================================================================================ DOMAIN ANALYSIS: LEGITIMATE vs LOOKALIKE — FOR AUTHORIZED TRAINING ONLY ================================================================================ WARNING: These are fictional domain records created for educational purposes. Registering lookalike domains for unauthorized phishing is illegal. All WHOIS data below is fabricated. ================================================================================ LEGITIMATE DOMAIN: acmecorp.com ================================================================================ WHOIS RECORD: Domain Name: acmecorp.com Registrar: Cloudflare, Inc. Registrar URL: https://www.cloudflare.com Creation Date: 2011-03-15T14:22:00Z Updated Date: 2025-03-15T08:00:00Z Expiration Date: 2028-03-15T14:22:00Z Registrant Org: Acme Corporation Registrant State: Texas Registrant Country: US Name Servers: ns1.cloudflare.com, ns2.cloudflare.com DNSSEC: signedDelegation Status: clientTransferProhibited clientDeleteProhibited DNS RECORDS: A acmecorp.com 203.0.113.50 MX acmecorp.com 10 mx1.acmecorp.com MX acmecorp.com 20 mx2.acmecorp.com TXT acmecorp.com "v=spf1 include:_spf.google.com ip4:203.0.113.0/24 -all" TXT _dmarc.acmecorp.com "v=DMARC1; p=reject; rua=mailto:dmarc@acmecorp.com; ruf=mailto:dmarc@acmecorp.com; pct=100" TXT s1._domainkey.acmecorp.com "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..." CAA acmecorp.com 0 issue "letsencrypt.org" CAA acmecorp.com 0 issue "digicert.com" SSL CERTIFICATE: Issuer: DigiCert Inc Subject: *.acmecorp.com Valid From: 2025-01-10 Valid To: 2026-01-10 Serial: 0A:1B:2C:3D:4E:5F:6A:7B Key Size: RSA 2048 SECURITY POSTURE SUMMARY: [PASS] SPF: Hard fail (-all) — unauthorized senders are rejected [PASS] DKIM: RSA key published, selector s1 [PASS] DMARC: p=reject at 100% — spoofed emails are dropped [PASS] DNSSEC: Signed delegation in place [PASS] CAA: Restricts certificate issuance to approved CAs [PASS] Domain lock: Transfer and delete protection enabled [PASS] Registration: 14+ years old, reputable registrar, US-based ================================================================================ LOOKALIKE #1: acmec0rp.com (zero substitution) ================================================================================ Visual Comparison: Legitimate: acmecorp.com (letter 'o') Lookalike: acmec0rp.com (digit '0') Difference: Position 6 — 'o' replaced with '0' At normal font sizes and in most email clients, these are nearly indistinguishable. The substitution is invisible in many sans-serif fonts (Arial, Helvetica, Calibri). WHOIS RECORD: Domain Name: acmec0rp.com Registrar: Namecheap, Inc. Registrar URL: https://www.namecheap.com Creation Date: 2025-10-01T22:14:33Z Updated Date: 2025-10-01T22:14:33Z Expiration Date: 2026-10-01T22:14:33Z Registrant Org: WhoisGuard, Inc. (PRIVACY SERVICE) Registrant State: Panama Registrant Country: PA Name Servers: ns1.registrar-servers.com, ns2.registrar-servers.com DNSSEC: unsigned Status: clientTransferProhibited DNS RECORDS: A acmec0rp.com 91.195.240.18 MX acmec0rp.com 10 mail.acmec0rp.com TXT acmec0rp.com "v=spf1 ip4:91.195.240.18 ~all" TXT _dmarc.acmec0rp.com [NO RECORD] SSL CERTIFICATE: Issuer: Let's Encrypt Subject: acmec0rp.com Valid From: 2025-10-01 Valid To: 2025-12-30 Serial: 03:FF:AA:BB:CC:DD:EE:11 Key Size: RSA 2048 COMPARISON FLAGS: [ALERT] Created just 2 weeks before phishing campaign (2025-10-01) [ALERT] WHOIS privacy service in Panama — identity hidden [ALERT] Different registrar than legitimate domain (Namecheap vs Cloudflare) [ALERT] No DMARC record — no spoofing protection [ALERT] SPF soft fail (~all) instead of hard fail — permissive policy [ALERT] DNSSEC unsigned — no DNS integrity protection [ALERT] Let's Encrypt certificate (free, automated — no identity verification) [ALERT] Single IP address, no redundancy — disposable infrastructure [ALERT] 1-year registration — minimum commitment [ALERT] IP 91.195.240.18 geolocates to Eastern Europe ================================================================================ LOOKALIKE #2: acmecorp.net (TLD variation) ================================================================================ Visual Comparison: