Lookalike Domains Explained: How Fake Addresses Imitate Real Ones
Misspellings, extra words, swapped endings and look-alike characters: the techniques behind fake card and gift-card websites, and how to read an address correctly.
A lookalike domain is a web address designed to be mistaken for a real one. It is the single most common ingredient in fake balance-check and card-verification pages, because people tend to glance at an address rather than read it.
The addresses below use an invented brand, “mylabel”, with the reserved .example ending, so you can learn the patterns without any real website being involved.
Anatomy of a web address
Take the address https://balance.mylabel.example/gift/check. It has four parts that matter:
- https:// — the connection type. It means traffic is encrypted. It does not identify the owner.
- balance. — a subdomain. The owner of mylabel.example can create any subdomain they like.
- mylabel.example — the registered domain. This is the part that identifies who controls the site.
- /gift/check — the path. Anyone can put any words here, including brand names.
Common lookalike techniques
| Technique | Real address | Lookalike |
|---|---|---|
| Misspelling (typosquatting) | mylabel.example | mylabal.example |
| Character swap | mylabel.example | my1abel.example (the number 1 instead of the letter l) |
| Extra words | mylabel.example | mylabel-balance-check.example |
| Different ending | mylabel.example | mylabel.net or mylabel.co |
| Brand as subdomain | mylabel.example | mylabel.example.card-verify.net |
| Brand in the path | mylabel.example | card-verify.net/mylabel.example/login |
| Look-alike characters from other alphabets | mylabel.example | an address using a Cyrillic “а” that looks identical to a Latin “a” |
Some techniques combine several of these. A page might use a believable subdomain, a short extra word and a common ending all at once.
Look-alike characters from other alphabets
Domain names can contain characters from many writing systems. That is important for people who do not use the Latin alphabet, but it also means some letters from different alphabets look the same on screen.
Modern browsers apply protections and may display such addresses in an encoded form starting with xn-- when they look deceptive. If you see an address beginning with xn-- where you expected a familiar brand, treat it as a warning sign.
Shortened links and redirects
Link shorteners and redirect chains hide the final destination. They are common and often harmless, but they also let scammers send you a tidy-looking link that ends somewhere else.
The rule is simple: judge the address you land on, not the link you clicked. After a page loads, read the full address bar before entering anything sensitive.
Why phones make this harder
Mobile browsers often show only part of the address, and in-app browsers inside messaging or social apps may hide it altogether. Before entering card details on a phone, tap the address bar to reveal the full address, or open the link in your main browser.
Warning signs
- The registered domain differs from the one printed on your card, even by one character.
- A familiar brand name appears only in the subdomain or the path.
- The address contains extra words like “verify”, “secure”, “check” or “support” bolted onto a brand.
- The ending is different from the one you expected.
- The address begins with xn-- where you expected a familiar name.
- The link was shortened and you have not checked where it actually led.
Checklist
- I found the registered domain by reading backwards from the ending.
- I compared it character by character with the address printed on my card or paperwork.
- I checked the full address on my phone by tapping the address bar.
- I judged the final landing address, not the link that got me there.
Common mistakes
- Reading left to right
- Scammers put the familiar part on the left. The owner is identified on the right, just before the ending.
- Assuming “secure” in an address means secure
- Anyone can register a domain containing the word secure.
- Trusting in-app browsers
- Messaging and social apps may hide the full address. Open sensitive links in your main browser.
What to do next
- Practice on addresses you already trust: find the registered domain in your bank’s site.
- Use our website checklist next time you are about to type card details.
- Read why HTTPS alone does not prove a site is safe.
Sources and further reading
- U.S. Federal Trade Commission — How to Recognize and Avoid Phishing Scams (opens in a new tab)
- ICANN — Internationalized Domain Names (opens in a new tab)
- Anti-Phishing Working Group (APWG) (opens in a new tab)
- CISA — Recognize and Report Phishing (opens in a new tab)
External links go to independent sources we consider authoritative. Check My Card is not responsible for their content.
This guide is general education, not financial or legal advice. For anything about your own card, contact your issuer using the number printed on your card. Spotted an error? Request a correction.
