================================================================================
DOMAIN ANALYSIS: LEGITIMATE vs LOOKALIKE — FOR AUTHORIZED TRAINING ONLY
================================================================================

WARNING: These are fictional domain records created for educational purposes.
Registering lookalike domains for unauthorized phishing is illegal. All WHOIS
data below is fabricated.

================================================================================
LEGITIMATE DOMAIN: acmecorp.com
================================================================================

WHOIS RECORD:
  Domain Name:      acmecorp.com
  Registrar:        Cloudflare, Inc.
  Registrar URL:    https://www.cloudflare.com
  Creation Date:    2011-03-15T14:22:00Z
  Updated Date:     2025-03-15T08:00:00Z
  Expiration Date:  2028-03-15T14:22:00Z
  Registrant Org:   Acme Corporation
  Registrant State: Texas
  Registrant Country: US
  Name Servers:     ns1.cloudflare.com, ns2.cloudflare.com
  DNSSEC:           signedDelegation
  Status:           clientTransferProhibited
                    clientDeleteProhibited

DNS RECORDS:
  A       acmecorp.com           203.0.113.50
  MX      acmecorp.com    10     mx1.acmecorp.com
  MX      acmecorp.com    20     mx2.acmecorp.com
  TXT     acmecorp.com           "v=spf1 include:_spf.google.com
                                   ip4:203.0.113.0/24 -all"
  TXT     _dmarc.acmecorp.com    "v=DMARC1; p=reject; rua=mailto:dmarc@acmecorp.com;
                                   ruf=mailto:dmarc@acmecorp.com; pct=100"
  TXT     s1._domainkey.acmecorp.com  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
  CAA     acmecorp.com    0 issue "letsencrypt.org"
  CAA     acmecorp.com    0 issue "digicert.com"

SSL CERTIFICATE:
  Issuer:           DigiCert Inc
  Subject:          *.acmecorp.com
  Valid From:       2025-01-10
  Valid To:         2026-01-10
  Serial:           0A:1B:2C:3D:4E:5F:6A:7B
  Key Size:         RSA 2048

SECURITY POSTURE SUMMARY:
  [PASS] SPF: Hard fail (-all) — unauthorized senders are rejected
  [PASS] DKIM: RSA key published, selector s1
  [PASS] DMARC: p=reject at 100% — spoofed emails are dropped
  [PASS] DNSSEC: Signed delegation in place
  [PASS] CAA: Restricts certificate issuance to approved CAs
  [PASS] Domain lock: Transfer and delete protection enabled
  [PASS] Registration: 14+ years old, reputable registrar, US-based

================================================================================
LOOKALIKE #1: acmec0rp.com (zero substitution)
================================================================================

Visual Comparison:
  Legitimate:  acmecorp.com     (letter 'o')
  Lookalike:   acmec0rp.com     (digit '0')
  Difference:  Position 6 — 'o' replaced with '0'

  At normal font sizes and in most email clients, these are nearly
  indistinguishable. The substitution is invisible in many sans-serif
  fonts (Arial, Helvetica, Calibri).

WHOIS RECORD:
  Domain Name:      acmec0rp.com
  Registrar:        Namecheap, Inc.
  Registrar URL:    https://www.namecheap.com
  Creation Date:    2025-10-01T22:14:33Z
  Updated Date:     2025-10-01T22:14:33Z
  Expiration Date:  2026-10-01T22:14:33Z
  Registrant Org:   WhoisGuard, Inc. (PRIVACY SERVICE)
  Registrant State: Panama
  Registrant Country: PA
  Name Servers:     ns1.registrar-servers.com, ns2.registrar-servers.com
  DNSSEC:           unsigned
  Status:           clientTransferProhibited

DNS RECORDS:
  A       acmec0rp.com           91.195.240.18
  MX      acmec0rp.com    10     mail.acmec0rp.com
  TXT     acmec0rp.com           "v=spf1 ip4:91.195.240.18 ~all"
  TXT     _dmarc.acmec0rp.com    [NO RECORD]

SSL CERTIFICATE:
  Issuer:           Let's Encrypt
  Subject:          acmec0rp.com
  Valid From:       2025-10-01
  Valid To:         2025-12-30
  Serial:           03:FF:AA:BB:CC:DD:EE:11
  Key Size:         RSA 2048

COMPARISON FLAGS:
  [ALERT] Created just 2 weeks before phishing campaign (2025-10-01)
  [ALERT] WHOIS privacy service in Panama — identity hidden
  [ALERT] Different registrar than legitimate domain (Namecheap vs Cloudflare)
  [ALERT] No DMARC record — no spoofing protection
  [ALERT] SPF soft fail (~all) instead of hard fail — permissive policy
  [ALERT] DNSSEC unsigned — no DNS integrity protection
  [ALERT] Let's Encrypt certificate (free, automated — no identity verification)
  [ALERT] Single IP address, no redundancy — disposable infrastructure
  [ALERT] 1-year registration — minimum commitment
  [ALERT] IP 91.195.240.18 geolocates to Eastern Europe

================================================================================
LOOKALIKE #2: acmecorp.net (TLD variation)
================================================================================

Visual Comparison:
  Legitimate:  acmecorp.com
  Lookalike:   acmecorp.net
  Difference:  TLD changed from .com to .net

  This is effective because users often ignore TLDs, especially when the
  second-level domain matches exactly. Email display names can mask the
  full address entirely.

