# Has someone registered a domain that looks like yours?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

The lookalike check reads public records for common variations of your domain and lists the ones that are registered. Here is what to do about them.

The lookalike check reads public records for common variations of your domain, such as one letter off or a different ending, and lists the ones that are registered.

## What does this check look at?

It looks at whether common lookalike versions of your domain are registered. Someone registers a name one letter away from yours, or the same name with a different ending, and uses it for fake invoices or sign-in pages.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Info finding | One or more lookalike names are registered. | Tell your team and customers which address is really yours. |

Owning a similar name does not prove bad intent. You can't stop every lookalike, but knowing about one lets you warn customers and report it. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

Most of the response is communication, plus registering the closest variants yourself if they are still free.

:::fix-prompt any
Here are domains registered by others that look like mine: [paste the list from the report]. Draft a short note for my team and one for customers that names my real domain and says how we contact people. Then suggest which close variants I should register myself if they are still available, and how to report a lookalike that is used for phishing.
:::

## How to check

Say Atlas, our example app at `atlas.example`, sees a registered variant with one letter swapped. The check lists it, and the team warns customers before an invoice scam lands.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Does a registered lookalike mean someone is attacking me?

No. Plenty of lookalikes are parked or owned by unrelated people. It is worth knowing about, not proof of intent.

### Can I make the owner give the domain up?

Sometimes, through a dispute process, when it infringes your trademark. Reporting active phishing to the registrar is usually faster.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [Lookalike domains](https://www.lockpick.app/docs/learn/lookalike-domains), Lockpick docs, read on 2026-10-07