Dot-UK Doppelgangers: The Scam Hiding in One Wrong Character

Most phishing advice still begins with the same line: check the sender. That is good advice, but in 2026 it is not enough. A growing slice of UK-brand phishing hides behind a domain that looks almost right at a glance — a swapped letter, an extra hyphen, or a Unicode character doing its best impression of an English one. The display name says Royal Mail, HMRC or your bank. The link says something like r0yal-mail.co.uk, hmrc-refund.uk or a punycode string that starts with xn--. One wrong character is often the whole scam.

Why .uk keeps turning up in lookalike attacks

.uk is familiar, trusted and short. Direct .uk registrations opened up back in 2014, and the namespace has spent more than a decade becoming part of everyday British internet life. That trust is exactly what attackers want to borrow. Short, plausible domains are scarce, so criminals improvise: add a word, swap a character, lean on a hyphen, or use a different suffix that still feels local.

Not every odd-looking .uk domain is hostile. Plenty of legitimate small firms use hyphens, initials and location words because the clean version was taken years ago. The job is not to block anything that looks roughly like a brand. The job is to spot the combination of signals that makes a message dangerous.

The usual disguises

• Character swaps: rn for m, l for I, 0 for O, vv for w. The classic paypa1 trick still works because people read shapes, not letters.
• Hyphen and keyword padding: a domain might bolt on words like secure, login, refund, billing or support to borrow urgency.
• Subdomain misdirection: the part before the brand name is not the important bit. Read from the right. The registrable domain is the bit just before the suffix.
• Homoglyphs and punycode: Cyrillic or Greek characters can look identical to Latin ones. If a domain appears as xn--something, slow down.
• Reply-To mismatch: the From address looks fine, but replies are pointed somewhere else. That is a classic invoice-fraud tell.

Read the domain like a suspicious sysadmin

Start with the actual link, not the display name. On desktop, hover. On mobile, long-press or copy the link into a notes app. Check the registrable domain, not the words in the middle of the URL. Then look for registration clues using RDAP or a WHOIS tool. A domain registered days ago is not automatically malicious, but it is a useful signal when it is also asking you to reset a password or change bank details.

DNS can add context. Does the domain have mail records? Which nameservers? Is there a published SPF record, DKIM signing and a DMARC policy? A lookalike with no DMARC, or one stuck at p=none, deserves more suspicion — though plenty of legitimate small senders are also sloppy. Authentication is evidence, not a verdict.

The strongest clue is usually context. An unexpected invoice with new bank details, a delivery fee for a parcel you are not expecting, a login prompt you did not trigger, or a message that pushes you to act within minutes. In those moments, verify out of band. Ring the number you already have, not the one in the email.

Filtering lookalikes without punishing real UK senders

A good filter is a scoring system, not a blunt ban. Start with authentication. Publish DMARC at p=reject for your own domains, and quarantine or reject inbound mail that fails alignment where you can. Then add lookalike scoring for protected domains: edit distance, keyboard proximity, homoglyph skeletons and hyphen padding. A message that hits a lookalike domain plus an authentication failure plus a financial keyword should not sit in the inbox waiting for a human to be careful.

Newly registered domains are another input, but use them carefully. Combine domain age with display-name impersonation, link mismatch, a Reply-To pointing at a free mail provider, or a first-contact invoice. Allowlist by authenticated domain, never by display name. Keep medium-confidence messages in quarantine rather than deleting them, and give users a clear way to report false positives. Legitimate .uk SMEs will occasionally trip a fuzzy match; tune the threshold and review the misses.

For users, the habits are simple. Do not log in from an email link; go to the site directly. Use a password manager, because it will not autofill on a doppelganger. Turn on MFA or passkeys. Treat any payment-detail change as a phone call, not an email thread. The .uk shakedown works because one character is easy to miss. A few seconds of domain-checking is still the cheapest defence we have.