A lookalike domain is a domain name created by an attacker that mimics a legitimate, trusted domain to deceive users. This is achieved by making subtle changes, such as adding a hyphen ("great-company.com" vs. "greatcompany.com"), using character substitution ("g00gle.com"), or using a different top-level domain (".co" instead of ".com"). This tactic is a cornerstone of phishing and Business Email Compromise (BEC) attacks, as it preys on users' lack of attention to detail to establish a fraudulent sense of trust.

A: Domain Hijacking is the act of gaining unauthorized administrative control over a legitimate, existing domain, not registering a new, similar one.

B: Display Name Spoofing involves faking the sender's "From" name (e.g., "John Smith") while the underlying email address/domain is different.

D: Subdomain Takeover involves compromising a misconfigured subdomain of a legitimate domain (e.g., help.greatcompany.com), not creating a new parent domain.

- Proofpoint, Inc. "What is a Lookalike Domain?" proofpoint.com/us/threat-reference/lookalike-domain. This official glossary article defines the term precisely as registering a domain similar to a well-known brand to facilitate attacks.

- Proofpoint, Inc. "Email Fraud Defense Datasheet." This document describes how Proofpoint solutions detect various impersonation tactics, explicitly including lookalike domains as a key threat vector in BEC attacks. (Section: Key Capabilities).