catch lookalike phishing domains before attackers use them

somebody out there might already own "n1mbus.shop"

here's the thing nobody tells you about phishing campaigns: they don't start with an email. they start weeks or months earlier, with someone quietly registering a domain that looks almost exactly like yours. one swapped letter, an extra hyphen, a different ending. then they sit on it. set up mail servers. wait for the right moment to send "urgent invoice attached" to your finance team from a domain that looks close enough that nobody double checks.

the good news is that domain registration is public-ish and predictable, which means you can beat them to it. there's a tool called dnstwist that does exactly this, and it takes about ten seconds to run against your own domain.

the command

dnstwist --registered nimbus.shop

swap "nimbus.shop" for whatever domain you're actually trying to protect. that's it, that's the whole command.

what dnstwist is actually doing

dnstwist takes your domain and generates a huge list of lookalikes using the tricks attackers actually use: character swaps (nimbus becomes n1mbus), added or removed hyphens (nimbus-shop.com), homoglyphs (letters that look identical in certain fonts), different tlds (nimbus.shop becomes nimbus.shop.com or nimbus.store), and common typos (numbus, nimbis, nimbus).

the --registered flag tells it to only show you the ones that actually exist. without that flag you'd get a firehose of every theoretical typo, most of which nobody has ever touched. with it, you get a short, useful list of domains that a real human being paid money to register.

reading the output without panicking

you'll get a table with columns like the domain name, whether it resolves to an ip address, and whether it has mx records (mail exchange records, meaning it's set up to send or receive email).

most of the rows you'll see are noise. domain squatters grab thousands of lookalikes just to resell them or park ads on them. those usually resolve to a parking page and have no mail setup at all. annoying, but not an active threat.

the rows that should get your attention are the ones that resolve AND have an mx record. that combination means someone didn't just register a name, they built infrastructure to send mail from it. that's not squatting, that's staging. that's a domain getting ready to send phishing emails that look like they came from you.

why this matters more than you'd think

email security tools, spam filters, and your employees are all trained to look for obviously wrong domains. a lookalike domain defeats all three at once. it passes spf and dmarc checks because it's a legitimate domain in its own right, it doesn't trip typo filters because it's close enough to look like a formatting quirk, and it doesn't trigger human suspicion because who's actually reading "nimbus.shop" versus "nimbus-shop.com" character by character in a rushed inbox.

this is also how a lot of business email compromise and invoice fraud starts. not some dramatic hack, just a domain that's 95% right and a well timed email.

making this a habit, not a one time scan

the real value here isn't running the scan once. it's running it on a schedule so you catch new registrations close to when they happen, ideally before anyone sends mail from them. you can drop this into a cron job or scheduled task, pipe the output to a file, and diff it against the last run so you only get alerted on new registered lookalikes instead of rereading the same list every week.

if you find a live one with mail configured, that's your cue to act. document it, report it to your registrar or hosting provider's abuse contact, and give your security team or msp a heads up so they can watch for inbound mail referencing that domain. you can also proactively register the most obvious variants of your own domain before someone else does, it's cheap insurance.

the takeaway

attackers count on the fact that most companies never look at what's being registered around their own brand name until it's already being used against them. dnstwist flips that timeline. it's free, it's fast, and it turns "we found out during the incident" into "we found out three weeks before anyone clicked anything." run it against your domain, run it on a schedule, and pay attention to anything that resolves and has mail set up. that's the difference between a defender who's watching and one who's guessing.