Domínios

Similar domains: how to distinguish risk from coincidence

branddi · Published on June 10, 2025 · Updated on October 26, 2026

Similar domains are addresses that resemble a brand name or its official domain. Resemblance helps identify candidates for review, but it does not establish fraud on its own. To decide what needs investigation, combine the observed name, available content, known business relationships and the action the visitor is asked to take.

What makes a similar domain relevant to a brand?

A changed letter, an added term or a different extension may confuse someone seeking support, making a purchase or accessing an account. Risk depends on context. An address impersonating the brand and requesting payment needs a different assessment from a parked domain or an unrelated legitimate business with a similar name.

The first output should be a classification supported by reasons. Avoid turning a list of discovered names into a list of confirmed scams. Keeping those categories separate helps reviewers prioritize cases without mixing suspicions, authorized partners and situations they have not yet understood.

This article addresses the review of similar external addresses. For managing the company's own assets, see the guide to domain protection. Governance of an official domain and investigation of a third-party address are related activities, but they depend on different evidence.

Which patterns deserve an initial check?

Treat these patterns as discovery filters. None independently proves malicious intent, infringement or a relationship with the brand owner.

• Observed pattern — Why it deserves attention — What to check before concluding
• Missing, repeated or changed letter — A quick reading may miss the difference — Content, claimed identity and requested action
• Brand plus shop, support or promotion — It may imply an official channel — Recognized relationship and authorization
• Same name under another extension — It may resemble a local or alternative version — Who uses the address and in which context
• Visually similar characters — Human reading may overlook differences — Exact domain representation and actual use
• Similar name belonging to another business — Coincidence or legitimate activity is possible — Business context, presentation and confusion

ICANN explains internationalized domain names, which support characters from different languages. Non-Latin characters are therefore not evidence of fraud. Reviewers must distinguish valid language representation from specific conduct that leads a visitor to believe an address belongs to the brand.

An extension is not a safety score either. The cover of this article illustrates different extensions; it does not rank their trustworthiness. Assessment requires the complete address and evidence of its use.

How do you separate the domain from other address elements?

Record the address exactly as observed. Do not rely only on an advertisement's display name, button label or page title. Those elements may present one identity while pointing to a different destination.

A brand name appearing somewhere in an address does not demonstrate that the company controls the site. It may appear in a subdomain, page path or another component. If the registrable domain is unclear, ask a technical reviewer and record the uncertainty. Do not invent a rule based on the last visible word.

Keep the address presented to the user separate from the destination identified by the team in an appropriate environment. Redirects can change the final destination. Evidence collection must not require an employee to enter credentials, make a purchase or install files to test a suspicion.

The record should also distinguish what was directly observed from what a customer described. Both can matter, but they have different evidential limits. Preserve the original report alongside the team's findings.

What evidence helps distinguish coincidence from impersonation?

Organize the review around four questions. What identity does the page claim? Is there a known authorized relationship? What action does it request? Which verifiable observations support the concern?

A reseller may mention a brand without claiming to own it. A partner may operate an authorized domain that the support team's inventory does not yet include. Confirm such relationships with the responsible business unit through a known internal channel before classifying them.

A different page may copy the visual identity, claim to provide official support and request payment without a recognized relationship. Together, these observations justify investigation priority. Still, describe what was actually seen: an operational classification does not replace a legal conclusion.

A partner's missing response, limited public information or temporary unavailability does not confirm fraud. Use an inconclusive state when the available material is insufficient. Explicit uncertainty is more useful than a confident label unsupported by evidence.

Does HTTPS or a professional appearance settle the question?

No. Chromium explains the difference between connection security and trust: a secure connection indicator does not certify a site's honesty. A page using HTTPS still requires checks of its identity and relationship with the brand.

Logos, photographs, testimonials and layout are also insufficient. What matters is consistency between the address, claimed identity, authorization and requested action. A simple-looking page can be legitimate, while a polished one can present misleading information.

Do not classify a site as safe merely because the browser displayed no error. A technical warning also requires caution, but does not by itself identify who operates the page or determine the appropriate response.

How can identity be checked without increasing exposure?

The FTC recommends checking suspicious messages through a known contact instead of using contact details supplied by the message itself. Within a company, this means consulting an already validated official channel and the person responsible for the relationship.

Support teams need a simple instruction: never ask customers to test a payment or send documents to the suspicious address. Collect the report and route it for review. If someone has already supplied information, activate the response process appropriate to that exposure.

For responsibilities and internal communication, see phishing against brands. Domain review should provide a reasoned decision to that process, without creating a separate, conflicting support or investigation workflow.

How should discovered cases be prioritized?

Combine evidence of impersonation, the requested action and observed exposure. An address linked to a payment report and a false claim of official support generally warrants review before a similar name with no identified use. Reassess priority when new information appears.

Use clear states: legitimate relationship confirmed, review pending, suspicion supported by evidence and insufficient information. Record who classified the case, when and why. Define who may revise or close it as well.

Do not rely solely on the number of different characters as a risk measure. That distance can help discover names, but does not measure potential harm. A less similar name may cause more confusion when it appears within apparently official customer support.

What belongs in the evidence record?

A useful record lets another person understand the case without repeating risky interactions. Include:

• the observed domain and URL, date and discovery context;
• claimed identity, requested action and a relevant capture;
• report origin and the authorized relationship checked;
• current classification, reasoning and responsible reviewer;
• information gaps, next action and review date.

Keep only personal data necessary to handle the case. Restrict access to customer documents or payment records. Do not publish a list of suspicious addresses in guidance that could send additional visitors to them.

When the next step requires a report, the guide to reporting a fake website covers that stage. Discovering an address, classifying it and receiving a decision from the responsible channel are distinct outcomes.

How can review performance be measured without inflated totals?

Count unique domains, URLs, reports and cases separately. Multiple pages under one domain do not necessarily represent independent incidents. Repeated reports may indicate growing exposure, but should not artificially multiply the number of identified domains.

Track how many candidates were reviewed, how many had a legitimate relationship confirmed and how many advanced with sufficient evidence for action. Include inconclusive and reopened cases. Classification changes must remain visible in the history.

These indicators describe operational quality. They do not independently demonstrate recovered revenue or avoided loss. Assessing commercial impact requires additional data linked to the case and explicit limits on the analysis.

Which questions come up frequently?

Should every similar domain be reported?

No. Establish context and collect evidence first. Partners, businesses in other sectors and legitimate uses may share parts of a name. Any referral should match the facts and the rules of the competent channel.

Can a domain with no content be closed as safe?

Not automatically. Missing content limits the assessment at that moment. Record what could be observed, the uncertainty and the review criterion, without making a definitive claim about future use.

Does a brand name in an address prove authorization?

No. Authorization must be confirmed with the company and those responsible for the relationship. The presence of a word in an address is only one element of the assessment.

Where can Branddi support this process?

Branddi Digital Fraud brings together monitoring, evidence and case routing within the contracted scope. Bring known cases and coverage gaps to define channels, responsibilities and prioritization criteria. A similar name must never become an automatic promise of removal.

Sources consulted on October 26, 2026. ICANN, Chromium and FTC guidance supports the specific points indicated; the review matrix above is an operational proposal, not an opinion about a particular case.

Back to blog