WHOIS RECORD:
  Domain Name:      acmecorp.net
  Registrar:        GoDaddy.com, LLC
  Registrar URL:    https://www.godaddy.com
  Creation Date:    2025-09-18T09:30:12Z
  Updated Date:     2025-09-18T09:30:12Z
  Expiration Date:  2026-09-18T09:30:12Z
  Registrant Org:   Domains By Proxy, LLC (PRIVACY SERVICE)
  Registrant State: Arizona
  Registrant Country: US
  Name Servers:     ns1.digitalocean.com, ns2.digitalocean.com
  DNSSEC:           unsigned
  Status:           ok

DNS RECORDS:
  A       acmecorp.net           167.71.44.203
  MX      acmecorp.net    10     mail.acmecorp.net
  TXT     acmecorp.net           "v=spf1 ip4:167.71.44.203 ~all"
  TXT     _dmarc.acmecorp.net    "v=DMARC1; p=none"

SSL CERTIFICATE:
  Issuer:           Let's Encrypt
  Subject:          acmecorp.net
  Valid From:       2025-09-18
  Valid To:         2025-12-17
  Serial:           04:11:22:33:44:55:66:77
  Key Size:         EC P-256

COMPARISON FLAGS:
  [ALERT] Different TLD — .net instead of .com
  [ALERT] Created 4 weeks before campaign (recent registration)
  [ALERT] Privacy-protected WHOIS (GoDaddy proxy)
  [ALERT] DigitalOcean hosting — cloud VPS, likely disposable
  [ALERT] DMARC p=none — monitor only, no enforcement
  [ALERT] SPF soft fail — permissive
  [ALERT] Let's Encrypt certificate — free, no identity verification
  [ALERT] IP geolocates to DigitalOcean NYC datacenter

================================================================================
LOOKALIKE #3: acme-corp.com (hyphen insertion)
================================================================================

Visual Comparison:
  Legitimate:  acmecorp.com
  Lookalike:   acme-corp.com
  Difference:  Hyphen inserted between "acme" and "corp"

  Hyphen insertion is effective because it looks like a plausible
  alternative domain format. Many companies use hyphens in their domains,
  so the target does not question it.

WHOIS RECORD:
  Domain Name:      acme-corp.com
  Registrar:        PDR Ltd. d/b/a PublicDomainRegistry.com
  Registrar URL:    https://www.publicdomainregistry.com
  Creation Date:    2025-09-25T16:45:00Z
  Updated Date:     2025-09-25T16:45:00Z
  Expiration Date:  2026-09-25T16:45:00Z
  Registrant Org:   REDACTED FOR PRIVACY
  Registrant State: REDACTED
  Registrant Country: IN
  Name Servers:     freedns1.registrar-servers.com, freedns2.registrar-servers.com
  DNSSEC:           unsigned
  Status:           ok

DNS RECORDS:
  A       acme-corp.com          103.48.216.77
  MX      acme-corp.com    10    mail.acme-corp.com
  TXT     acme-corp.com          "v=spf1 +all"
  TXT     _dmarc.acme-corp.com   [NO RECORD]

SSL CERTIFICATE:
  Issuer:           Let's Encrypt
  Subject:          acme-corp.com
  Valid From:       2025-09-25
  Valid To:         2025-12-24
  Serial:           05:AA:BB:CC:DD:EE:FF:00
  Key Size:         RSA 2048

COMPARISON FLAGS:
  [ALERT] Hyphen insertion variant of legitimate domain
  [ALERT] Created 3 weeks before campaign
  [ALERT] Registrar in India — different jurisdiction from target
  [ALERT] Country of registration: IN (India)
  [ALERT] SPF "+all" — allows ANY server to send as this domain (worst possible)
  [ALERT] No DMARC record
  [ALERT] DNSSEC unsigned
  [ALERT] Free DNS nameservers
  [ALERT] IP 103.48.216.77 geolocates to Hong Kong

================================================================================
LOOKALIKE #4: login-acmecorp.com (subdomain-style prefix)
================================================================================

Visual Comparison:
  Legitimate:  acmecorp.com
  Lookalike:   login-acmecorp.com
  Difference:  "login-" prepended to domain name

  This technique is particularly effective for credential harvesting pages.
  The URL looks like a subdomain of acmecorp.com at a glance, especially
  in a mobile browser where the address bar may be truncated.

