The most expensive phishing emails rarely contain a link. They contain a polite message from a supplier you know, a new bank account for the next invoice, and a sender address that looks exactly right until you count the letters.

That domain was registered a few days earlier. It never hosted a website. It never needed one. It only had to exist long enough to send a handful of emails to the right people.

What attackers are doing right now

Invoice fraud and payment redirection remain among the costliest forms of cybercrime for businesses, and they run on lookalike domains. The pattern is always similar:

• a domain one letter away from a real company, like rnicrosoft.com instead of microsoft.com, or the real name with a word added, like microsoft-singapore.com
• a mailbox on that domain, set up within minutes
• a message to finance or a customer, sent before anyone has had a reason to look at the domain

Attackers increasingly register these domains in batches and in many languages at once, a fake parcel notice in German, a rewards message in Italian, an account check in Turkish, each on its own fresh domain.

Why waiting for a report is too late

Most protection reacts to something that has already happened: a page that was reported, a sender that was flagged, a site that someone visited. A lookalike that has only just been registered has done none of that. To every list and every reputation service it simply does not exist yet.

So we look at the moment that cannot be skipped. Before a domain can send an email or host a page, it has to be registered.

Watching registrations, every day

Cybereinforce now monitors newly registered domains across hundreds of domain extensions, from .com and .net to the cheap extensions favoured by phishing kits and many country domains. Every new name is checked the same day against the brands we protect:

• more than 250 of the world's most impersonated brands, from Microsoft, Google and Apple to banks, payment services, crypto exchanges, couriers and government portals across Europe, Turkey, the Gulf, the Americas and Asia
• and, with Brand Protection, your own company's domains and name

The check looks for every way a name can be imitated: misspellings, swapped or doubled letters, digits instead of letters, characters from other alphabets that look identical, and the brand name hidden inside a longer word. It also understands phishing vocabulary in English, German, Italian, Spanish, Portuguese, French, Dutch and Turkish, so a domain that pairs a brand with "verify", "Lieferung" or "doğrulama" stands out immediately.

Checked before it is blocked

A new domain that carries a brand name is not automatically malicious, so each candidate is checked the way an analyst would check it. We confirm when it was registered and by whom, recognise the brand's own registrations so they are never touched, and look at how strong the imitation is.

• A clear impersonation, a misspelled brand or a brand next to words like login, refund or tracking, is blocked as malicious right away.
• A weaker match is marked suspicious. Your users see a warning before it opens, and the moment the domain shows any sign of use, a certificate, a visit or an email, it is upgraded to a full block.

Every finding joins our threat intelligence, so one detection protects every Cybereinforce customer at once.

Your own name, protected the same way

For Brand Protection customers, a newly registered lookalike of your own domain is the most valuable thing we can find. You receive a Microsoft Sentinel incident and an email the day we see it, so finance and customer teams can be warned before the first fake invoice arrives. When you switch Brand Protection on, we also look back over the past months of registrations, so you start with a full picture instead of an empty page.