What’s the difference between cousin domains and mirror domains?
Cousin domains are similar but distinct: variations like company-support.com, companylogin.com, or company-secure.com. They reference the brand but don't attempt exact duplication. Often used for targeted **phishing**.
Mirror domains attempt exact replication through character substitution: c0mpany.com, cornpany.com (rn vs m), or compаny.com (Cyrillic а). They're designed to be mistaken for the legitimate domain.
Both serve **phishing** but require different detection approaches. Cousin domains need brand keyword monitoring; mirror domains need visual similarity analysis. Comprehensive protection monitors for both.
Was this answer helpful?
Thanks for your feedback!