Lookalike domains: what they are and how to take them down

Your domain is your name online. It is the part after the @ in your email address, and it is the address of your website. A lookalike domain is another domain that looks almost the same. Someone else registers it, and often sets it up to look like you.

What is a lookalike domain?

A lookalike domain is a domain name that is almost identical to yours and is registered by someone else. Your real domain is yourcompany.com. A lookalike might be yourc0mpany.com, with a zero in place of the o.

Anyone can register a name that nobody else has registered yet. That is why a lookalike is so easy to create, and why you need to watch for them.

How do scammers use a lookalike domain?

Scammers use a lookalike in three common ways.

• Email. They send from the lookalike to your customers, your staff or your suppliers. This is a common path for fake invoices and changed bank details, as the fake invoice scam explains.
• A copy of your website. They copy your logo and pages to collect logins or payments from people who think they are on your site.
• A login or payment page. They send a link that says "sign in to see the invoice" or "confirm your payment", and the page looks like yours.

A lookalike does not need to be perfect. It only has to pass a quick look, especially on a phone screen.

For a business, the damage goes beyond one bad payment. A customer who gets a message from a lookalike may decide that you were hacked. Your staff may stop trusting email from your real domain. A short check today is much easier than a long explanation to a customer later.

What are the common tricks?

Most lookalikes use one of a few simple changes. You can check for all of them in the table above.

Is a letter swapped for one that looks alike?

Yes. A zero can replace an o, and rn can replace an m. In many fonts, rn looks almost like m, so yourcornpany.com can pass for yourcompany.com in a quick read.

Is a letter missing, repeated or swapped?

Small typing errors work too, such as yourcompny.com with a missing a, or yourcopmany.com with two letters swapped. People who read fast often skip them.

Is a word or a hyphen added?

Yes. yourcompany-billing.com or your-company.com can look official to a busy reader, especially when the message asks about an invoice or a payment.

Is the ending different?

Yes. yourcompany.co or yourcompany.net keeps your name and changes only the ending. Check the endings you do not own, not only the ones you already use.

How do I find lookalikes that use my name?

Check on a schedule, and check again after any sign of trouble. Three methods work well together.

1. Search your company name. Search for your name and your main product words, and look at the first pages for sites that are not yours.
2. Look up the closest variants. Use ICANN Lookup to see whether a domain is registered, and which company registered it.
3. Use Ward's lookalike check. Ward looks for registered domains that imitate yours, using the same kinds of changes listed above. Ward's paid plans include this check. It flags a lookalike as high priority when it was registered recently and already has a website or email set up.

Keep a short list of what you find, with the date and the reason you are worried. It makes the next step much faster.

Should I register the lookalikes myself?

Sometimes. Registering the closest variants blocks the easiest copies, especially the .co or .net endings and the most likely typo. It cannot cover every option, so use it together with regular checks.

How do I ask for a lookalike domain to be taken down?

Start with evidence, then go to the company that sold the name. Ward finds the lookalike, but you have to send the reports yourself.

1. Collect the evidence. Save screenshots, the exact web address, the dates and the email headers. Do not enter any details on the site, and do not reply to a suspicious email.
2. Find the registrar. Look up the domain in ICANN Lookup. The registrar is the company that sold the name. Registrars usually publish an abuse contact on their websites.
3. Report it to the registrar. Send the evidence, explain that the domain imitates your company and is used to deceive people, and ask them to take action.
4. Contact the hosting provider. If a website or mail server is live, the host can act too. Send the same evidence.
5. Report the fraud. In the United States, report scams to the FBI's Internet Crime Complaint Center at ic3.gov.
6. For a trademark dispute, use the formal route. ICANN's UDRP process lets a trademark owner file a complaint with an approved dispute-resolution provider. It takes time and has rules, so talk to a lawyer before you start.

Results are not guaranteed, and each company has its own process. A clear, documented report gets the fastest attention.

What does a Ward finding look like?

A Ward finding names the lookalike, the technique used, the date it was registered, and what to do next. It is a warning with the evidence attached.

What if a lookalike is already sending email?

Block the sender's domain in your email filters, and tell your staff and customers that you only use your real domain. Keep the messages and the headers for your records.

Your DMARC record protects only your exact domain, so a lookalike needs the steps above. The DMARC guide shows how to protect your own domain, and our guide to email spoofing explains why both checks matter.

How do I check a suspicious link that uses a lookalike?

Paste the link into Ward Analyzer. The Link tab checks the address without visiting it. It looks at who owns the domain, how old it is, how similar it is to your domains or to known brands, and whether its first certificate is brand new. Analyzer is part of Ward's paid plans, and it never says a link is safe.

What should I do this week?

• Search for your company name and write down any sites or emails that are not yours.
• Check the most likely variants from the table, and decide which ones you should register.
• Tell your staff and billing team what your real domain is, and to be careful with any email from a similar one.
• Set a reminder to repeat the search each quarter.

A lookalike domain often shows up as the front door of a fake invoice. Read the fake invoice scam to see how the payment side works, and how to check a bank detail change before you pay.