Lookalike Domains
Business email compromise doesn’t spoof your domain — it registers one that reads like it. We generate the plausible variants and check which already exist.
Registered
49
With a mail server
26
Variants checked
114
Time taken
9.3s
Needs attention
- 26 lookalikes can send and receive mailThese have MX records: g0v.uk, ggov.uk, ggv.uk, giv.uk, gkv.uk, gmv.uk, go6.uk, gob.uk, goc.uk, goov.uk, gov-email.uk, gov-info.uk, gov.com, gov.de, gov.email, gov.me, gov.net, gov.online, gov.org, gov.ru, govv.uk, gow.uk, gpv.uk, gv.uk, gvo.uk, yov.uk. A registered lookalike with a mail server is set up to be used, whether or not it has been yet. Nothing you publish on your own domain will stop mail from these — they authenticate as themselves.
Worth watching
- 23 other lookalikes registeredNo mail server on these yet. Some will be defensive registrations by you or a competitor, some parking, some waiting. They are worth watching: adding an MX record takes a minute.
Worth knowing
- What to do with thisRegister the handful closest to your real name yourself — it is cheaper than the incident. For the rest, monitoring beats blocking: a lookalike that appears with an MX record is an early warning worth acting on.
Registered lookalikes
Sorted by risk. A domain with MX records can both send and receive mail as that name — and its own SPF, DKIM and DMARC will pass, because the mail really is from it.
| Domain | Risk | Technique | Mail servers | Addresses |
|---|---|---|---|---|
| g0v.uk | has mail | lookalike character | 10 mx01.ionos.co.uk, 10 mx00.ionos.co.uk | none |
| ggov.uk | has mail | repetition | 0 localhost | 64.190.63.222 |
| ggv.uk | has mail | bitsquat | 10 park-mx.above.com | 103.224.182.244 |
| giv.uk | has mail | adjacent key | 0 localhost | 64.190.63.222 |
| gkv.uk | has mail | adjacent key | 10 park-mx.above.com | 103.224.182.244 |
| gmv.uk | has mail | bitsquat | 10 mail2.quickdns.co.uk | 172.67.162.94, 104.21.74.190 |
| go6.uk | has mail | bitsquat | 20 mx2.cloudhosting.uk, 10 mx1.cloudhosting.uk | 185.199.220.69 |
| gob.uk | has mail | adjacent key | 10 mailserver.livemail.co.uk | 213.171.195.105 |
| goc.uk | has mail | adjacent key | 20 mx2.krystal.io, 10 mx1.krystal.io | 82.221.141.79 |
| goov.uk | has mail | repetition | 1 mail.mailerhost.net | 172.104.149.86, 172.104.251.198 |
| gov-email.uk | has mail | added word | 0 govemail-uk0i.mail.protection.outlook.com | 185.245.124.16 |
| gov-info.uk | has mail | added word | 0 smtp.secureserver.net, 10 mailstore1.secureserver.net | 97.74.203.210 |
| gov.com | has mail | other TLD | 10 mail.gov.com | 34.233.180.60 |
| gov.de | has mail | other TLD | 10 mail.gov.de | 149.232.252.78 |
| gov.email | has mail | other TLD | 0 gov-email.mail.protection.outlook.com | 124.244.28.141 |
| gov.me | has mail | other TLD | 30 alt2.us.email.fireeyecloud.com, 10 primary.us.email.fireeyecloud.com, 20 alt1.us.email.fireeyecloud.com | 185.132.160.21 |
| gov.net | has mail | other TLD | 10 mx001.netsol.xion.oxcs.net, 10 mx004.netsol.xion.oxcs.net, 10 mx003.netsol.xion.oxcs.net | 206.188.193.169 |
| gov.online | has mail | other TLD | 10 inbound-smtp.us-east-1.amazonaws.com | 34.117.186.217 |
| gov.org | has mail | other TLD | 1000 0.0.0.0 | 54.235.96.128 |
| gov.ru | has mail | other TLD | 20 mx3.gov.ru, 30 mx4.gov.ru | 95.173.128.90, 95.173.128.89 |
| govv.uk | has mail | repetition | 1 mail.mailerhost.net | 172.104.149.86, 172.104.251.198 |
| gow.uk | has mail | lookalike character | 10 mailserver.livemail.co.uk | 213.171.195.105 |
| gpv.uk | has mail | adjacent key | 10 park-mx.above.com | 103.224.182.244 |
| gv.uk | has mail | omission | 10 mx.stackmail.com | 185.151.30.131 |
| gvo.uk | has mail | transposition | 10 park-mx.above.com | 103.224.182.244 |
| yov.uk | has mail | adjacent key | 10 park-mx.above.com | 103.224.182.244 |
| bov.uk | live site | adjacent key | none | 172.104.203.186, 172.104.149.86 |
| eov.uk | live site | bitsquat | none | 139.162.181.76, 172.104.203.186 |
| fov.uk | live site | adjacent key | none | 104.21.20.169, 172.67.193.58 |
| glv.uk | live site | adjacent key | none | 104.21.17.16, 172.67.219.142 |
| gnv.uk | live site | bitsquat | none | 172.67.145.6, 104.21.81.163 |
| gof.uk | live site | adjacent key | none | 13.248.213.45, 76.223.67.189 |
| gog.uk | live site | adjacent key | none | 78.41.207.18 |
| gor.uk | live site | bitsquat | none | 104.21.86.205, 172.67.136.206 |
| gou.uk | live site | lookalike character | none | 104.21.24.57, 172.67.217.31 |
| gov.app | live site | other TLD | none | 76.223.54.146, 13.248.169.48 |
| gov.icu | live site | other TLD | none | 172.104.203.186, 172.104.149.86 |
| hov.uk | live site | adjacent key | none | 104.21.43.111, 172.67.178.138 |
| oov.uk | live site | bitsquat | none | 172.104.203.186, 172.104.251.198 |
| qov.uk | live site | lookalike character | none | 104.21.2.70, 172.67.128.221 |
| vov.uk | live site | adjacent key | none | 172.67.128.65, 104.21.0.201 |
| 9ov.uk | registered | lookalike character | none | none |
| go.uk | registered | omission | none | none |
| gov.cn | registered | other TLD | none | none |
| gov.dev | registered | other TLD | none | none |
| gqv.uk | registered | lookalike character | none | none |
| info-gov.uk | registered | added word | none | none |
| ogv.uk | registered | transposition | none | none |
| ov.uk | registered | omission | none | none |
How they were found
| Technique | Registered |
|---|---|
| adjacent key | 13 |
| other TLD | 12 |
| bitsquat | 7 |
| lookalike character | 6 |
| repetition | 3 |
| added word | 3 |
| omission | 3 |
| transposition | 2 |
A lookalike is not something DMARC can block, but strong authentication on your own domain forces attackers to use one — which makes this list the place to look. Check your DMARC policy is at enforcement.