Lookalike addresses

Spot a lookalike email address

A lookalike address sits one letter, word or character away from a sender you trust. Fromensics compares the sender with your trusted senders, your own address and known brands, in your browser.

What you’ll see

Don’t pay

Don’t pay this invoice.

It came from sterlingcooper-partners.com, not Sterling Cooper’s usual address, and it asks you to pay an account Sterling Cooper hasn’t used before.

Ask Sterling Cooper to confirm

We’ll write to accounts@sterlingcooper.com, the address you already have.

When you see it: the email imitates one of your trusted senders and asks for money. The button drafts an email to the address you already have for them, never to the one this email came from.

Don’t pay

This address is a lookalike.

It came from acme-invoices.example made to look like your own.

Report phishing in Gmail

When you see it: the sender imitates your own address, a common trick in fake requests from “the CEO” or “accounts”. If the email asks for money or a login, the title says Don’t pay or Don’t sign in instead.

With Trust badges in Gmail turned on, a lookalike of a trusted sender is marked in the inbox before you open it:

Lookalike address

What counts as a lookalike

Check	What it catches	Listed as
Your trusted senders	sterlingcooper-partners.com writing as sterlingcooper.com	Imitates one of your trusted senders
Your own address	An address built to look like yours	Imitates your own address
Look-alike characters	A Cyrillic “а” in place of a Latin “a”	Look-alike characters
Known brands	A brand name with extra words added to the domain	Imitates a known brand
Near misses	A domain one letter away from an established one	A near-miss of an established domain
Company names	“From Brightline Media”, sent from an address that isn’t theirs	Names a company its address doesn’t match

These checks run in code on your device.

Trusted senders make this sharper

The strongest lookalike check compares the sender with people you’ve told Fromensics you trust. When an email shows Nothing looks off, Fromensics offers Add to trusted senders: “We’ll warn you if someone ever imitates this address.” You can also add a sender from the report’s More menu. The list stays in this browser. More on this in verified senders.

Questions

What if the address is exactly right?

Then it isn’t a lookalike, but the mailbox could still be hijacked. That’s what signed email is for: a hijacked mailbox can’t sign with a key it doesn’t have.

Does Fromensics block the email?

No. It tells you what to do and why. Reporting it uses your mail app’s own Report phishing.

Check an invoice emailDon’t pay, Check first, or Nothing looks off, before money moves.Verified sendersKnow an email is really from them, not a hijacked mailbox.Is this email a scam?One click for one answer, with every reason listed.