What the finder checks
- Typos: a missing, doubled or swapped letter, or a neighbouring key (
examplbank,exampelbank). - Lookalike characters:
rnform,0foro,1orlfori, and internationalised letters that look the same (homographs). - Other extensions: the same name on .net, .co, .online, .shop, .com.tr and other popular endings.
- Added words: “login”, “secure”, “support”, “verify” and their Turkish equivalents, before or after your name.
What to do with the results
A registered lookalike is not automatically a phishing site: some are parked, some are defensive registrations, some belong to unrelated businesses. Check the ones that resolve with the link checker, watch for new certificates and pages, and act on the ones that imitate you. If one is already live, our first 24 hours guide explains the steps.
Want this watched for you, every day?
We monitor new lookalike domains, verify them by hand and take down the ones that turn into phishing sites.