Lookalike Domains and Typosquatting: How to Spot and Respond to a Fake Copy of Your Business Domain

Most owners meet this problem the same way: a customer forwards an email that looks like it came from you, or a friend says “I searched for your site and landed somewhere odd”. The address is almost yours, but not quite. Someone has registered a domain that resembles your business domain, and is using it to catch mistyped visits, to impersonate you, or to ask your customers to pay money to the wrong account. This guide explains how lookalike domains work, how to check whether one exists, what to do in the first hours if it is being used against you, who to report it to, and what actually reduces the risk. It is general information, not legal advice; if money has been lost or you are considering a legal complaint, speak to a qualified adviser.

What a lookalike domain is, and why it works

A domain name is registered on a first-come basis: whoever registers a name first, and keeps it renewed, holds it. There is no central check that a new registration is not confusingly similar to an existing business. That is why anyone can register yourbusines.com or yourbusiness-billing.com in a few minutes, and why the practice has a name: typosquatting when the copy relies on a typing mistake, and the wider term lookalike domain when it relies on a name that merely looks right at a glance.

It works because people do not read addresses carefully. On a phone, the sender name and a shortened address are often all that is visible. A customer who is expecting an invoice from you will not stop to compare nine letters. The copy does not have to be perfect, only convincing for a few seconds.

It is also worth separating this from a different problem. A fake renewal email pretends to come from your registrar and tries to take money for a domain you already own; that is covered in fake domain renewal emails and how to spot them. A trademark conflict is about choosing a name that someone else already holds rights to; that is covered in trademark and business-name conflicts before you register a domain. A lookalike domain is the reverse of both: a stranger imitating your name after you have already built it.

The common patterns

Lookalikes follow a small number of tricks. Knowing them tells you what to search for. The examples below use yourbusiness.com as a stand-in for your own address.

The number of possible variants of even a short name runs into the hundreds. That matters later, when we come to whether you can simply register them all.

What people do with a lookalike domain

Not every lookalike is an attack. The realistic uses fall into four groups, and the right response is different for each.

• Parking and advertising. The domain shows a page of adverts or an offer to sell the name. It profits from mistyped visits. It is annoying and can send your traffic elsewhere, but it is the lowest-risk group.
• A copy of your website. Your logo, photos and text are copied to a page on the lookalike domain, sometimes with changed contact details or a different payment method. This is what makes customers believe they are dealing with you.
• Phishing pages. A page that imitates your login, booking or payment screen to collect passwords or card details. The goal is to harvest information, and the page may only live for days.
• Email impersonation. Messages sent from an address on the lookalike domain, such as an invoice, a “we have changed our bank account” note or a request from someone claiming to be a director. These are often aimed at your customers or suppliers, not at you, which is why you may hear about it second-hand.

An unrelated business that happens to have a similar name, with no copying and no attempt to mislead, is a fifth case and a different matter: that is a naming overlap rather than an attack, and the trademark guide linked above is the better starting point.

How to check whether one exists

You do not need special software to make a useful first pass. Do the following, and write down every address you find rather than clicking around.

1. Search for your business name together with words customers add, such as “login”, “payment”, “invoice” or “promo”. Look past the first page, and check the paid results at the top.
2. Type the likely mistakes yourself into a browser: the missing letter, the doubled letter, the other common endings. Do this on a device where you are not signed in to anything important, and do not enter any details on a page you do not recognise.
3. Check where your own listings point. Your Google Business Profile, social pages and any directory entries should all show your real domain. A wrong link there sends your visitors straight to the copy.
4. Ask staff and customers to forward, not delete, anything odd. Tell them what to look for: a sender address that is nearly yours, or a payment request that arrives with new bank details.
5. Look up a suspicious domain’s registration record. A public registration lookup normally shows the registrar, the date it was created and when it expires. A domain created a few days ago that imitates a business founded years ago is a strong signal. Many registrations hide the owner’s details, so expect to see the registrar and dates rather than a name.
6. Use a lookalike checker if you want more coverage. Free tools and paid services exist that generate likely variants of a name and report which ones are registered, and some also list newly registered domains. Treat their output as a lead to investigate, not as proof of wrongdoing.

Is it actually a problem? A quick triage

Finding a lookalike does not automatically mean you must act. Sort what you found before you spend time on it.

If a fake is being used: the first few hours

Speed matters more than perfection, because a phishing page may be taken down or moved within days. Work through this order.

