What is a look-alike domain?

How is a look-alike domain made?

The threat actor may send you a link to a fraudulent website that closely mimics an official site, using deliberate misspellings that look almost identical to a legitimate URL.

Most look-alikes start from your real name and change one small thing. A letter is swapped for one that looks the same, a letter is added or dropped, a hyphen or a word is added, or the ending changes.

Some use letters from another alphabet that look like Latin ones. Others put your name at the front of an address that belongs to someone else.

Why does a look-alike matter to a small firm?

Deceptive phishing is one of the most common types of attack and occurs when a cybercriminal pretends to be a legitimate company to steal your personal information or login credentials.

A look-alike lets someone write to your clients as if they were you, or put up a page that asks for a password. The Cyber Centre says the aim of this kind of phishing is to steal personal information or login credentials.

Clients rarely read an address letter by letter, so a close copy of your name carries the trust you have built.

What can I do about look-alikes?

1. Write down every domain your firm really uses for its website and its email.
2. Tell clients which address your invoices and payment details come from.
3. Register the closest copies of your name yourself and point them at your real site.
4. Confirm any change to payment details by phone, on a number you already have.