RealJobCheck

Glossary term

Lookalike domain

A lookalike domain (or typosquat) is an email or web address crafted to resemble a real company's, with a small change you can miss at a glance: an extra word like acme-careers.com, a different ending like acme.co, a swapped character like rn for m, or a hyphen. Scammers use them so an impersonated message appears to come from a trusted employer.

Updated June 2, 2026 · By the Trust and Safety Research Team

What it is

A lookalike domain is the technical trick behind most company-impersonation job scams. Because the sender address looks almost exactly right, your eye fills in the rest and you trust the message. The domain is real - the scammer registered it - it is just not the company's.

How it reaches you

A recruiter for a well-known company emails you from an address that is close but wrong. Common variants:

  • Added words: acme-careers.com, acme-hr.com, careers-acme.com.
  • Different ending: acme.co, acme.net, acme.org instead of acme.com.
  • Character swaps: rn for m, 0 for o, acrne.com, acmejobs.io.
  • Free email entirely: [email protected].

The same trick appears in links, sending you to a fake careers page or application form on a lookalike site.

The tell

The sender's domain does not exactly match the company's real primary domain, the one you would reach by typing the company name into your browser. Even one extra word or a different ending means it is not the company.

What to do

Check the domain character by character against the company's real website, which you reach by typing the address yourself rather than clicking the link. Confirm the role on the company's official careers page. The free checker inspects the sender domain and the company's real careers board for you. Lookalike domains are the main tool of recruiter impersonation.