Attackers use cousin domains by registering domains that look related to a real organisation but are not exact copies, often by changing a word, subdomain or top-level domain. They use them for phishing, fake login pages, malware delivery and business email compromise because users may trust the similarity.
How cousin domains work in a phishing or impersonation campaign
Cousin domains are useful because they preserve just enough visual similarity to pass a quick glance test. Attackers rely on that near-match to lower suspicion, then route the victim toward a login prompt, a file download or an email conversation that feels legitimate.
The tactic works best when the target is busy, the message is expected, or the domain sits inside a normal-looking context such as a branded invoice, shared document or password reset notice. That is why cousin domains are often paired with social engineering rather than used alone.
When you map this behaviour to real-world phishing tradecraft, the goal is not only to imitate a brand, but to borrow trust at the moment a user is deciding whether to click, sign in or reply. NHIMG’s Phishing Guide covers lookalike domains, brand impersonation and the layered controls that reduce this kind of abuse.
What attackers use cousin domains for
The most common use is credential harvesting. A cousin domain can host a fake sign-in page that looks close enough to the real service to collect usernames, passwords and session information. Once the attacker has those credentials, the domain can also support account takeover, internal phishing and follow-on access attempts.
Cousin domains are also effective for malware delivery and business email compromise because they help the attacker look like a trusted supplier, executive or internal team. In those cases, the domain is part of the story: it gives the message a believable source, which makes the payload, request or payment change more likely to succeed.
They are often used in multi-step campaigns. A message may start with a harmless-looking link, move the victim to a spoofed portal, and then redirect them into a second stage that captures data or delivers malware. The domain only needs to be credible long enough for the victim to take the first action.
Attackers also exploit the fact that many users do not inspect the full registered domain. A subtle change in spelling, a swapped top-level domain, or a modified subdomain can be enough to create trust. That is why cousin domains remain effective even when the impersonation is not technically perfect.
How defenders should think about detection and response
Cousin domains are a threat problem, but they are also an inventory problem. If you do not know which domains legitimately belong to your organisation, it becomes much harder to spot the ones that merely resemble it. The practical challenge is to distinguish real brand surface area from attacker-controlled lookalikes before the first user is fooled.
Detection works best when it combines domain monitoring, email security, web filtering and user reporting. Domain similarity alone is not always enough to prove maliciousness, so the better signal is the combination of name resemblance, newly registered infrastructure, suspicious hosting, and a page or message designed to capture credentials or redirect trust.
When a cousin domain is discovered, the response should focus on both takedown and exposure checking. If the domain has already been used in a campaign, review sign-in telemetry, mailbox rules, suspicious OAuth grants, and any evidence that users submitted credentials or opened a malicious payload. The domain is the lure, but the real risk is what the attacker got from the interaction.
Risk and Threat Considerations
Cousin domains matter because they let attackers exploit brand trust without needing a perfect clone. The risk is highest when users rely on visual recognition, when email gateways permit novel lookalikes, or when a fake domain can support a believable login flow or payment request.
Failure mechanism: The attacker registers a domain that is close enough to the real one to bypass casual inspection, then uses it to host phishing pages, impersonate staff, deliver malware or sustain business email compromise.
Impact: Victims may disclose credentials, approve fraudulent requests, install malware, or continue a conversation under false trust, which can lead to account takeover, data theft and financial loss.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Cousin domains are a common phishing delivery technique used to lure victims. |
| T1583 — Acquire Infrastructure | Attackers register impersonation domains as part of campaign infrastructure. | |
| Recommendation — Map lookalike domain activity to T1566 and hunt for delivery, credential capture, and follow-on access. Track newly registered lookalike domains as attacker infrastructure and correlate them with lure activity. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Cousin domains often host fake sign-in flows meant to steal credentials or sessions. |
| Recommendation — Protect authentication flows against impersonation pages and validate login endpoints rigorously. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Phishing domains target user authentication and credential capture. |
| Recommendation — Require strong user authentication that reduces the value of stolen passwords. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Cousin domains are delivered through email and web browsing channels. |
| Recommendation — Filter and warn on suspicious domains in email and browser traffic. | ||
Practitioner Guidance
What to verify: Confirm which domains are officially owned, delegated or used by your organisation, including common variants and legacy brands. If a domain is not in that inventory, treat similarity as a warning signal rather than as proof of legitimacy.
Decision rule: If a lookalike domain is being used for login, payment or account recovery, treat it as a high-priority impersonation event and investigate the message path, the hosted content and any sign-in activity before assuming it is a harmless typo-squat.
What practitioners underestimate: The first click is often not the only objective. Even when the victim does not submit credentials, the attacker may still gain value from reconnaissance, mailbox engagement, or convincing the target to move the conversation to a less monitored channel.
Practitioner takeaway: The best defence is not just spotting a suspicious domain, but understanding whether that domain can plausibly complete the trust chain needed for a click, a login or a payment.