Look-alike domain
Lookalike domain · Spoofed domain · Copycat domain
A look-alike domain is a web address made to pass for a real one at a glance, with a small change you are meant to miss: a swapped letter, an extra word, or a different ending. Scammers register these to host fake login pages and send convincing links, so the address in your browser looks almost right while the site behind it is theirs.
How we check this: Written and reviewed by the Hunch team; recognition signs reflect how the FTC/FBI describe this scam. · Last reviewed: 2026-08
Check a suspicious message now
Example
A message links to "paypa1-secure.com" instead of "paypal.com". The number 1 stands in for the letter l, and the extra word "secure" makes it sound safer. Type your password there and it goes straight to the scammer.
How to recognize it
- The address is close to a brand you know but not exactly right, with a swapped or extra character
- Extra words like "secure", "verify", "login", or "support" bolted onto a familiar name
- An ending you did not expect, like a trusted name followed by an unusual domain
How Hunch flags it
Hunch compares where a link really goes against the brand a message claims to be from, and flags addresses that only resemble the genuine one.
FAQ
How do I spot a look-alike domain?
Read the address slowly, right before the first single slash. Check the exact spelling of the brand name and the ending, and be wary of extra words added to a name you trust.
Is a look-alike domain the same as typosquatting?
They overlap. Typosquatting relies on common misspellings you might type by accident; a look-alike domain is any address built to resemble a real one closely enough to fool you.