Skip to content

Ward opens soon: join the waitlist and we'll email you the day we open.

What Ward checks

Area: Reputation and impersonation

Lookalike domains

Generates variations of your domain (missing, repeated or swapped letters, neighboring keys, look-alike characters, hyphens and other domain endings) finds which of them are registered with a website or email and, for up to 10 that have a website, makes a single visit to the homepage to see whether it copies yours.

What it can report

Open each one to see what it means and how to fix it.

Lookalike domain copying your website

What it means

example-com.com is a domain almost identical to yours, and its homepage pretends to be yours (the same title or your brand name in the title). Ward compared its homepage with yours in a single visit.

What could happen

This is the classic phishing setup: customers or employees believe they are on your website and enter passwords, payment details or orders. The damage lands on your customers and on your name, and it can happen before you notice. It deserves action today.

How an attacker would use it

Someone registers a domain one letter away from yours and copies your homepage. They send customers a message that looks like yours, “update your payment details”, with a link to the copy. The customer sees your logo and your wording, types their card details and the money is gone.

How to fix it

  1. Warn your customers and your team that this address isn't yours.Say clearly which one is the real address.
  2. Report it to the domain registrar and the hosting provider and ask them to take it down.You can find them by looking the domain up with a “whois” or RDAP lookup service.
  3. Report it to the authorities.In the U.S., that means Google Safe Browsing, the FBI's Internet Crime Complaint Center (ic3.gov) and the FTC (reportfraud.ftc.gov).
  4. Block the domain in your email, so nobody on your team receives messages from it.
  5. Save evidence: the address, screenshots and the dates. It helps in a complaint, and for a trademark dispute ICANN's UDRP is the formal route.

How to check it's fixed

The finding stays until the domain stops pointing to a copy of your website. Keep an eye on it: takedowns can take days.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Lookalike domain registered

What it means

eexample.com is a domain almost identical to yours. It doesn't belong to you, as far as we can tell.

What could happen

It may be a legitimate business with a similar name and no relation to you. Still, an email from it could confuse your customers or employees, so it's worth knowing it exists. The severity is low or informational.

How an attacker would use it

A scammer writes to one of your customers from an address that differs from yours by one letter, with an invoice and a new bank account. The customer doesn't notice the swapped letter and pays, and you only find out when your real invoice goes unpaid.

How to fix it

  1. Warn your team and your customers that you only use your real domain, and say which one it is.
  2. Block the lookalike in your email so nobody receives messages from it.
  3. Watch it: if it starts copying your brand or sending mail, ask the registrar or hosting provider to take it down.You can find them with a “whois” or RDAP lookup service. For trademark disputes, ICANN's UDRP is the formal route.
  4. Consider registering the most obvious variations of your own name yourself.
  5. If it's yours or unrelated and harmless, mark it as accepted, with a note.

How to check it's fixed

Ward checks this domain at each scan. The finding disappears if the domain stops being registered or set up, and you can mark it as accepted if it's harmless.

Who usually fixes it

vosotros

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Lookalike domain for sale

What it means

example-com.com is a domain almost identical to yours, and its page is a parked or for-sale page. It doesn't copy your website: nobody is using it to pretend to be you right now.

What could happen

The risk is for later: whoever buys the domain could use it to impersonate you, with fake emails to your customers or a copy of your site. For now it's only information: it doesn't count toward the score or send alerts.

How an attacker would use it

A scammer buys the domain when it goes on sale, sets up email on it and writes to your customers from an address one letter away from yours, with an invoice and a new bank account.

How to fix it

  1. If the brand matters to you, consider buying the domain yourself.Check the price on the page where it is for sale; compare it with what an incident would cost you.
  2. If you want to get ahead of it, block the domain in your email filter: if someone buys it and writes from it, the messages won't arrive.
  3. Beyond that, there's nothing to do. Ward checks it at each scan and will alert you if it changes hands or starts being used.

How to check it's fixed

Ward visits the page at each scan. The finding disappears if the domain stops being for sale or stops existing, and it changes if it starts copying your site.

Who usually fixes it

vosotros

Example with sample data. In your dashboard, the explanation uses your own domain and details.