Menu

Impersonation

1 way to gain visibility of lookalike websites

1 way to gain visibility of lookalike websites

< BLOG

1 way to gain visibility of lookalike websites

There is 1 way to gain visibility of lookalike websites before they become somebody else’s problem: actively monitor web addresses that resemble your business name, brand, domain or trading identity.

That sounds obvious, but many small businesses only discover an impersonating domain after a customer reports a suspicious email, a supplier queries altered bank details, or a prospect says they have found a website that “looks a bit like yours”. By that stage, the damage may already be underway.

A lookalike domain does not have to be a perfect copy of your website to create a problem. It may swap one character, add a hyphen, use a different domain ending, or place an extra word before or after your name. To a busy customer reading an email on a phone, that can be enough to create confusion.

Is there more than 1 way to gain visibility of lookalike websites?

Yes – however they are far more technical and garner enterprise level pricing. That’s why The TLD Project was created, to give small business owners the ability to protect their company’s name and reputation.

Why lookalike websites matter

A web address that resembles yours can be used in several harmful ways:

  • To send phishing emails that appear to come from your business.
  • To direct customers to a convincing imitation of your website.
  • To collect login details, payment information or personal data.
  • To impersonate your staff or suppliers during invoice-payment fraud.
  • To damage your reputation through misleading, offensive or fraudulent content.
  • To divert enquiries, sales leads and customer trust away from your genuine business.

The financial impact is not always direct or immediate. A customer who is tricked by a fraudulent site may not understand the difference between the criminal and the legitimate company. They may associate the experience with your name, lose confidence and tell others. For a smaller company, where trust is often personal and hard won, that reputational cost can be significant.

The problem with waiting

The usual approach is reactive. Someone spots a suspicious domain, screenshot or email and forwards it internally. The business then tries to work out whether the web address is connected to them, whether it is live, who registered it and what can be done.

That delay matters.

A domain can be registered long before it is used. It may sit quietly for weeks or months, then be activated when a fraudster is ready to send emails or publish a copied page. If nobody is looking, there is no early warning and no opportunity to prepare evidence, warn staff or advise customers.

This is why 1 way to gain visibility of lookalike websites is more valuable than relying entirely on chance discovery. Visibility does not stop a domain being registered, but it gives your business a chance to understand the risk before it becomes a customer-facing incident.

More than one route exists

Is there more than 1 way to gain visibility of lookalike websites? Yes. Large organisations can use specialist threat-intelligence platforms, security operations teams, domain-brand protection services and enterprise monitoring tools.

Those options can be useful, particularly for companies with global brands, large attack surfaces and dedicated security staff. But they are often technical, time-consuming to configure and priced for enterprise budgets.

Small businesses need something different: a straightforward way to see potential lookalike web addresses without needing to become a domain-security specialist.

Start with the names that matter

The most useful monitoring begins with the identifiers criminals are most likely to imitate:

  • Your main company domain.
  • Your trading name and registered business name.
  • Key product or service names.
  • Common misspellings.
  • Variations with hyphens, extra words or alternative domain endings.
  • Names of senior people where they are publicly associated with the business.

For example, a business using examplebusiness.co.uk should not only be concerned about an exact copy. Domains such as example-business.co.uk, examplebusiness.uk, examplebusinessltd.com or a subtle character substitution may all be capable of misleading someone in the right context.

The aim is not to assume every similar domain is malicious. Many will be harmless, unrelated or legitimately owned. The point is to avoid operating blind.

Turn awareness into response

Finding a suspicious address is only the first step. A sensible response should assess whether the domain is live, whether it hosts copied or harmful content, whether it is being used in email, and whether customers or staff need to be warned.

Keep a record of what you find. Capture the web address, date, screenshots and any associated emails. If action is required later, clear evidence makes it easier to report abuse to the relevant registrar, hosting provider, email service or platform.

The TLD Project provides 1 way to gain visibility of lookalike websites without requiring enterprise-level tooling. At £54 per year, it is designed to give smaller businesses a practical starting point: awareness of potentially confusing web addresses that may otherwise go unnoticed.

Do not wait for a complaint

The most damaging lookalike website is not necessarily the one that looks most convincing. It is the one you do not know exists until after it has been used against a customer, supplier or member of staff.

