Lookalike Domains Impersonating Your Business: Find and Remove

What lookalike domains are and why DMARC does not stop them

Criminals register domains that differ from yours by a character or two, then use them for fake invoices, payment change requests, fake login pages or copied shop sites. Common patterns:

SPF, DKIM and DMARC let receiving servers reject mail that pretends to come from your exact domain. A lookalike domain is a different domain, often with its own valid SPF and DKIM, so it passes those checks. Our SPF, DKIM and DMARC guide is still worth following, because it closes the easier route of spoofing your real domain.

How to find lookalike domains before customers do

You will not catch everything, but a simple routine finds most active lookalikes.

• Generate variations: the open-source tool dnstwist creates typo, homoglyph and extension variants of your domain and checks which are registered. Run it monthly, or ask your IT provider to.
• Watch email security alerts: Microsoft 365 and Google Workspace flag messages from new or unusual domains; check what your filters quarantine.
• Listen to customers and staff: many lookalikes are found when a customer asks whether an invoice is real. Make it easy to forward suspicious emails to one address.
• Search for your brand: search engines, social ads and marketplaces for copies of your logo, name and product photos. Our guide to fake social media ads covers that side.
• Register the obvious ones yourself: if you are yourco.sg, owning yourco.com.sg and yourco.com costs little and removes the easiest variants.

Takedown: who to report a lookalike domain to

Report to several parties at once. Registrars and hosts can remove the domain or site; browser and email providers can block it while that happens.

1. 1

   Collect evidence first

   Screenshot the site, save the phishing email with full headers, note the date and time, and record the URL exactly. Do not enter any details into the fake site.

2. 2

   Look up the registrar and host

   Use ICANN Lookup for .com and most other domains, or the WHOIS search on sgnic.sg for .sg. Note the registrar and its abuse email; find the hosting company from the site's IP address.

3. 3

   Email the registrar's abuse contact

   ICANN's registrar abuse page says accredited registrars must keep an abuse contact and investigate reports. Explain the impersonation briefly and attach evidence.

4. 4

   Report to the hosting provider

   Hosts usually remove phishing pages faster than registrars suspend domains. Use their abuse form or email.

5. 5

   Report to browsers and email providers

   Submit the URL to Google Safe Browsing and Microsoft's unsafe site report so Chrome, Edge and their mail services warn users.

6. 6

   Tell SingCERT

   Email SingCERT at singcert@csa.gov.sg with the evidence. If customers lost money, they should also make a police report.

Warn customers without causing panic

If the lookalike is sending invoices or messages, customers need to hear from you the same day.

Keep the tone calm and factual. Do not include links in the warning email itself if you can avoid them; tell people to type your address.

Getting the domain transferred: SDRP and UDRP

Suspension stops the immediate attack. If the same domain keeps coming back, or you want it permanently, use a dispute process.

Both work better if you own a registered trademark for your name. If you rely on your brand online, it is worth registering one with IPOS.

Reduce the damage next time

You cannot stop someone registering a similar name, but you can make it far less useful to them.

• Publish DMARC at p=reject so nobody can spoof your exact domain as well.
• Agree a payment verification rule with customers and suppliers: bank detail changes are confirmed by phone.
• Turn on external sender warnings in Microsoft 365 or Google Workspace so staff see when mail comes from outside.
• Train staff to check the full sender address, not the display name; our phishing guide shows what to look for.
• Include this scenario in your incident plan, alongside the controls in the Cyber Essentials checklist.

Do it yourself or get help?

A single fake domain can be reported in under an hour with the steps above. Ongoing monitoring, filtering and staff alerts take more set-up and are easy to let slip.

Our Email Threat Protection service (S$290, paid upfront) sets up impersonation protection, external sender warnings and DMARC enforcement in Microsoft 365 or Google Workspace. Domain & DNS Setup (S$99) can register defensive variants and tidy your DNS.