Guide · Brand impersonation
What is a look-alike domain?
By the SENTLOCK team · Updated
Short answer
A look-alike domain is a web address registered to imitate a real brand's domain closely enough that a customer mistakes it for the genuine site. Attackers use them to host cloned login pages, send phishing messages and run payment fraud. Because they live outside the brand's network, the firewalls and email filters inside the company never see them.
How do attackers build look-alike domains?
- Typosquatting
- A dropped, doubled or swapped letter: examplebank.com becomes exmplebank.com or examplebnak.com.
- Homoglyphs
- Characters that look identical, such as a Cyrillic "а" in place of a Latin "a", or "rn" standing in for "m".
- Combosquatting
- The real name plus a plausible word: examplebank-secure.com, examplebank-login.net, examplebank-support.com.
- TLD swaps
- The same name under another ending, such as .co, .net, .app or a country code.
- Subdomain tricks
- The brand name placed in front of someone else's domain, as in examplebank.com.account-check.net. The registered domain is the part at the end.
Why are banks and fintech companies prime targets?
Financial brands combine what an attacker wants most: customers who expect to log in online, credentials and one-time codes that turn straight into money, and a trusted name that makes an email or SMS look routine. A convincing look-alike can be registered and online quickly, so the gap between registration and the first victim is short.
What are the signs that a domain is impersonating a brand?
- It was registered very recently, often with privacy-protected registration details.
- It has a freshly issued TLS certificate. Free certificates take minutes to get, so the padlock proves nothing.
- Its DNS and hosting have no connection to the brand's real infrastructure.
- Its pages copy the brand's logo, colours and login form.
- It shows different content depending on who is visiting. That is cloaking, and it is built to fool scanners.
How can you detect look-alike domains before customers do?
Detection has to happen outside your network, by watching the open internet for new domains that resemble your brand. Each candidate then needs checking, because many similar names are harmless. SENTLOCK runs every candidate through eight independent checks, from registration records to what the page actually shows a customer, and fuses them into one verdict. See how the eight layers work.
What should you do when you find one?
- Preserve the evidence first: screenshots, URLs, registration details and certificates. Phishing pages move fast.
- Report the domain to the registrar's and the hosting provider's abuse desks.
- Submit it to browser safe-browsing and anti-phishing blocklists, so visitors are warned even before it comes down.
- If customers are already being targeted, warn them through your official channels.
- Keep watching. A site that is taken down often returns under a new name.
See which look-alikes target your brand
Run the free instant check on your domain, or request early access for continuous monitoring.
