has already sent mail to your users. Monitor when it is registered but has no mail records, no certificate, and no messages in your logs.