Lookalike domain

Fake websites that imitate real brands

A lookalike domain is a web address that imitates a real brand closely enough to trick people who are moving quickly.

brand_lookalike:*lookalike_domain

Internet-ClassWhat is a URL similarity phishing attack?

How to read this alert

Treat this as a signal to slow down and verify the destination, the request, and the audience. The alert does not mean every related page is malicious. It means there is enough risk that the normal click-through habit is not good enough.

The safest response is to separate the message from the account, service, or person it claims to represent. Open the real service from a bookmark, typed address, password manager, or trusted app instead of letting the suspicious page choose the path for you.

What to check before you trust it

The domain contains extra words before or after a trusted brand.
Characters are swapped, doubled, removed, or replaced with similar-looking letters.
The site uses a different top-level domain than expected.
The page copies a known brand's logo, colors, and sign-in layout.

Decision path

1. Name the request

Is the page asking for a login, payment, download, private context, automated action, or approval?

2. Check the evidence

Compare the actual destination, signal tags, sender, and page behavior against what you expected.

3. Choose the safer route

If the request is sensitive or surprising, leave the link and use a known-good path or trusted person.

Examples

RiskypaypaI.example uses a capital I where your eye expects a lowercase L.SaferUse your password manager; it usually will not autofill on the wrong domain.

Riskybrand-support-login.example claims to be a major service.SaferGo to the brand's main site and find support from there.

What to do next

Identify the real domain, not just the brand word inside the URL.
Use a saved bookmark or password manager entry for important accounts.
Do not assume the lock icon means the organization is legitimate.
Report lookalike domains to the impersonated brand or your security contact.

Common mistakes

Reading a domain too quickly and seeing the brand you expected.
Trusting HTTPS alone. A fake site can still have a lock icon.
Ignoring small spelling changes in a mobile browser address bar.

Quick check

Test the decision before you leave

This short quiz stays in your browser. It is meant to reinforce the safe habit, not grade or track you.

1You see a "Lookalike domain" warning. What should you do first?Identify the real domain, not just the brand word inside the URL.Click through quickly if the page looks professional.Enter a small amount of information first to see whether the page works.

2Which clue is most useful for this lesson: "Fake websites that imitate real brands"?The page uses the same colors as a trusted brand.The domain contains extra words before or after a trusted brand.The message says the task is urgent.

3What is the safest habit after a link or page does not feel right?Reuse the same link in a private browser window.Ask the page itself whether it is safe.Do not assume the lock icon means the organization is legitimate.