Lookalike domain identification

1. A computing platform, comprising:

at least one processor;

a communication interface communicatively coupled to the at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

generate a plurality of lookalike domain names for an input domain name, wherein generating the plurality of lookalike domain names comprises removing, from the input domain name, one or more characters before generating the plurality of lookalike domain names;

generate, by applying a hash algorithm to the plurality of lookalike domain names, a dictionary index;

identify a first domain name;

identify, by performing a lookup function in the dictionary index using the first domain name, that the first domain name comprises a lookalike domain name corresponding to the input domain name; and

send, to a user device, one or more commands directing the user device to display a user interface that includes the lookalike domain name, wherein sending the one or more commands directing the user device to display the user interface causes the user device to display the user interface.

2. The computing platform of claim 1 , wherein generating the plurality of lookalike domain names comprises generating, for the input domain name, lookalike domain names that are potential variations of the input domain name.

3. The computing platform of claim 1 , wherein the plurality of lookalike domain names further includes lookalike domain names for a plurality of other input domain names.

4. The computing platform of claim 1 , wherein identifying the first domain name comprises detecting an electronic message sent from the first domain name.

5. The computing platform of claim 1 , wherein identifying that the first domain name comprises the lookalike domain name corresponding to the input domain name comprises comparing metadata of the first domain name with the input domain name.

6. The computing platform of claim 5 , wherein comparing the metadata of the first domain name with the input domain name comprises one or more of:

identifying that one or more characters of the first domain name are different than the input domain name, and

the first domain name has a different top level domain (TLD) than the input domain name.

7. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:

identify, after identifying that the first domain name comprises the lookalike domain name, whether the lookalike domain name corresponds to a threat;

based on identifying that the lookalike domain name corresponds to the threat, perform one or more of:

sending one or more notifications indicating the threat,

blocking messages corresponding to the lookalike domain name,

quarantining messages corresponding to the lookalike domain name, and

rewriting URLs corresponding to the lookalike domain name; and

based on identifying that the lookalike domain name does not correspond to the threat, routing messages corresponding to the lookalike domain name for delivery.

8. The computing platform of claim 7 , wherein identifying whether the lookalike domain name corresponds to the threat comprises:

generating, based on metadata corresponding to the first domain name, a maliciousness score indicating a threat level of the first domain name;

comparing the maliciousness score to a maliciousness threshold;

based on identifying that the maliciousness score meets or exceeds the maliciousness threshold, identifying that the first domain name corresponds to the threat; and

based on identifying that the maliciousness score does not meet or exceed the maliciousness threshold, identifying that the first domain name does not correspond to the threat.

9. The computing platform of claim 7 , wherein the one or more notifications indicate that an identity of the input domain name is under attack, and wherein a first enterprise corresponding to the input domain name is a member of a supply chain for a second enterprise corresponding to the user device.

10. The computing platform of claim 7 , wherein the one or more notifications include one or more of: registration information for the first domain name and registration information for the input domain name.

11. The computing platform of claim 7 , wherein the one or more notifications include a service configured for domain names to be input, and corresponding lookalike domains to be output in real time.

12. The computing platform of claim 7 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:

identify an entity corresponding to the lookalike domain name; and

store a count of electronic messages sent from the lookalike domain name to the entity.

13. The computing platform of claim 1 , wherein the first domain name is identified based on a scan of historical messaging traffic.

14. The computing platform of claim 1 , wherein the first domain name is identified prior to receiving an electronic message from the input domain name.

15. A method, comprising:

at a computing platform comprising at least one processor, a communication interface, and memory:

generating a plurality of lookalike domain names for an input domain name, wherein generating the plurality of lookalike domain names comprises removing, from the input domain name, one or more characters before generating the plurality of lookalike domain names;

generating, by applying a hash algorithm to the plurality of lookalike domain names, a dictionary index;

identifying a first domain name;

identifying, by performing a lookup function in the dictionary index using the first domain name, that the first domain name comprises a lookalike domain name corresponding to the input domain name; and

sending, to a user device, one or more commands directing the user device to display a user interface that includes the lookalike domain name, wherein sending the one or more commands directing the user device to display the user interface causes the user device to display the user interface.

16. The method of claim 15 , wherein generating the plurality of lookalike domain names comprises generating, for the input domain name, lookalike domain names that are potential variations of the input domain name.

17. The method of claim 15 , wherein the plurality of lookalike domain names further includes lookalike domain names for a plurality of other input domain names.

18. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

generate a plurality of lookalike domain names for an input domain name, wherein generating the plurality of lookalike domain names comprises removing, from the input domain name, one or more characters before generating the plurality of lookalike domain names;

generate, by applying a hash algorithm to the plurality of lookalike domain names, a dictionary index;

identify a first domain name;

identify, by performing a lookup function in the dictionary index using the first domain name, that the first domain name comprises a lookalike domain name corresponding to the input domain name; and

send, to a user device, one or more commands directing the user device to display a user interface that includes the lookalike domain name, wherein sending the one or more commands directing the user device to display the user interface causes the user device to display the user interface.

19. The method of claim 15 , wherein the first domain name is identified prior to receiving an electronic message from the input domain name.

20. The non-transitory computer-readable media of claim 18 , wherein the first domain name is identified prior to receiving an electronic message from the input domain name.