  Target sees: https://login-acmecorp.com/sso/auth
  Target thinks: "This is the login page for acmecorp.com"
  Reality: Completely separate domain controlled by attacker

WHOIS RECORD:
  Domain Name:      login-acmecorp.com
  Registrar:        NameSilo, LLC
  Registrar URL:    https://www.namesilo.com
  Creation Date:    2025-10-05T03:22:18Z
  Updated Date:     2025-10-05T03:22:18Z
  Expiration Date:  2026-10-05T03:22:18Z
  Registrant Org:   PrivacyGuardian.org (PRIVACY SERVICE)
  Registrant State: REDACTED
  Registrant Country: REDACTED
  Name Servers:     ns1.namesilo.com, ns2.namesilo.com
  DNSSEC:           unsigned
  Status:           clientTransferProhibited

DNS RECORDS:
  A       login-acmecorp.com           45.77.198.201
  MX      [NO MX RECORD — not used for email, only phishing pages]
  TXT     login-acmecorp.com           [NO SPF RECORD]
  TXT     _dmarc.login-acmecorp.com    [NO RECORD]

SSL CERTIFICATE:
  Issuer:           Let's Encrypt
  Subject:          login-acmecorp.com
  Valid From:       2025-10-05
  Valid To:         2026-01-03
  Serial:           06:12:34:56:78:9A:BC:DE
  Key Size:         EC P-256

COMPARISON FLAGS:
  [ALERT] Prefix-style typosquatting — mimics subdomain structure
  [ALERT] Created just 10 days before campaign (very recent)
  [ALERT] Full WHOIS privacy — all registrant fields redacted
  [ALERT] No MX records — domain is only used for web (landing pages)
  [ALERT] No SPF, no DKIM, no DMARC — no email authentication at all
  [ALERT] Let's Encrypt cert — padlock icon visible, gives false sense of trust
  [ALERT] IP 45.77.198.201 — Vultr VPS in London, UK
  [ALERT] Single purpose: hosts a cloned SSO login page for credential capture

LANDING PAGE ANALYSIS:
  URL:      https://login-acmecorp.com/sso/auth?redirect=portal
  Content:  Pixel-perfect clone of Acme Corp's Okta SSO login page
  Action:   Form POSTs credentials to https://login-acmecorp.com/collect
  Behavior: After capture, redirects to real https://sso.acmecorp.com
            (victim thinks login "just had a glitch")
  Evilginx: This domain was configured as an Evilginx phishlet to
            intercept MFA tokens in real-time (reverse proxy attack)

================================================================================
COMPARISON TABLE
================================================================================

Domain              Registrar       Created      Country  SPF     DKIM  DMARC    IP Location
------------------  --------------  -----------  -------  ------  ----  -------  ----------------
acmecorp.com        Cloudflare      2011-03-15   US       -all    Yes   reject   US (corporate)
acmec0rp.com        Namecheap       2025-10-01   PA       ~all    No    none     Eastern Europe
acmecorp.net        GoDaddy         2025-09-18   US*      ~all    No    none     US (VPS)
acme-corp.com       PublicDomain    2025-09-25   IN       +all    No    none     Hong Kong
login-acmecorp.com  NameSilo        2025-10-05   Hidden   none    No    none     UK (VPS)

* US registrar address but privacy-protected, actual registrant unknown

================================================================================
KEY DETECTION PATTERNS
================================================================================

1. DOMAIN AGE: All lookalikes were registered within 30 days of the attack.
   Legitimate corporate domains are typically years old.

2. REGISTRAR DIVERSITY: Attackers use different registrars for each domain
   to avoid pattern-based takedowns.

3. WHOIS PRIVACY: All lookalikes use privacy protection. While privacy is
   common for legitimate domains too, combined with other indicators it is
   a strong signal.

4. EMAIL AUTHENTICATION: Legitimate domain has SPF -all, DKIM, DMARC reject.
   Lookalikes have weak or missing authentication — they don't need it
   because they're sending, not receiving.

5. CERTIFICATE AUTHORITY: Legitimate domain uses DigiCert (paid, OV/EV cert).
   All lookalikes use Let's Encrypt (free, DV only). The padlock icon means
   the connection is encrypted, NOT that the site is trustworthy.

6. HOSTING: Legitimate domain uses dedicated corporate infrastructure.
   Lookalikes use cheap VPS providers (DigitalOcean, Vultr, generic hosting)
   that can be provisioned and abandoned quickly.

7. GEOGRAPHIC SPREAD: Lookalike infrastructure spans multiple countries
   (Eastern Europe, Hong Kong, UK, US) to complicate takedown jurisdiction.

================================================================================
DEFENSIVE RECOMMENDATIONS
================================================================================

1. Register common typosquatting variants of your domain proactively
2. Set up domain monitoring alerts (e.g., dnstwist, URLCrazy, PhishTank)
3. Implement DMARC p=reject for your legitimate domain
4. Train employees to verify domains character by character
5. Use browser extensions that highlight newly registered domains
6. Configure email gateway to flag messages from lookalike domains
7. Report lookalike domains to registrars for takedown (most have abuse@ processes)

================================================================================
END OF DOMAIN ANALYSIS
================================================================================
