OSINT & Digital Exposure Intelligence
How to find look-alike domains that copy your brand
Look-alike domains are used in phishing. Learn how to spot ones that copy your brand, what to check and how to report them.
A look-alike domain is a web address that copies your brand name closely enough to fool a customer. Criminals use them for fake login pages, fake invoices and fake support emails. You can look for them yourself, free, by checking variants of your own brand name.
This post covers only your own brand. It shows how to check for look-alikes, how to decide which ones matter, how to report them, and how to make them less useful to a scammer. It does not cover how to build one, and you should never look for domains that belong to someone else's brand.
What a look-alike domain is
Suppose your business is called Sharma Traders and your site is sharmatraders.example. A look-alike is a different domain that a hurried reader would take for yours. The owner is not you, and the site or email behind it is not yours either.
Many are registered to trick people, but not all. Some belong to a company with a similar name, a fan, a reseller or a domain investor. That is why the first step is to look at what the domain is doing, not to assume the worst.
Common types
These are the patterns to think about when you list variants of your own brand:
- Typing slips. A missing, doubled or swapped letter, such as
sharmatradrsorsharmatradders. - Extra words. Your name plus a word that sounds official, such as
-support,-login,-paymentsor-india. - Other endings. The same name under a different ending, such as
.co,.in,.netor a newer one, when you only own the.com. - Look-alike letters. Letters or characters that look alike on screen, such as a capital I and a lowercase l, or the digit 0 and the letter o. Some domains use characters from other alphabets that look the same as English letters.
- Hyphens and spacing.
sharma-tradersagainstsharmatraders.
Write your own list of variants in a spreadsheet, using your brand name and the words customers associate with you. This list is the base for every check below.
How to check for ones that already exist
You do not need paid software to start. Work through your list in this order.
- Search the web for your brand and each variant. Put the name in quotes and look beyond the first page. Look for sites that copy your logo, text or product photos.
- Try each variant in a browser. Type it in yourself. If it loads, note what it shows. If it shows nothing, note that too.
- Search at your registrar. Your registrar's domain search will show whether a variant is taken. A taken name does not mean it is hostile, but it tells you where to look.
- Ask your customers and staff. People often spot a fake before any tool does. Add a line to your support page asking customers to forward suspicious messages.
- Check your email reports. If you set up DMARC reporting (see below), the reports show who sends mail that claims to come from your domain.
- Repeat every month or two. New domains appear all the time. Put it in the calendar.
For a small brand, this routine is enough to catch the obvious cases. Paid monitoring services exist. Compare their official pages and terms yourself if you want one, and be careful that any service you use checks only your brand.
Which ones matter most
Do not panic over every registered variant. Sort what you find like this:
| What you see | Priority | Why |
|---|---|---|
| Live site copying your logo, text or login page | High | Customers can be tricked now |
| Domain that sends or is set up to send email | High | Fake invoices and payment requests use email |
| Site asking for passwords, OTPs or payments | High | This is phishing |
| Domain for sale or parked with ads | Medium | May be resold to someone harmful, or may be harmless |
| Registered, but shows nothing | Low | Keep watching |
| Similar name, clearly a different real business | Low | May need a lawyer if it hurts your trademark, not a takedown |
To find out whether a domain is set up for email, ask whoever manages your DNS to look up its mail records. This is a read-only lookup of public records for the variant of your own brand that you already found.
Always keep proof. Take a screenshot with the date and the web address visible, and save the page address and any email headers. Do not enter any real details into the suspect site.
How to report and request removal
Start with the party closest to the problem.
The registrar
ICANN's abuse reporting page (opens in a new tab) explains that registrars must publish an email address for abuse reports on their website. They must also provide abuse contact details in Whois results, and take reasonable and prompt steps to investigate and respond to reports. Look up the domain's registrar, then send your evidence to its abuse contact. If the registrar does not meet those duties, the same page points to a Registrar Standards Complaint Form. For a site's content, report to the registrar and to the hosting provider.
The hosting provider
The page's host is often a different company from the registrar. Its abuse contact is usually on its website. Report the same evidence there.
Google Safe Browsing
For a phishing page, use Google's page for reporting to Safe Browsing (opens in a new tab). Google also links to this form from its help page on phishing sites (opens in a new tab).
Authorities in India
If customers lost money or the scam targets people in India, report it on the Government of India's National Cybercrime Reporting Portal (opens in a new tab). CERT-In (opens in a new tab), India's national computer emergency response team, is the government body for cyber incidents. Check both sites for the current way to report, because details change.
A registrar may ask for more proof before it acts. Report to the registrar, the host and Google at the same time, and keep your evidence ready.
Protect your own domain
You cannot stop everyone from registering a similar name. You can make the abuse harder and the damage smaller.
Register the variants that matter. Buy the obvious other endings and the most likely typing slips of your brand. Do this selectively, because each one is a yearly cost. Turn on auto-renewal for the ones you keep.
Set up email authentication on your own domain. SPF and DKIM show that a message really came from servers you approved. DMARC then tells receiving mail servers what to do with messages that fail those checks. Google's DMARC setup guide (opens in a new tab) recommends starting with the policy p=none, which only monitors, and moving to quarantine or reject once your own mail passes. It also says to turn on SPF or DKIM first.
This protects your exact domain from being forged. It does not stop a scammer using a different, look-alike domain, which has its own mail records. So it is one layer, not the whole answer.
Tell your customers how you contact them. On your site, say which address you send invoices from and that you never ask for passwords or OTPs by email or message.
When to get help
Get help when a fake site is live and customers are being tricked, when a registrar ignores your report, when you do not know who manages your DNS, or when you want the whole picture of where your brand appears online. Your lawyer should handle trademark questions.
Hackers Family runs OSINT and digital exposure checks that cover domains, brands and accounts you own, including look-alike domains of your brand. Findings are ranked by risk, each with a clear fix. We only check what you own.
