Menu

Monitoring

See Who Is Copying Your Website

See Who Is Copying Your Website

< BLOG

See Who Is Copying Your Website

You work hard to build a website that represents your business properly. It carries your name, branding, content, products, services and contact details. But could you confidently say if someone else is using a similar web address and copying it?

For most businesses, the answer is no. There is no automatic alert when a lookalike domain is registered, a copied website goes live or someone starts using your branding to appear connected to your business.

That creates a visibility problem. You cannot deal with a copied website if you do not know it exists.

A copied website does not always look identical

It may reuse parts of your content, copy your layout, use your business name or borrow recognisable branding. It may sit on a web address that differs only slightly from your genuine one.

The aim is often to look credible at a glance.

A customer may search for your business, see a similar result or click a link without noticing the small difference in the address. They may assume the site is yours because the name, wording or appearance looks familiar.

That is why checking only your own registered domains is not enough.

The problem sits outside your control

You can register defensive web addresses, protect access to your website and keep your official site secure. Those are sensible steps.

What you cannot do is prevent every third party from registering a similar address. There are too many possible combinations, including alternative endings, small spelling changes, extra words and character substitutions.

You also cannot rely on customers or staff spotting every copied website. Some may never see it. Others may see it but assume it is legitimate. Without ongoing monitoring, a copied website can remain unnoticed until someone reports it — if they report it at all.

Ongoing monitoring gives you visibility

To see who is copying your website, you need a way to identify potentially relevant web addresses and check what is being displayed on them.

Ongoing monitoring helps highlight addresses that may be similar to yours and shows whether they are being actively used. It gives you evidence to review rather than leaving you to search manually or discover an issue by accident.

The questions are simple:

  • Is a similar web address being used?
  • Is there a live website behind it?
  • Does it copy your name, branding, content or contact details?
  • Could visitors reasonably think it belongs to your business?
  • Does it need action?

Not every similar address is harmful. Many are inactive, unrelated or of no concern. Monitoring is not about treating every result as a crisis. It is about seeing enough, early enough, to make an informed decision.

Act to take harmful sites down

Finding a copied website is only the first stage. The next question is what to do about it.

Takedown action involves gathering evidence, identifying the right provider or platform, submitting a clear report and following up when needed. For a small business, that can be difficult to navigate while also running the day-to-day operation.

Practical takedown helps turn monitoring into a response. Where a site is harmful and there is a basis to act, you have support to raise the issue with the appropriate parties and pursue its removal.

If you come across a website that appears to be a scam, the UK’s National Cyber Security Centre also provides a free service to report a suspicious website. You may also report to Google. Avoid entering information or clicking links on the site; copy the web address instead.

Find out before customers do

You cannot stop every lookalike web address from being registered. But you can see who is copying your website, assess the risk and take action when it matters. That is the difference between discovering a problem by chance and having the visibility to respond properly.

See Who Is Copying Your Website
The TLD Project: Empowering everyone to take professional action.

5 Step Domain Monitor and Takedown

5 Step Domain Monitor and Takedown

< BLOG

5 Step domain monitor and takedown

When a business is targeted by a fake-domain impersonation attack, the most critical period is often the time between a lookalike domain being registered and anyone noticing it.

A 5 Step domain monitor and takedown process gives businesses a practical way to identify suspicious domain names, assess the potential risk, collect evidence and take action when a genuine threat is confirmed.

A convincing lookalike domain can be used to imitate a company’s website or email address, mislead customers and suppliers, redirect payments, or support phishing and invoice-fraud campaigns.

Step 1:

Create a free account

Step 2:

Add your domain

Step 3:

Fake domains identified

Step 4:

Promote fake to case

Step 5:

Generate takedown emails

No fake website. No threat. Right?

There may be no fake website pretending to be your business. No one may appear to be targeting your customers, suppliers or employees. No one may seem to be using your name to damage the reputation you have worked hard to build.

Or are they?

That is the real-world problem with domain impersonation. It is often invisible until someone notices a suspicious email, a customer questions a payment request, or money has already been sent to the wrong bank account.

A business may have no reason to believe it is being impersonated simply because it has not yet discovered the fake domain. Finding out early can mean the difference between an organised response and complete shock.

Why criminals register similar domain names

Criminals register lookalike domain names because they can use them to make fraud appear legitimate.

A domain that closely resembles a genuine business web address can be used to create a convincing fake website, send emails that appear to come from the company, or support messages sent to customers, suppliers and employees. The aim is usually financial gain: persuading someone to disclose information, change payment details, make a fraudulent payment or trust a request that appears to come from a known business.

The difference can be small: a missing letter, an added hyphen, a different domain extension or a character that is easy to overlook. Yet that small variation can make a fraudulent email address or website look authentic at a glance.

A low-cost crime with lasting consequences

Registering a similar domain name can cost very little. The potential financial and reputational consequences for the targeted business, however, can be significant.

A successful impersonation attempt can lead to financial loss, disrupted supplier relationships, customer complaints, internal investigation costs and lasting damage to trust. Even where fraud is stopped before money is lost, the business may still need to warn contacts, investigate what happened, preserve evidence and begin reporting the domain to the relevant providers.

The purpose of a 5 Step domain monitor and takedown process is not to assume that every similar domain is malicious. It is to give a business a clear way to identify potential impersonation, assess the evidence and act quickly when a genuine threat is confirmed.

