Someone registered a domain that looks like mine: what to do

What a lookalike domain is

A lookalike domain is one a shopper could mistake for yours: a typo (yourstroe.com), a swapped ending (yourstore.co instead of .com), an added word (yourstore-sale.com), or characters that look alike, such as the number 1 in place of the letter l. Registering these on purpose to catch mistyped traffic is often called typosquatting.

Domains are cheap and easy to register, and anyone can register almost any name that is free. Finding one is not proof that anyone is targeting you.

How to tell a harmless one from a real threat

Visit the domain carefully, ideally from a device you don't use for anything sensitive, and look at what it does. These are usually harmless:

• A parked page with ads or a for sale notice.
• A real, unrelated business that happens to share a word with your brand.
• No website at all.

These are signs of a real threat:

• A shop using your store name, logo, product photos or descriptions, often with prices that look too good.
• A login, checkout or track your order page that asks for passwords or card details.
• MX records set up on the domain. MX records tell the internet where to deliver email for a domain, so having them means the owner can receive mail there, and is often set up to send it too. You can check with dig MX lookalike-domain.com +short.
• A very recent registration date, especially one close to a sale, launch or press mention of yours.

Don't accuse the owner publicly or contact them with threats. Many lookalikes are registered for ordinary reasons, and a public accusation can backfire. Stick to the facts and use the formal reporting routes below.

What to do if it looks like a threat

1. Document everything first. Take dated screenshots of the pages, save the full URLs, and note any email you or customers received from the domain. Sites can disappear quickly once reported.
2. Check the registration details. A WHOIS or RDAP lookup, for example at lookup.icann.org, shows the registration date, the registrar and its abuse contact. Owner details are often hidden for privacy, which is normal.
3. Check Google Safe Browsing. Google's Transparency Report lets you look up whether a site is already flagged as unsafe.
4. Report phishing to Google through its Safe Browsing report form. If Google agrees, browsers that use Safe Browsing show a warning before loading the site.
5. Report to the registrar and the host. Send your evidence to the registrar's abuse contact. If the site runs on a known platform or host, use that company's abuse or trademark reporting form too.
6. Warn your customers if they are being contacted. A short notice on your site or in your emails, saying which address you really use, helps without naming anyone.

If you hold a trademark

The UDRP (Uniform Domain-Name Dispute-Resolution Policy) is a process for getting a domain transferred or cancelled without going to court. It applies to .com and many other endings. You generally need to show three things: the domain is identical or confusingly similar to your trademark, the owner has no legitimate right or interest in it, and it was registered and is being used in bad faith.

Filing has a fee and takes time, so it suits clear cases of abuse. Many country-code endings have their own similar process. A trademark lawyer can tell you whether your case is strong before you pay.

Prevent and watch

• Buy the obvious ones. Registering the main misspelling and the most common other endings for your name is often cheaper than dealing with abuse later. You don't need every variation.
• Protect your real domain's email. A strict DMARC policy stops people faking your actual address, which pushes impersonators onto lookalikes that are easier to spot. See how to tell if someone can send email as your store.
• Watch for new registrations. New lookalikes appear over time, so a one-off check goes stale. Monitoring that flags new ones early gives you time to act before customers are caught.