Anatomy of a lookalike web address
Anatomy of a lookalike web address
A lookalike web address is not always an obvious typo. It can be a carefully chosen domain that looks legitimate at a glance, particularly when it appears in an email, WhatsApp message, advert or search result. For example, a business trading from yourbusiness.com could be impersonated using something as similar and simple as yourbusiness.org – something as simple as a change of the domain name extension is all it takes.
On a small screen, in a busy inbox, or when someone already expects to hear from your business, the difference can be easy to miss. The purpose is simple: make a customer believe they are dealing with you when they are actually dealing with a fraudster.
How the impersonation works
The anatomy of a lookalike web address diagram above shows a common route from a newly registered lookalike web address to an active impersonation scam.
1. A lookalike web address is registered
The process often begins when somebody registers a domain that resembles your trading name, brand or genuine website address. The address may use a missing letter, added word, different extension or subtle character change.
Registering a domain does not automatically mean it is malicious. Businesses buy variations of their own names for legitimate reasons, and some names overlap naturally. However, a newly registered domain becomes a concern when it closely resembles your business and is later used to copy your identity, website or communications.
This is why early domain monitoring matters. A suspicious registration can be investigated before it is fully turned into a fraudulent website or campaign.
2. Your website content is copied
A fraudster may copy visible parts of your genuine website, including:
- Your logo, colours and branding
- Product or service descriptions
- Contact details and staff names
- Images, testimonials and company information
- Terms, privacy wording or page layouts
A copied website does not need to be perfect to be convincing. Many people will only look at the page they landed on, particularly if they arrived through a message that appears to come from a trusted business.
3. Fake website and email infrastructure is activated
The lookalike domain can then be used to host a fake website or create email addresses that appear connected to your business.
For instance, an attacker may send from an address that looks broadly correct, such as accounts@yourbusiness-support.co.uk, then direct the recipient to a website that uses your branding. They may also use WhatsApp messages, paid adverts or social-media messages to push people towards the fake site.
The National Cyber Security Centre notes that phishing messages can direct people to malicious websites or trick them into revealing sensitive information or transferring money.
4. Customers are directed to the fake website
Recipients may receive what appears to be a normal message: an invoice reminder, delivery update, quotation, password reset, recruitment contact, customer-service reply or urgent payment request.
The message is designed to exploit familiarity. If the business name looks right, the email seems plausible and the website resembles the genuine one, the recipient may not inspect the web address closely.
At that point, they believe they are contacting your business.
5. Details, payments or enquiries are captured
The fake site may include an enquiry form, login page, checkout, payment instruction or contact number. A customer may submit their details, disclose account credentials, send payment information or begin communicating directly with the fraudster.
The consequences can include:
- Stolen passwords or personal information
- Diverted invoice payments
- Fraudulent orders or payment requests
- Lost customer enquiries and sales
- Damage to trust in your brand
- Time-consuming complaints, investigations and takedown requests
Why early detection matters
A lookalike domain is easiest to investigate before it has been promoted, indexed, used in phishing emails or turned into a convincing copy of your website. Monitoring cannot prevent every impersonation attempt, but it gives your business a better chance to spot suspicious domains early, preserve evidence and decide whether action is needed.
If a fraudulent domain is already impersonating your organisation, the NCSC advises identifying the domain registrar and locating its abuse-reporting process. Technical controls such as SPF, DKIM and DMARC can also make it harder for criminals to spoof email sent from your genuine domain. Should you wish to better understand the anatomy of a lookalike web address and how to join The TLD Project please do contact us as our team are always happy to assist.
