Look-Alike Domains: How Copycats Spell a Brand
A copycat site only needs a name that looks right at a glance. Read the address from right to left and most of these tricks stop working.
Read the address from right to left
Every web address has a part that says whose site it is, plus decoration. This method finds the part that counts. The examples use a made-up brand, Example Club, at exampleclub.com.
- Cut off the end. Start after
https://and stop at the first slash, question mark (?) or hash (#). What follows picks a page. It does not pick the site. - Drop anything before an @. The browser ignores everything up to an @ sign. The real address is what follows it.
- Drop a port. A colon and a number, such as
:8443, is not part of the name. - Find the ending. The last bit after the final dot is the ending, such as
.com,.inor.xyz. A few have two parts, such as.co.in. - Take one word to the left. That word plus the ending is the site. Anything further left is a sub-name, which the owner can set to anything, even a famous brand’s name.
- Compare letter by letter with the address you already know.
A worked example is https://login.exampleclub.com.example-host.xyz/play. Cut at /play. The ending is .xyz and the word to its left is example-host, so the site is example-host.xyz. The words login, exampleclub and com are sub-names that the owner of example-host.xyz chose. This is not Example Club.
The login link checker does steps 1 to 5 for you and prints the result as “The site this link belongs to”. It knows the usual two-part endings such as .co.in and .com.ng, so login.exampleclub.com.ng comes out as exampleclub.com.ng. A rare ending it does not know can still make it show too little. If the line is only an ending, count one more word to the left yourself.
Nine tricks, shown with a made-up brand
The last column shows how the checker treats a name it has no entry for.
| Trick | Made-up example | How to catch it | What the checker does |
|---|---|---|---|
| An added hyphen | example-club.com | The name has a hyphen the real one lacks | Nothing for one hyphen. Two score 8 points, three or more 20 |
| Swapped or doubled letters | exampelclub.com | Spell the name out letter by letter | Nothing |
| A digit for a letter (1 for l, 0 for o) | examp1eclub.com | A digit inside a word | Nothing, unless the name holds seven digits or more (12 points) |
| Extra words | exampleclub-login.com | The real address has no such words | 12 points for words such as login, verify, bonus, claim or wallet, and for free, gift, update or secure when they stand alone between hyphens or dots. None for app, apk or vip |
| A different ending | exampleclub.xyz | The last part differs | 15 points for about three dozen cheap endings such as .xyz and .top. None for .co or .net |
| The brand among another site’s sub-names | exampleclub.com.example-host.xyz | Right to left, the site is example-host.xyz | Only the ending here (15 points). Three sub-names or more add 20 |
| The brand after the slash | example-host.xyz/exampleclub.com/login | The address ends at the first slash | Only the ending (15 points) |
| Look-alike letters from another alphabet | xn--exmpleclub-0qi.com | Looks identical on screen. Browsers keep it in this xn-- form | Medium: the look-alike letters score 30. Honest names in other alphabets look like this too, so look closer |
| An @ sign | exampleclub.com@example-host.xyz | The real address is what follows the @ | 60 points: High on its own |
The platform’s name is the one it knows
The checker has no entry for Example Club, which is why the first three rows pass without a mark. It does hold one platform name: the platform this site covers. It strips every dot, hyphen and other mark from the site part of an address and looks for that name written out in a row. If the name turns up in any address except the one the platform’s own help page names (at the time of writing), it adds 30 points, enough for Medium on its own.
Take Example Club as its stand-in.
- Caught:
example-club.org(a hyphen),theexampleclubapp.in(extra words),exampleclub.xyz(another ending), andexampleclub.com.example-host.xyz(the name among sub-names). - Missed:
exampelclub.com(swapped letters),examp1eclub.com(a digit for a letter) andexample-host.xyz/exampleclub.com/login(the name after the slash).
Look-alike letters and the @ trick have marks of their own, so what slips through is a misspelling, or the name placed after the slash. This site’s own address contains the platform’s name too, so at the time of writing the checker marks it as well. Paste it from your address bar and see. The name alone proves nothing about who runs a site, and we are an independent site, not the platform.
Try it: same site or not?
Is each of these on the same site as exampleclub.com? Decide, then read the answers.
| Address | Same site? |
|---|---|
https://www.exampleclub.com/ | Yes. www is a sub-name on the same site. |
https://exampleclub.co/ | No. The ending is .co, not .com. |
https://exampleclub.com@example-host.xyz/ | No. The real address is what follows the @. |
https://exampleclub.com.example-host.xyz/ | No. The site is example-host.xyz. |
When you still cannot tell
Do not guess. Type the address you already know, or use a link from the platform’s own page or app. At the time of writing (8 October 2026), the platform’s own help-centre guide on verifying links describes a link verifier: you paste a link you were sent, and a confirmation pop-up appears only if it is one of the platform’s links. Nothing happens if it is not. This tool cannot do that check, because it cannot see who runs a site. Finding the right link goes through the guide. Already typed details on a page you doubt? After a scam lists the next steps.
Common questions
Does https or a padlock show that I am on the real site?
No. https means the connection is encrypted, and anyone can get it for a domain they control, including a look-alike. The checker marks plain http as a warning sign, but an https address can still be a copy.
How can an address look right and still be a different site?
Only the part just before the ending says whose site it is. Hyphens, extra words, swapped letters, other alphabets and long chains of sub-names can all make a different name read like the one you expect at a glance.
Is login.exampleclub.com on the same site as exampleclub.com?
Yes. A sub-name in front of a site’s own name is set by whoever owns that name, so it belongs to the same site. It is login.exampleclub.com.example-host.xyz that belongs to someone else.
Why does the checker miss a copy with swapped letters?
It compares an address with the few names it knows, and a swapped letter makes a name it has never seen. It knows the platform’s name and about thirty famous ones, and nothing else. Spell the name out letter by letter before you trust a Low.