Read this domain out loud: rnicrosoft.com. Most people see "microsoft". Look again. The "m" at the start is an "r" and an "n" standing very close together. In a busy inbox, on a phone screen, in a font that squeezes letters, nobody notices.

That is the whole idea behind a lookalike domain. It does not need to fool a security tool. It only needs to fool a person for two seconds, long enough to type a password or approve a payment.

What attackers are doing right now

Lookalikes of the brands people trust most are registered every single day. A few of the ones our own watch picked up in its first days of running:

• microsoft-singapore.com, registered on 8 October 2026 and passed around as a phishing domain three days later. A real brand name, a real city, and nothing to do with Microsoft.
• metamask.si, a crypto wallet brand on a country domain, registered 19 days before we saw it.
• Domains that swap letters for digits (micros0ft), drop a letter (microsft), squeeze letters together (rnicrosoft) or use characters from another alphabet that look exactly like Latin ones, so that a Cyrillic "і" in mіcrosoft.com is invisible to the eye.

The same tricks work on any company name. Your suppliers know your domain. Your customers know your domain. A domain that is one letter off is enough to send them a fake invoice with new bank details, and it will arrive looking like a normal Tuesday.

Why lists and reputation are too slow here

A brand new lookalike has no history. No security vendor has seen it, no one has reported it, and every reputation service treats it as unknown. By the time it lands on a blocklist, the invoices have been paid and the passwords have been typed.

So we do not wait for someone to report it. We look where every lookalike has to appear first.

Where every lookalike shows itself

A phishing site needs the padlock in the address bar, otherwise browsers warn people away. To get the padlock it needs a certificate, and every publicly trusted certificate on the internet has to be published in open Certificate Transparency logs before browsers accept it. Often that happens before the phishing page is even online.

Cybereinforce reads those logs around the clock. That is every new website certificate issued worldwide, around ten thousand of them every minute, from all the logs that Chrome and Safari rely on. On its first afternoon alone our watch read more than two million certificates.

Every name in every certificate is checked against the brands we protect, in every spelling that matters:

• the name as a word, like microsoft-login or microsoft-singapore
• the name hidden inside a word, like securemicrosoft
• misspellings, one letter added, dropped, swapped or replaced
• lookalike letters, rn for m, vv for w, digits for letters
• foreign alphabets, Cyrillic and Greek characters that render like Latin ones
• the real domain used as bait, like login.microsoftonline.com.example.top

Checked, not just matched

Plenty of honest businesses carry a brand name in their domain, so a match alone is not a verdict. Each candidate is checked the same way our analysts would check it:

• How old is it? We read the registration date straight from the registry. A lookalike registered in the last 30 days is blocked as malicious right away.
• Who registered it? Big brands register their own domains through specialist brand registrars. Those are recognised as the brand's own and left alone.
• Does anyone else already know it? When other security vendors already flag an older lookalike, it is blocked too.
• Has someone already decided? A domain a person has reviewed and cleared stays cleared.

Everything else goes to our analysts. Nothing is ever duplicated: whichever of our systems sees a lookalike first, every later sighting adds evidence to the same entry, and a stronger signal turns a warning into a block.

Your own brand, not only Microsoft's

Microsoft, PayPal, DHL and the other household names are watched for every Cybereinforce customer. With Brand Protection, your own company joins that list.

We take your domain and your company name and watch them in every spelling, including the ones you would never think of yourself: German umlauts written both ways, accents dropped, letters doubled. Your own domains are never flagged. When a lookalike of your brand appears:

• it is checked and, when it is new or already known to be malicious, blocked for every Cybereinforce user, so your colleagues are protected and so are the other companies on our platform that do business with you
• you get a Microsoft Sentinel incident with the lookalike domain as its entity, ready for your SOC, your hunting queries and your playbooks
• your administrators get an email the moment it is found, so finance and customer teams can be warned before the first fake invoice arrives
• every finding is listed on the Brand Protection page of your admin portal, with how it imitates you, when it was registered and what we did about it

Brand Protection is included in Enterprise and available as an extra for every other plan, with two domains included.