A fake version of your website can do real damage: it collects your customers’ passwords or card details, sells counterfeit products, or simply makes your brand look untrustworthy. These sites usually live on a lookalike domain, a web address that is one small change away from yours.

Common lookalike tricks

  • Misspellings: a missing, doubled or swapped letter (for example yourbrnad.com).
  • Lookalike characters: a zero for the letter o, the number 1 for the letter l.
  • Other endings: yourbrand.net, yourbrand.shop, or a country ending.
  • Added words: yourbrand-login.com, yourbrand-support.com, yourbrandbd.com.
  • Subdomains: yourbrand.something-else.com, which looks like yours at a glance.

How to find them

You can check likely variations by hand, but there are many of them. DrutoScan’s Brand watch generates the common lookalike variations of your domain every day, checks which ones are actually live, reads what each page says, notices if it asks for a password or is just parked, and checks when its first security certificate was issued. A brand-new certificate on a page that uses your name and asks for a password is a strong warning sign.

Before you report: save evidence

  • the exact address, and the address it redirects to,
  • screenshots of the pages, especially login or payment pages,
  • the date and time,
  • any emails, ads or messages that link to it.

Who to report to

  1. The hosting company. A WHOIS or RDAP lookup shows who hosts the site. Send a short abuse report with your evidence. If the site is behind a service such as Cloudflare, report to that service; it forwards reports to the real host.
  2. The domain registrar. The registrar (shown in the same lookup) has an abuse contact and can suspend domains used for phishing or fraud.
  3. Google Safe Browsing. Report phishing pages so browsers show a warning to visitors.
  4. The platforms where it is advertised or linked.
  5. Copyright or trademark routes if the site copies your content or logo. See our DMCA guide.
Phishing is handled fastest. Hosts and registrars act quickly on clear phishing, especially when your report includes a screenshot of the fake login or payment page.

If the domain itself is the problem

When someone registers a domain that copies your trademark in bad faith, you can ask for the domain to be transferred to you through the domain dispute process, the UDRP for most global endings, run by providers approved by ICANN. It costs a fee and takes some weeks, so it makes sense mainly for persistent or high-risk domains.

Tell your customers

Publish your one real web address on your social profiles, and tell customers you will never ask them to log in through a link in a message.

Frequently asked questions

Can I get a fake website taken down if it is hosted in another country?

Often yes. Hosting companies and registrars worldwide act on clear phishing and fraud reports, and Google Safe Browsing warnings work everywhere.

What is the UDRP?

The Uniform Domain-Name Dispute-Resolution Policy, an ICANN process for transferring domains registered in bad faith that copy a trademark.