Lookalike Domains: How a Single Character Difference Becomes a Brand’s Worst Nightmare

This report describes the industrial-scale threat posed by lookalike (typosquatting/homoglyph/combosquatting) domains in 2025, documenting large-scale telemetry (tens of thousands of suspicious domains), examples of attacker objectives (credential harvesting, BEC, malware/infostealer distribution), a Unit42 case demonstrating advanced homoglyph and anti-scanning techniques, and recommended continuous detection and takedown controls (CT log monitoring, Unicode-aware domain surveillance, passive DNS, dark-web intel, and rapid takedown procedures).