If your business name has value, it can be copied. 1 way to gain visibility of lookalike websites is to make monitoring part of protecting that value—before confusion becomes fraud, and fraud becomes reputational damage.

1 way to gain visibility of lookalike websites
The TLD Project: Empowering everyone to take professional action.

Deceptive-website activity

Deceptive-website activity

< BLOG

Deceptive-website activity: why every organisation should pay attention

Deceptive-website activity is not only a problem for household-name brands. Any organisation with a website, customers, members, suppliers or online accounts can be imitated through a similar-looking web address.

A business may have strong security around its website, email and online systems. It can use multi-factor authentication, train staff and protect its own domain name. Yet it cannot prevent somebody else registering a domain that looks close enough to confuse a customer, member or supplier.

That gap matters.

How deceptive websites work

A deceptive website often begins with a lookalike web address. A criminal registers a name that resembles a legitimate organisation’s domain, perhaps by adding a hyphen, changing one character, using a different domain extension or adding a word such as “secure”, “login” or “support”.

The website itself may copy the genuine organisation’s branding and login page. It may be used in scam emails, text messages or social-media posts that encourage people to sign in, update payment details or contact a fraudulent address.

The organisation being impersonated may not know the domain exists until a customer reports it—or until damage has already been done.

A risk beyond major brands

Large brands are visible targets, but deceptive-website activity affects organisations of every size. Smaller businesses, charities, associations and membership bodies can be especially attractive because they often depend on trusted relationships and regular online communication.

A convincing email appearing to come from a familiar organisation does not need to reach thousands of people to cause harm. One fraudulent payment request, a stolen member login or a fake event-registration page can create financial loss, support workload and reputational damage.

The method is accessible. Registering a domain is inexpensive, publishing a basic website is quick, and copied branding can make a false page look credible enough for someone acting in a hurry.

What the latest data shows

Global phishing activity remains at a high level. The Anti-Phishing Working Group recorded around 3.8 million phishing attacks in 2025, slightly higher than the 3.76 million recorded during 2024. In the first quarter of 2026, it recorded 971,181 attacks, up 13.8% from the previous quarter. Its reporting includes bogus websites and deceptive domain names used to impersonate trusted organisations.

These figures do not prove that every deceptive website uses a lookalike domain, nor do they measure attacks against small organisations separately. They do, however, show the scale of the wider environment in which website impersonation operates.

The sensible conclusion is not that every organisation will be targeted. It is that deceptive-website activity is persistent, inexpensive for criminals and difficult to spot without looking for it.

Monitoring the risk

Organisations should treat their domain name as part of their identity, not simply a technical setting. Monitoring for similar domains can identify possible impersonation earlier, before a misleading site is used in a scam or false login page.

When reviewing a suspicious domain, ask:

  • Does it closely resemble your organisation’s name or web address?
  • Is it resolving to a live website, redirecting elsewhere or sending email?
  • Does it use your branding, services, staff names or contact details?
  • Is it being used to request passwords, payments or personal information?
  • Is there evidence that customers, members or suppliers have been contacted?

Not every similar domain is malicious. Some will be inactive, unrelated or legitimately owned. The important point is to have visibility, assess what is found and act where there is a genuine risk.

A practical response

The TLD Project helps organisations monitor lookalike web addresses and take practical action when suspicious domains appear. It is designed to make a technical problem easier to understand, assess and address.

Deceptive-website activity sits outside the control of the genuine organisation—but it does not have to remain outside its awareness.

Deceptive-website activity
The TLD Project: Empowering everyone to take professional action.

Brand Impersonation

Brand Impersonation: How Fake Domains Damage Customer Trust

< BLOG

Brand Impersonation: How Fake Domains Damage Customer Trust

Brand Impersonation is when a criminal uses your business name, domain, logo, staff identity, or website content to persuade people they are dealing with the real company. A fake domain gives the scam a believable address for email, a copied website, a payment page, or a support message. Even when the fraud happens outside your systems, customers can associate the loss with your business—damaging the trust you have worked to build.

A criminal uses your name. Your customers blame you.

Your business may have done nothing wrong. Your website has not been hacked. Your email account has not been compromised. Yet a customer receives a scam message carrying your name, clicks a fake link, or pays a fraudulent invoice.

Their first question is likely to be: “Why did your company send this?”