Legitimate: acmecorp.com Lookalike: acmecorp.net Difference: TLD changed from .com to .net This is effective because users often ignore TLDs, especially when the second-level domain matches exactly. Email display names can mask the full address entirely. WHOIS RECORD: Domain Name: acmecorp.net Registrar: GoDaddy.com, LLC Registrar URL: https://www.godaddy.com Creation Date: 2025-09-18T09:30:12Z Updated Date: 2025-09-18T09:30:12Z Expiration Date: 2026-09-18T09:30:12Z Registrant Org: Domains By Proxy, LLC (PRIVACY SERVICE) Registrant State: Arizona Registrant Country: US Name Servers: ns1.digitalocean.com, ns2.digitalocean.com DNSSEC: unsigned Status: ok DNS RECORDS: A acmecorp.net 167.71.44.203 MX acmecorp.net 10 mail.acmecorp.net TXT acmecorp.net "v=spf1 ip4:167.71.44.203 ~all" TXT _dmarc.acmecorp.net "v=DMARC1; p=none" SSL CERTIFICATE: Issuer: Let's Encrypt Subject: acmecorp.net Valid From: 2025-09-18 Valid To: 2025-12-17 Serial: 04:11:22:33:44:55:66:77 Key Size: EC P-256 COMPARISON FLAGS: [ALERT] Different TLD — .net instead of .com [ALERT] Created 4 weeks before campaign (recent registration) [ALERT] Privacy-protected WHOIS (GoDaddy proxy) [ALERT] DigitalOcean hosting — cloud VPS, likely disposable [ALERT] DMARC p=none — monitor only, no enforcement [ALERT] SPF soft fail — permissive [ALERT] Let's Encrypt certificate — free, no identity verification [ALERT] IP geolocates to DigitalOcean NYC datacenter ================================================================================ LOOKALIKE #3: acme-corp.com (hyphen insertion) ================================================================================ Visual Comparison: Legitimate: acmecorp.com Lookalike: acme-corp.com Difference: Hyphen inserted between "acme" and "corp" Hyphen insertion is effective because it looks like a plausible alternative domain format. Many companies use hyphens in their domains, so the target does not question it. WHOIS RECORD: Domain Name: acme-corp.com Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Registrar URL: https://www.publicdomainregistry.com Creation Date: 2025-09-25T16:45:00Z Updated Date: 2025-09-25T16:45:00Z Expiration Date: 2026-09-25T16:45:00Z Registrant Org: REDACTED FOR PRIVACY Registrant State: REDACTED Registrant Country: IN Name Servers: freedns1.registrar-servers.com, freedns2.registrar-servers.com DNSSEC: unsigned Status: ok DNS RECORDS: A acme-corp.com 103.48.216.77 MX acme-corp.com 10 mail.acme-corp.com TXT acme-corp.com "v=spf1 +all" TXT _dmarc.acme-corp.com [NO RECORD] SSL CERTIFICATE: Issuer: Let's Encrypt Subject: acme-corp.com Valid From: 2025-09-25 Valid To: 2025-12-24 Serial: 05:AA:BB:CC:DD:EE:FF:00 Key Size: RSA 2048 COMPARISON FLAGS: [ALERT] Hyphen insertion variant of legitimate domain [ALERT] Created 3 weeks before campaign [ALERT] Registrar in India — different jurisdiction from target [ALERT] Country of registration: IN (India) [ALERT] SPF "+all" — allows ANY server to send as this domain (worst possible) [ALERT] No DMARC record [ALERT] DNSSEC unsigned [ALERT] Free DNS nameservers [ALERT] IP 103.48.216.77 geolocates to Hong Kong ================================================================================ LOOKALIKE #4: login-acmecorp.com (subdomain-style prefix) ================================================================================ Visual Comparison: Legitimate: acmecorp.com Lookalike: login-acmecorp.com Difference: "login-" prepended to domain name This technique is particularly effective for credential harvesting pages. The URL looks like a subdomain of acmecorp.com at a glance, especially in a mobile browser where the address bar may be truncated. Target sees: https://login-acmecorp.com/sso/auth Target thinks: "This is the login page for acmecorp.com" Reality: Completely separate domain controlled by attacker WHOIS RECORD: Domain Name: login-acmecorp.com Registrar: NameSilo, LLC Registrar URL: https://www.namesilo.com Creation Date: 2025-10-05T03:22:18Z Updated Date: 2025-10-05T03:22:18Z Expiration Date: 2026-10-05T03:22:18Z Registrant Org: PrivacyGuardian.org (PRIVACY SERVICE) Registrant State: REDACTED Registrant Country: REDACTED Name Servers: ns1.namesilo.com, ns2.namesilo.com DNSSEC: unsigned Status: clientTransferProhibited