Free check, no sign-up

Who is pretending to be you?

Attackers register a domain that looks like yours, then email your customers from it. This finds the look-alikes that already exist. Nothing is logged.

Privacy: runs only in your browser, so we never see the domain you check.

How it works

We generate the domains an attacker would register against you: a dropped letter, a doubled letter, two letters swapped, a neighbouring key, a hyphen, a look-alike character from another alphabet, a word like secure or invoice bolted on, and the same name on every common ending. Then we ask public DNS which of them exist.

What matters

  • Can send mail. The domain has mail servers. Someone can email your staff, customers and suppliers from an address that reads almost like yours.
  • Has a website. Often a parked page or a copy of yours, used for phishing logins.
  • Registered only. Taken but not in use. Sometimes yours, sometimes an investor, sometimes waiting.

What this cannot tell you

It reads DNS only. A registered look-alike is not proof of anything: some will be yours, some belong to domain investors, some to unrelated businesses. It cannot see a domain that exists but hides from DNS. Treat the list as leads to check, not a verdict.

Why look-alikes work

Nobody reads a sender address letter by letter. On a phone the domain is often hidden behind a display name, and accounts@yourcompany-co.za or yourcornpany.co.za passes a glance. The usual play is a supplier invoice with new bank details, or a reply into a real email thread the attacker has already seen.

Why DMARC does not stop this

SPF, DKIM and DMARC protect your exact domain. They stop someone forging yourcompany.co.za, which you can test with the email spoofing check. A look-alike is a different domain that the attacker owns, so it can pass all three checks perfectly. Mail filters let it through for the same reason: technically, nothing is wrong with it.

What to do if you find one

  1. Rule out your own. Ask whoever manages your domains. Old campaign or regional domains often turn up here.
  2. Warn the people who pay and get paid. If a look-alike can send mail, tell your finance team, and your key customers and suppliers, to confirm any change of bank details by phone on a number they already have.
  3. Report it. Send an abuse report to the registrar and the web host. For a .co.za name used in bad faith, the ZADNA alternative dispute resolution process can transfer it to you; most other endings use the UDRP.
  4. Register the closest ones. A handful of the most convincing variants costs less than one paid fake invoice.
  5. Screen inbound mail for them. SIFT flags senders one letter off from a real contact, and display names that do not match the address behind them.