That is the commercial harm caused by Brand Impersonation. The attacker borrows the reputation you have earned and places it inside a false online identity. The customer often cannot see where your real business ends and the criminal operation begins.

For SMEs, trust is not an abstract marketing term. It is built through recommendations, repeat orders, supplier relationships, reviews, and years of reliable service. A fake domain can put that trust at risk in a single email.

That is why The TLD Project helps businesses see where their identity may be copied online and take professional action when there is evidence of abuse.

Brand Impersonation

Brand Impersonation is the false use of a company’s name, identity, products, services, or visual assets to deceive people.

A fake domain often provides the foundation. It can make an email address look genuine, host a copied website, create a believable payment link, or give a fraudulent social-media advert somewhere to send visitors.

The attacker may imitate:

  • Your company name or trading name.
  • Your domain name or a close variation.
  • Your logo, colours, photography, wording, and website design.
  • Your products, prices, services, and contact details.
  • Your staff names, job titles, signatures, and email style.
  • Your invoices, payment process, support channels, or login pages.

Brand Impersonation is not limited to global names. A local business, specialist supplier, SaaS provider, consultancy, retailer, contractor, or professional firm can all be imitated if people know and trust the name.

When a brand, organisation, or service is falsely represented online, it is commonly described as Brand Impersonation or Brand Infringement.

How customer trust is damaged

Trust depends on consistency. Customers learn to recognise your website, emails, products, payment process, and customer-service approach.

A fake domain disrupts that recognition.

Someone may receive an email from a similar-looking address and assume it is yours. They may visit a copied site, pay for an order, enter their details, or click a link they believe is safe. When they discover the fraud, they may not understand the difference between the real business and the impersonator.

The result can be:

  • Complaints about products or orders you never sold.
  • Chargebacks and payment disputes linked to a fraudulent site.
  • Negative reviews from people who believed they bought from you.
  • Customers ignoring genuine emails because they fear another scam.
  • Suppliers questioning legitimate changes to payments or account details.
  • Staff spending time explaining, investigating, and reassuring people.

The criminal’s objective may be money or information. The cost to your business is confidence.

Why fake domains are effective

A fake domain allows an attacker to make their communications appear connected to your business without accessing your real systems.

They might register yourbrand-support.com, yourbrand-shop.com, yourbrand-payments.com, or an address that differs from yours by one letter. They can then create email addresses, build a cloned page, or send customers to a fraudulent checkout.

The goal is not always a perfect copy. It is a believable one.

An attacker may use your name with a word that fits the message: “support” for a customer-service scam, “delivery” for a parcel fraud, “accounts” for an invoice request, or “secure” for a fake login alert. They rely on the recipient seeing the familiar part of the address and not the detail that proves it is false.

Fake domains, copycat websites, and fraudulent messages are common infrastructure for phishing and brand-related fraud.

Protecting the relationship with customers

You cannot stop every criminal from registering a new domain. You can make it easier for customers to know what is real.

Publish a simple page listing your official domains, email addresses, payment process, social accounts, and support channels. Explain how customers can independently verify a payment request or account message. Make reporting easy by providing a dedicated contact route for suspicious messages or websites.

When impersonation occurs, communicate clearly and promptly. State what is happening, which address or message is fraudulent, what customers should not do, and how they can reach you through a verified route. Avoid technical language where it does not help; the priority is helping people make a safe decision.

This approach helps customers distinguish a warning from a marketing email and gives them a reliable way to check future messages. Guidance on brand-impersonation response similarly emphasises clear customer notification, official-channel verification, monitoring, evidence collection, and takedown action.

What to do when your brand is copied

Record the evidence before the content changes. Save the full domain and URL, screenshots of copied pages, fake emails and headers, advert links, payment details, false contact information, and reports from affected customers.

Assess the scale of the issue. Is the domain only registered, or is it sending emails, copying your site, collecting payments, or asking for credentials? Has it reached customers, suppliers, or staff? Are there related domains using the same name or pattern?

Then report the activity through the providers enabling it: the domain registrar, host, email platform, payment provider, advertising service, search engine, or social platform. A targeted report that shows impersonation and potential harm is more useful than a general claim that a domain looks similar to yours.

The TLD Project helps SMEs monitor brand-related domains, identify false online identities, collect evidence, and respond to Brand Impersonation before it causes wider damage.

Brand Impersonation
The TLD Project: Empowering everyone to take professional action.