Skip to content

Ward opens soon: join the waitlist and we'll email you the day we open.

What Ward checks

Area: Reputation and impersonation

Lookalike domains

Generates variations of your domain (missing, repeated or swapped letters, neighboring keys, look-alike characters, hyphens and other domain endings) finds which of them are registered with a website or email and, for up to 10 that have a website, makes a single visit to the homepage to see whether it copies yours.

What it can report

Open each one to see what it means and how to fix it.

Lookalike domain copying your website

What it means

example-com.com is a domain almost identical to yours, and its homepage pretends to be yours (the same title or your brand name in the title). Ward compared its homepage with yours in a single visit.

What could happen

This is the classic phishing setup: customers or employees believe they are on your website and enter passwords, payment details or orders. The damage lands on your customers and on your name, and it can happen before you notice. It deserves action today.

How an attacker would use it

Someone registers a domain one letter away from yours and copies your homepage. They send customers a message that looks like yours, “update your payment details”, with a link to the copy. The customer sees your logo and your wording, types their card details and the money is gone.

How to fix it

  1. Warn your customers and your team that this address isn't yours.Say clearly which one is the real address.
  2. Report it to the domain registrar and the hosting provider and ask them to take it down.You can find them by looking the domain up with a “whois” or RDAP lookup service.
  3. Report it to the authorities.In the U.S., that means Google Safe Browsing, the FBI's Internet Crime Complaint Center (ic3.gov) and the FTC (reportfraud.ftc.gov).
  4. Block the domain in your email, so nobody on your team receives messages from it.
  5. Save evidence: the address, screenshots and the dates. It helps in a complaint, and for a trademark dispute ICANN's UDRP is the formal route.

How to check it's fixed

The finding stays until the domain stops pointing to a copy of your website. Keep an eye on it: takedowns can take days.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Lookalike domain registered

What it means

eexample.com is a domain almost identical to yours. It doesn't belong to you, as far as we can tell.

What could happen

It may be a legitimate business with a similar name and no relation to you. Still, an email from it could confuse your customers or employees, so it's worth knowing it exists. The severity is low or informational.

How an attacker would use it

A scammer writes to one of your customers from an address that differs from yours by one letter, with an invoice and a new bank account. The customer doesn't notice the swapped letter and pays, and you only find out when your real invoice goes unpaid.

How to fix it

  1. Warn your team and your customers that you only use your real domain, and say which one it is.
  2. Block the lookalike in your email so nobody receives messages from it.
  3. Watch it: if it starts copying your brand or sending mail, ask the registrar or hosting provider to take it down.You can find them with a “whois” or RDAP lookup service. For trademark disputes, ICANN's UDRP is the formal route.
  4. Consider registering the most obvious variations of your own name yourself.
  5. If it's yours or unrelated and harmless, mark it as accepted, with a note.

How to check it's fixed

Ward checks this domain at each scan. The finding disappears if the domain stops being registered or set up, and you can mark it as accepted if it's harmless.

Who usually fixes it

vosotros

Example with sample data. In your dashboard, the explanation uses your own domain and details.