Fake Websites and Lookalike Addresses

Why a fake site can look perfect

Copying a website’s appearance is easy. Page layout, logos and wording can be saved and reused in minutes. What cannot be copied is the real address, because each web address belongs to one owner. So scammers do the next best thing: they register an address that looks close enough to the real one that a quick glance does not notice the difference. These are often called lookalike domains.

The fake page then asks for what the scammer wants, usually a login, card number or personal details, or it sells goods that never arrive.

How a web address is built

To spot tricks, it helps to know how to read an address. Take https://www.shop.example.com/account/login. The important part is the registered domain, here example.com, which sits immediately before the first single slash, with the final two parts (name and ending) read together. Everything to the left (www.shop.) is a subdomain chosen freely by whoever owns example.com. Everything after the slash is just a path on that site.

This is the part scammers exploit: the real owner is identified by the end of the name, not the start. An address such as example.com.account-check.net does not belong to example.com at all. It belongs to account-check.net, and the first words are decoration.

Names are matched to server locations by the domain name system, which simply looks up whatever address is typed. It does not judge whether a name is deceptive.

Common lookalike tricks

• Misspellings (typosquatting). A missing, swapped or doubled letter, such as exmaple.com for example.com. These also catch people who mistype an address directly.
• Similar-looking characters. The letter “l” and the capital “I” can look alike in some fonts, and “rn” next to each other can resemble “m”.
• Extra words. example-support.com, example-login.com or secure-example.com. The real brand name appears, but the domain is different.
• Different endings. example.co or example.shop instead of example.com. Many businesses use other endings legitimately, which is why this works.
• Brand in the subdomain. example.secure-pay.net places the familiar name at the front, but the owner is secure-pay.net.
• Non-Latin lookalike letters. Some alphabets contain letters that appear nearly identical to Latin ones. Browsers have protections that often display such names in a special form, but these are not perfect.
• Shortened links. A link shortener hides the destination entirely until you click.

Where fake sites come from

Fake pages are rarely found by chance. People usually arrive from a link in an email, a text, a social media post or an advert, or via a search result that was promoted. The pages that phishing emails and smishing texts point to are commonly lookalikes. Fake online shops often use heavily advertised discounts, and some stay up only briefly before disappearing and reappearing under another name.

Because the link is the usual route, the safest habit is to avoid arriving through the message at all.

How to check a site

No single check is conclusive, so combine several.

1. Read the domain carefully. Find where the first single slash is and read the name directly before it. Say the letters aloud if needed.
2. Do not rely on the padlock. The padlock only means the connection is encrypted. Scammers can and do obtain such certificates for fake sites. It does not show that the site is trustworthy.
3. Go in through a route you control. Type the address yourself, use a saved bookmark or open the official app, rather than following a link in a message.
4. Check the search result carefully. Results marked as adverts can include impostors. Look at the actual domain shown, not just the title.
5. Be cautious on a phone. Mobile browsers often show only part of an address, which makes tricks harder to see. Pressing and holding a link usually reveals the full destination before you open it.
6. Look for what feels off. Odd prices, missing contact details, no clear returns policy or only unusual payment methods are all worth noticing, though a polished fake can avoid all of them. Some of these points overlap with how online shopping works generally.
7. Use a password manager. A password manager will normally fill in saved logins only on the exact address where they were saved. If it does not offer your login on a site that looks identical, treat that as a warning. This is one of the more reliable automatic checks.
8. Consider a browser extension with a good reputation for blocking known malicious sites. It can help, but it only covers sites already identified.

Newly registered sites

Fake sites are often very new. Some tools can show when a domain was registered, and a recently created address pretending to be a long-established company is a warning sign. This is a clue rather than proof; new businesses exist, and old domains can be hijacked.

If you already entered details

Act quickly. If you typed a password, change it on the real site and on any other site where you reused it, then enable two-factor authentication if it is available. If you entered card details, contact your card provider. If you paid for goods from a site that now looks suspicious, tell your bank or card provider promptly. The steps in scam recovery steps cover reporting and follow-up in more detail.

A useful rule: a message that rushes you toward a login page deserves a closer look at the address bar than it feels like it needs.