Domain impersonation is not always obvious. The question is not only whether a fake domain exists today, but whether you would know quickly enough if one was registered and used against your business.

5 Step Domain Monitor and Takedown
The TLD Project: Empowering everyone to take professional action.

Domain Monitoring

Domain Monitoring: Finding Fake Versions of Your Website Early

< BLOG

Domain Monitoring: Finding Fake Versions of Your Website Early

A fake domain often has a short window in which it is merely a registration, not yet an active scam. That window is valuable. It allows a business to notice unusual use of its name, record the details, and decide whether the domain deserves attention before an attacker adds a copied website, email service, or payment page. Domain monitoring turns an unexpected customer complaint into an earlier, more controlled decision.

The first complaint is too late.

Many businesses find a fake domain only after a customer has paid a fraudulent invoice, entered details into a cloned login page, or received a scam message that appears to come from the company.

By then, the attacker has already used the domain.

Domain Monitoring changes the point at which you discover the risk. Instead of relying on a customer to spot a fake address and report it, you watch for domain registrations that resemble your name or services. A suspicious domain can be reviewed when it is registered, before it appears in an email campaign, advert, QR code, social-media profile, or copied website.

The principle is simple: you cannot assess a domain you do not know exists.

That is why The TLD Project gives SMEs a practical way to watch for brand-related domains without the cost or complexity of enterprise brand-protection services.

Domain Monitoring

Domain Monitoring is the continuous discovery, comparison, and review of domains that may be connected to your business name.

It starts with your legitimate domains, trading names, product names, and key services. It then looks for domains that are identical, similar, or contextually misleading.

This can include:

  • Misspellings and transposed letters.
  • Missing, repeated, or substituted characters.
  • Hyphenated versions of your name.
  • Brand names combined with words such as “login”, “support”, “payment”, or “secure”.
  • Domains using another TLD or country extension.
  • Lookalike characters and internationalised domain names.
  • Names that combine your business with a location, service, product, or department.

Security services such as CISA’s Domain Doppelgänger look for similar “evil twin” domains to identify possible phishing domains and typosquatters. That illustrates the central purpose of Domain Monitoring: identifying potentially deceptive addresses before their purpose is obvious.

What monitoring is—and is not

Domain Monitoring does not mean every matching domain is malicious.

A similar name may belong to an unrelated business, legitimate reseller, franchisee, customer, or company operating in another sector. It may have been registered years before your business existed. A matching word in a domain does not prove impersonation.

Monitoring provides visibility. The investigation determines risk.

A sensible review asks:

  • Does the domain resemble your genuine name closely enough to confuse someone?
  • Does it use a high-risk word such as login, account, payment, support, or delivery?
  • Is it active, redirecting, configured for email, or hosting content?
  • Does it copy your branding, products, business details, or customer journey?
  • Has it been used in a message, advert, invoice, QR code, or social profile?
  • Is there evidence of a false claim of association with your business?

This prevents two common mistakes: ignoring a dangerous domain because it has no visible website, and treating every similar registration as fraud.

Why early discovery matters

A domain can be registered long before it is used. Attackers may prepare several options, test different names, and only activate the one that works best for a campaign.

Early discovery gives you time to document the registration, review its configuration, identify connected infrastructure, and build a record of the risk. If the domain later becomes active, you already have the timeline and evidence needed to respond quickly.

It can also reveal patterns. One suspicious domain may be an isolated registration. Several domains using the same brand with “support”, “login”, “billing”, “secure”, or different extensions may indicate deliberate preparation for impersonation.

Organisations that study DNS abuse continuously combine registration data with security-threat feeds to identify domains connected with phishing, malware, spam, and botnet activity.

What should an SME monitor?

Start with the assets that people associate with your business:

  • Your primary domain and known alternative domains.
  • Your company name and trading names.
  • Key product, service, or platform names.
  • Customer portal and login terminology.
  • Finance, invoicing, payment, and support language.
  • Major locations, regions, or markets.
  • Common abbreviations and frequent misspellings.

Then prioritise the variations most likely to be used against you. A business that sells online should focus on shop, store, orders, delivery, tracking, returns, and refund terms. A professional-services business may prioritise payment, invoice, accounts, client portal, and secure-document variations. A SaaS business may watch for login, account, dashboard, app, support, and verification terms.

This is more useful than a generic list because it reflects the ways your customers, suppliers, and staff already interact with you.

From discovery to action

When you find a suspicious domain, preserve the information before it changes. Record the exact domain, registration date where available, DNS records, screenshots, redirects, copied pages, sender addresses, and related messages.

Classify the finding:

  • Low concern: Similar name with a plausible independent use and no evidence of impersonation.
  • Watch: Brand-related domain with a high-risk pattern but no active abuse.
  • High risk: Domain used for copied content, false affiliation, email fraud, payment requests, credential capture, or malicious redirects.

A domain in the “watch” category may need continued monitoring rather than immediate reporting. A high-risk domain needs a clear evidence package and a prompt response through the relevant registrar, host, email provider, search engine, advertising platform, or payment provider.

The TLD Project helps SMEs discover brand-related domains across TLDs, assess likely impersonation risk, preserve evidence, and move from monitoring to professional action when it matters.

Domain Monitoring
The TLD Project: Empowering everyone to take professional action.