## TL;DR
A one-letter-off login domain is registered to be believed at a glance. Reputation has nothing on it, and generic URL filtering waits for a verdict that comes only after victims report. Block the exact host now, add the pattern to lookalike monitoring for your core brands, and hunt for the campaign that used it, because a registered lookalike rarely sends a single message.

```text
lookalike domain "micorsoft365-login" not blocked by url filter
```

## Use this when
- Mail links to a misspelled brand login domain that resolves to a credential page.
- Certificate or DNS monitoring shows a new lookalike of your sign-in domain.

## Not for this skill when
- The domain belongs to a legitimate reseller or regional brand. Confirm ownership before blocking mail from partners.
- The lookalike is only a sender domain with no hosted page. Use impersonation policy instead.

## Steps
1. Capture the full URL and the page evidence in an isolated environment, confirming it solicits credentials for the imitated brand. Verify: the harvest purpose is evidenced.
2. Block the domain in the tenant list, proxy and DNS layers, using the exact registrable domain so subdomains are covered. Verify: internal tests are blocked at each layer you control.
3. Search mail logs for the domain and its obvious spelling siblings, then purge delivered copies. Verify: the campaign footprint is cleared.
4. Add your main brands to a lookalike monitoring service or feed so new registrations alert before campaigns start. Verify: monitoring covers the brands users sign in to.
5. Submit the domain for takedown through the registrar abuse channel with your evidence pack. Verify: the takedown request is filed and tracked.

## Variant phrasings
### lookalike domain typosquat login block takedown
The block and takedown variant.
### misspelled microsoft 365 domain phishing
The brand-specific variant.

Compatibility: Tenant block lists, DNS filtering, registrar abuse processes for lookalike domains.

## Why it happens
Typosquatting works because reading is pattern-based: users see the expected word shape, not the letters. Filters share a version of the problem, since a fresh domain has no history to score, so first-day protection has to come from similarity analysis and monitoring.

## Edge cases / pitfalls
- Attackers register batches of variants. When you find one, enumerate and pre-block plausible siblings.
- A lookalike with a valid TLS certificate is normal now. A padlock says nothing about legitimacy.
- Keep evidence timestamps; registrars act faster with dated proof of active phishing.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xELY0DELPOnOe4TUzDez5w