How to find lookalike domains impersonating your business

A lookalike domain is a name registered to be mistaken for yours. It can catch people who mistype your address, or it can be used on purpose in phishing emails and fake shops that copy your site. Finding them early gives you time to warn customers and report the ones that are clearly abusive.

How lookalike domains are made

• Typos: a missing, doubled, or swapped letter (exmaple.com, examplle.com).
• Neighbouring keys: a letter replaced by one next to it on the keyboard.
• Look-alike characters: rn for m, 0 for o, 1 or l for i.
• Internationalised names: letters from other alphabets that look identical, such as a Cyrillic “а” in place of a Latin “a”. Browsers often show these in their encoded xn-- form to reduce the risk.
• Other endings: your name on .net, .co, .shop, or a country ending.
• Added words: example-login.com, example-support.com, secure-example.com, or an added hyphen.

How to find them

1. Generate the variations. Write down the patterns above for your main domain, or use a generator. Open-source tools such as dnstwist do this systematically.
2. Check which ones exist. A variation only matters if it is registered and resolves. Look up its DNS: an A or AAAA record means it can host a website, and an MX record means it can send and receive email, which matters for phishing.
3. Look at what they serve. Many registered lookalikes are parked pages or for sale. The worrying ones copy your logo, text, or login page.
4. Watch certificate logs. Every publicly trusted https certificate is recorded in Certificate Transparency logs. Searching those logs (for example on crt.sh) for your brand name shows new domains soon after they get a certificate.
5. Repeat. New lookalikes appear over time, so this works best as a regular check, not a one-off.

Signs a lookalike is being used against you

• The homepage copies your design, text, or product photos.
• It has a login, payment, or “verify your account” form.
• It has mail records and your customers report emails that looked like yours.
• It was registered recently and got a certificate soon after.

A parked page or an unrelated business with a similar name is usually not an attack. Be careful with accusations; a similar name alone proves nothing.

What you can do

• Keep evidence: screenshots, the date, DNS records, and any emails that used the domain.
• Report phishing pages to Google Safe Browsing so browsers start warning visitors.
• Report abuse to the domain’s registrar and to the hosting provider. Their abuse contacts are listed in the domain’s registration (RDAP or WHOIS) data.
• If you hold a trademark, dispute processes such as the UDRP can transfer abusive domains to you. A lawyer can tell you whether it fits your case.
• Warn your customers about how you do and do not contact them.
• Consider registering the most likely typos of your own domain yourself.
• Protect your real domain with SPF, DKIM and DMARC. They stop others from sending email as your exact domain, though they do not stop a different, lookalike domain.

How Gmork helps

For verified sites, Gmork generates up to 150 lookalike domains across common patterns and endings, looks up their DNS, and compares the live ones with your real homepage. It lists them with a similarity score and says they may be impersonating you, without accusing anyone. On paid plans the hunt runs daily.