1. Do not engage. Do not reply to the sender, do not enter anything into the fake page, and do not message the domain owner. You may be handing them a live email address or a reason to move the page.
2. Capture evidence. Take screenshots that show the full address bar and the date. Save the complete web address, the original email (use “forward as attachment” so the headers survive), any bank account number or phone number the fake uses, and the registration details you found. Keep it all in one folder.
3. Warn people through channels you control. Put a short notice on your real website, your social pages and your WhatsApp status or broadcast list. Give the exact real address and the exact email format you use. State the facts only, and avoid accusing a named person or company, since you may not know who is behind the domain.
4. Say what you will never do. If you never ask customers to pay through a link in a chat message, or never change bank details without a call to a number they already have, say so in the notice. That gives customers a rule they can apply even to a fake they have not seen yet.
5. Report it to the places in the next section, starting with the ones that can switch it off fastest.
6. Secure your own accounts if anyone typed a login on the fake. Change the password, turn on two-step sign-in where it is offered and check for sign-ins you do not recognise.

Where to report a lookalike domain

You are asking other organisations to act, so be specific and polite, and attach the evidence. None of them is obliged to remove a site on request, and response times vary, so send several reports in parallel rather than waiting for one.

If the lookalike is a .my domain and you hold a registered trademark, there is a formal dispute process for domain names that conflict with a trademark; the outline is in the trademark guide linked earlier. Whether a complaint can succeed depends on the facts, including whether you hold a registered trademark and whether the domain was registered in bad faith, so take advice before relying on it. A dispute process is also slower than reporting a phishing page, so do both.

Reducing the risk before it happens

You cannot stop someone registering a lookalike. You can make it less effective and spot it sooner.

• Use one address everywhere. Put the same domain on invoices, quotations, social pages, signatures and printed material. Customers who know your one real address notice when another appears.
• Authenticate your own email. SPF, DKIM and DMARC stop other people sending mail that claims to come from your exact domain. They do not stop mail from a lookalike, which is a different domain, so they help but are not a complete answer. The settings are explained in business email on your own domain.
• Protect the real domain. Keep it locked against transfer (see domain lock explained), use a strong unique password and two-step sign-in on the registrar account, and keep the account email address one that you still read. An unlocked domain or a hijacked account is a worse problem than any lookalike.
• Renew on time. If your own domain lapses, anyone can register it, and that is the most convincing lookalike of all. See how to never miss a domain renewal and what happens when a domain expires.
• Make sure you are the registrant. If an agency or former colleague holds the registration, you cannot act quickly when something goes wrong. See who owns your domain name.
• Set a payment-change rule. Any request to change bank details is confirmed by phone, on a number already on file, before anything is paid. This single habit defeats most email impersonation, whatever domain it comes from.
• Hold a short list of variants, not all of them. A few defensive registrations can be sensible: the same name with the other ending you actually use, and the one or two most obvious misspellings if your customers really do mistype. Because the possible variants run into the hundreds, buying them all is neither affordable nor effective, and each one still has to be renewed every year. Spend the effort on checking and on warning customers instead.

Common mistakes

• Trying to register every variant. You will never keep up, and new ones can appear the next day.
• Paying a stranger who offers to sell you the lookalike. A payment encourages the next one, and a deadline in the message is a pressure tactic.
• Visiting and entering details on the fake to “test” it. Take screenshots and leave it alone.
• Deleting the evidence. The original email, its headers and the dated screenshots are what the registrar and host will ask for.
• Telling customers only after a loss. A short warning on day one costs nothing.
• Accusing a named person. You often do not know who runs the domain; describe what the page does.
• Assuming email authentication covers it. It protects your exact domain, not a domain that only resembles it.
• Relying on one report. Report to the registrar, the host and Google together.

Where Gotka Technologies fits

Gotka Technologies provides the domain side of the protection steps above. Domain registration starts from RM10/year and includes free transfer-in, domain lock and privacy protection, so your own registration can be locked against unauthorised transfer. Domain lock and privacy protection apply to domains you register with us; they do not stop another party registering a similar name, which is why checking and warning customers matter. If you decide to hold a second ending or a close spelling, you can register it in the same place as your main domain. For a business site that needs a home, cloud hosting runs AI-powered cPanel plans on LiteSpeed servers with free SSL, daily backups, free migration, 24/7 support and a 99.9% uptime guarantee, from RM17.80/month for Go AI Lite on the 36-month plan. A specific tier price is always tied to its billing cycle, and hosting and domain are quoted separately. Keep the registrant record in your own business’s name.

Key terms used in this guide

• Typosquatting: registering a domain that relies on a typing mistake, such as a missing or swapped letter, to catch visits meant for another site.
• Lookalike domain: a domain that resembles another at a glance, whether through spelling, extra words or a different ending.
• Phishing: a fake page or message designed to trick someone into giving a password, card details or a payment.
• Registrar: the company through which a domain is registered and managed.
• Registrant: the person or company recorded as the holder of the domain.
• Registration lookup (WHOIS): a public record showing a domain’s registrar and key dates, and sometimes the holder’s details.
• Abuse contact: the address or form a registrar or host publishes for reporting misuse.
• Domain lock: a setting that blocks a domain being transferred to another registrar until you unlock it.
• SPF, DKIM and DMARC: email settings that help prove a message really came from your domain.
• Impersonation: pretending to be a person or business, for example through an email address that looks like theirs.