DNS RECORDS: A login-acmecorp.com 45.77.198.201 MX [NO MX RECORD — not used for email, only phishing pages] TXT login-acmecorp.com [NO SPF RECORD] TXT _dmarc.login-acmecorp.com [NO RECORD] SSL CERTIFICATE: Issuer: Let's Encrypt Subject: login-acmecorp.com Valid From: 2025-10-05 Valid To: 2026-01-03 Serial: 06:12:34:56:78:9A:BC:DE Key Size: EC P-256 COMPARISON FLAGS: [ALERT] Prefix-style typosquatting — mimics subdomain structure [ALERT] Created just 10 days before campaign (very recent) [ALERT] Full WHOIS privacy — all registrant fields redacted [ALERT] No MX records — domain is only used for web (landing pages) [ALERT] No SPF, no DKIM, no DMARC — no email authentication at all [ALERT] Let's Encrypt cert — padlock icon visible, gives false sense of trust [ALERT] IP 45.77.198.201 — Vultr VPS in London, UK [ALERT] Single purpose: hosts a cloned SSO login page for credential capture LANDING PAGE ANALYSIS: URL: https://login-acmecorp.com/sso/auth?redirect=portal Content: Pixel-perfect clone of Acme Corp's Okta SSO login page Action: Form POSTs credentials to https://login-acmecorp.com/collect Behavior: After capture, redirects to real https://sso.acmecorp.com (victim thinks login "just had a glitch") Evilginx: This domain was configured as an Evilginx phishlet to intercept MFA tokens in real-time (reverse proxy attack) ================================================================================ COMPARISON TABLE ================================================================================ Domain Registrar Created Country SPF DKIM DMARC IP Location ------------------ -------------- ----------- ------- ------ ---- ------- ---------------- acmecorp.com Cloudflare 2011-03-15 US -all Yes reject US (corporate) acmec0rp.com Namecheap 2025-10-01 PA ~all No none Eastern Europe acmecorp.net GoDaddy 2025-09-18 US* ~all No none US (VPS) acme-corp.com PublicDomain 2025-09-25 IN +all No none Hong Kong login-acmecorp.com NameSilo 2025-10-05 Hidden none No none UK (VPS) * US registrar address but privacy-protected, actual registrant unknown ================================================================================ KEY DETECTION PATTERNS ================================================================================ 1. DOMAIN AGE: All lookalikes were registered within 30 days of the attack. Legitimate corporate domains are typically years old. 2. REGISTRAR DIVERSITY: Attackers use different registrars for each domain to avoid pattern-based takedowns. 3. WHOIS PRIVACY: All lookalikes use privacy protection. While privacy is common for legitimate domains too, combined with other indicators it is a strong signal. 4. EMAIL AUTHENTICATION: Legitimate domain has SPF -all, DKIM, DMARC reject. Lookalikes have weak or missing authentication — they don't need it because they're sending, not receiving. 5. CERTIFICATE AUTHORITY: Legitimate domain uses DigiCert (paid, OV/EV cert). All lookalikes use Let's Encrypt (free, DV only). The padlock icon means the connection is encrypted, NOT that the site is trustworthy. 6. HOSTING: Legitimate domain uses dedicated corporate infrastructure. Lookalikes use cheap VPS providers (DigitalOcean, Vultr, generic hosting) that can be provisioned and abandoned quickly. 7. GEOGRAPHIC SPREAD: Lookalike infrastructure spans multiple countries (Eastern Europe, Hong Kong, UK, US) to complicate takedown jurisdiction. ================================================================================ DEFENSIVE RECOMMENDATIONS ================================================================================ 1. Register common typosquatting variants of your domain proactively 2. Set up domain monitoring alerts (e.g., dnstwist, URLCrazy, PhishTank) 3. Implement DMARC p=reject for your legitimate domain 4. Train employees to verify domains character by character 5. Use browser extensions that highlight newly registered domains 6. Configure email gateway to flag messages from lookalike domains 7. Report lookalike domains to registrars for takedown (most have abuse@ processes) ================================================================================ END OF DOMAIN ANALYSIS ================================================================================