Your Link Has a Twin: A Half-Day Audit for Impostor Domains

You spend ages choosing a tidy short domain. It is memorable, it fits on a leaflet, and it looks reassuring in an email. Then someone registers a near-identical version and starts using it to catch people who are moving a bit too quickly. That is the awkward truth about short links: the shorter and more brand-like they are, the easier they are to impersonate.

This is not only a problem for global banks. UK councils send residents to booking pages, charities push donation links through Facebook, and retailers put short URLs on packaging and till receipts. A single swapped character can send someone to a fake payment page, a bogus refund form or a survey that harvests personal details. The good news is that a focused audit can find most of the obvious impostors in half a day.

Start with the domain people actually type

Pull out every short domain your organisation uses. Not just the main one. Include campaign domains, legacy domains, agency-owned domains and anything printed on a poster in the last two years. For each one, write down the exact spelling, the TLD and the paths you promote most often.

If your main short domain is something like cuturl.co.uk, the first variants to check are the boring ones: cuturl.co, cuturl.uk, cuturl.com, cuturl.net and cuturl.org. Then look at hyphenated versions, missing letters, doubled letters and plural forms. A domain like cuturl.co.uk can also be mimicked with a subdomain that looks official, such as cuturl.co.uk.security-check.example, so do not assume the bit before the first dot is the only thing that matters.

The variants worth checking first

You do not need to hunt every possible combination. Start with the ones that real people mistype or misread:

• TLD swaps: .co, .uk, .com, .org, .net, .shop and .app.
• Hyphenation: cut-url.co.uk, cuturl-uk.co.uk, cuturl.co.uk-help.example.
• Character swaps: rn for m, vv for w, l for I, 0 for O, and 1 for l.
• Homoglyphs: Cyrillic letters that look like Latin ones, especially in а, е, о, р and с.
• Extra words: -secure, -login, -support, -verify, -refund and -official.
• Path-level tricks: a lookalike domain that copies your /login, /donate, /booking or /refund paths.

Write these down in a spreadsheet with columns for the variant, registrar, creation date, nameservers, current content and action. That sounds dull. It is also the difference between a vague worry and a usable record.

Where to look, and what to note

For .uk domains, Nominet is the place to start. For other TLDs, use the registry or a WHOIS/RDAP lookup. Domain availability checkers are fine for a quick pass, but they are not an audit trail. Record what you find: registrar, registration date, expiry date, nameservers, mail exchange records and whether a website is live.

Certificate transparency logs are useful here. Services such as crt.sh can show certificates issued for a domain, which sometimes reveals lookalikes that are being set up for phishing before they appear in search results. Also check whether the domain has a live site, a parked page, a redirect or a mail server. A parked domain is not automatically hostile. A live login form is a different matter.

Do a few manual searches too. Search for your brand name in quotes alongside words like login, refund, support and verify. Check the domain in a browser with a safe preview tool rather than clicking through from an email. Take a screenshot and save the URL, date and time. If something looks like phishing, do not fill in the form to test it.

Read your own click data like a suspicious editor

Your analytics can show signs that someone is using your brand elsewhere. Look for referrers from domains you do not recognise, unusually high direct traffic to pages that do not exist, and contact centre reports about strange links. Search Console query reports can reveal misspellings of your brand that people are typing into Google. If you run email campaigns, check link click maps and see whether any clicks are landing on unexpected hostnames.

One caution: click data is evidence, not proof. A lookalike domain may be run by a clumsy competitor, a domain investor or a confused supplier. Treat it as a lead and verify before you escalate.

Reclaim, block or just watch

If a domain is parked and doing nothing, monitor it. If it is impersonating your organisation, report it to the hosting provider and registrar. In the UK, the NCSC Suspicious Email Reporting Service is useful for phishing emails, and Action Fraud takes reports of fraud. For .uk disputes, Nominet has a dispute resolution service. For generic TLDs, there is the UDRP process. Trademark action is rarely a DIY job, so take advice before firing off legal letters.

On the defensive side, add known lookalikes to email gateway blocklists and web proxy rules. Warn frontline staff and customer service teams. If a variant is cheap and plausible, registering it and redirecting it to the real page can be sensible. Do not buy hundreds of domains out of panic; pick the ones that match how your audience actually types and reads.

Habits that make impersonation harder

Use one clear branded short domain for public campaigns, and keep it consistent. Avoid characters that are easy to confuse in print: rn and m, 0 and O, l and I. If a link has to go on a poster, a till receipt or a radio script, read it aloud to someone who has not seen it. Add a QR code as a backup where space allows. In email, check the link preview text and make sure the visible words match the destination. A mistyped link on a printed leaflet cannot be corrected after the fact, so the domain has to do the work before it goes to press.

A short audit checklist

• List every short domain and campaign path you use.
• Check TLD swaps, hyphens, character swaps and homoglyphs.
• Record registrar, creation date and current content for each hit.
• Use certificate transparency logs and manual searches.
• Review analytics for strange referrers and brand misspellings.
• Report phishing; monitor parked domains; buy only sensible defensive registrations.
• Add known impostors to email and web blocklists.
• Test printed and emailed links for misreading before they go out.

A half-day spent on this will not make you untouchable. It will make you a much harder target, and it will give you a record you can act on when a familiar-looking link turns up where it should not.