Fix guides

Deal with lookalike domains

A lookalike domain is one letter away from example.com, or has a word added, and is used to send invoices or login pages that seem to come from you. You can't stop someone registering one, but you can make it much less useful to them.

Who does this
You, with help from your IT provider for the email step.
How long
An hour for the first four steps.
Fixes
  • Lookalike domains got a security certificate in the last 90 days
  • Domains look like yours, but nothing new

  1. Check none of them are yours

    Agencies and past staff sometimes register variants for campaigns or to protect the brand. Ask before assuming the worst.

  2. Look them up without visiting them

    Don't log in or type anything on a lookalike site. Use ICANN Lookup instead: it shows when the domain was registered, which registrar it is with, and that registrar's abuse contact.

    A domain registered in the last few weeks, with a certificate, and not yours, is one being prepared for use.

  3. Warn the people who would be targeted

    Tell staff, especially whoever pays invoices, the exact domains to watch for. Tell regular customers too if you handle their money. The rule that stops most of this fraud: never change bank details because of an email; confirm by phone on a number you already have.

  4. Report it

    If the domain is impersonating you, email the registrar's abuse contact from ICANN Lookup, with the domain, what it is doing, and screenshots or forwarded emails as evidence. If it hosts a phishing page, report that page to Google Safe Browsing so browsers start warning visitors.

    For a domain that uses your trademark, a lawyer can take it through the formal dispute process. That is slower, but it can transfer the domain to you.

  5. Consider registering the obvious variants yourself

    The most likely typos and the other common endings (.co, .net, and your country's) are cheap to hold. Point them at your website, and publish the no-email records from the email spoofing guide on them so they can't be used to send mail either.

Check it worked

Perimeter keeps watching. A lookalike counts as new for 90 days after its certificate was issued, then moves from "Action needed" to "Needs a look" while it stays on the list.

The provider's own instructions

Menus move. If a step here doesn't match what you see, these pages are the source of truth.