How Brand Impersonation Works
Impersonation domains do not need to be convincing at a glance — they need to survive a half-second look. The common tricks are all variations on one idea: put the real brand name somewhere in the domain where a hurried reader will see it, while the part that actually decides ownership — the registrable domain — belongs to someone else. A domain such as brand-login.example can look like the brand's login page until you notice that the registrable domain is example, not the brand.
The tricks this checker looks for
- Prefix / suffix: the brand plus extra words, such as brand-support or support-brand.
- Trust keywords: login, secure, verify, support, or official added to sound legitimate.
- Brand in a subdomain only: brand.evil.example is owned by evil.example.
- Near-miss spelling: one or two characters changed, such as a missing or swapped letter.
- Digit lookalikes: 0 for o, 1 for l, 5 for s.
- Punycode: xn-- hiding lookalike Unicode characters.
- An unexpected top-level domain for a brand you know as .com.
What to do with a suspicious domain
Do not open it from the link you were given. If you need the brand's site, type its address yourself or use a bookmark you already trust. If the domain is impersonating a brand you manage, report it to the registrar and the brand's security team, and record the evidence with the incident report builder.