How to spot a lookalike domain

A lookalike domain is a web address built to imitate a trusted brand with small spelling changes, extra words, or swapped characters, so a fake site can pass for the real one.

Why lookalike domains work

People do not read web addresses letter by letter. We glance and match the shape to a brand we know. Scammers register an address that looks close enough, put a copied login page on it, and wait. Anyone can copy a logo, but nobody else can own the real address, so the address bar is your most reliable check.

The one part that matters

The owner of a site is the word right before the ending (.com, .net, .org). In login.paypal.com the owner is paypal. In paypal.secure-login.com it is secure-login, and paypal is just a word placed early to catch your eye.

Common tricks to watch for

• Misspellings. One changed, added, or missing letter: paypa1.com, netfliix.com, amazonn.com.
• Swapped characters. A zero for the letter o, or the number one for a lowercase L: g00gle.com, paypa1.com.
• Letters from other alphabets. Characters from other writing systems that look like ordinary letters, so the name reads as "apple" but is not. This is called a homoglyph.
• The brand as a subdomain. microsoft.login-verify.com puts the trusted name first, while the real owner is login-verify.
• Official-sounding extra words. secure, verify, support, or billing bolted onto a brand: apple-support-billing.com.

How to protect yourself

• Before you type a password, read the address from the ending backward and check the owner.
• Reach important sites yourself: type the address or use a bookmark, not a link in a message.
• A password manager fills your login only on the exact address it saved, so its silence on a familiar-looking page is a warning.
• Slow down when a message pushes urgency.

Fish Catcher reads the address for you and warns in plain words when it finds a misspelled brand, lookalike characters, or a brand buried in a long subdomain. It never blocks the page.

Common questions