Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell: two critical PHP flaws affect most WordPress hosting. See if your site is affectedFlagged by our vulnerability database: PHP2Shell, two critical PHP flaws. DetailsFlagged: PHP2Shell. Check your site
HuttenlocherTechnologies

Security · 4 min read · Updated October 25, 2026

Look-alike domains and typosquatting

Short answer: DMARC stops anyone sending email from your exact domain. It does nothing about yourbusines.com, yourbusiness.co or your-business.com. Those look-alikes are how many invoice scams reach your customers.

How look-alikes are used

  • Fake invoices and payment changes sent to your customers or vendors.
  • Phishing pages that copy your website to collect logins or payments.
  • Fake job offers or rental listings using your name.

Protect yourself

  • Register the obvious ones: common misspellings, a missing or doubled letter, the .net and .co versions, with and without hyphens. Point them at your real site.
  • Give each one a DMARC record at reject and an SPF record of v=spf1 -all, so they can’t send mail either.
  • Tell customers your one real domain and that you never change payment details by email.
  • Search occasionally for new registrations containing your name; some services alert you.

If someone registered one

If it’s being used for fraud, report it to the registrar and hosting provider listed in its registration, with evidence. If you hold a trademark, the Uniform Domain-Name Dispute-Resolution Policy (UDRP) lets you seek a transfer through an approved provider such as WIPO. That’s a legal process; talk to your attorney.

Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.

Questions

How many should I register?

A handful of the most likely typos and the main other endings is usually enough. You can’t register every variation, and you don’t need to.

Do you register and protect look-alikes?

Yes, as part of our email security work, with each one locked so it can’t send mail.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back
02A planning call, then a written plan with the price and the date
03A preview on your phone while it's being built
04Launch night handled: redirects, email, Google
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?

No newsletter, no sales sequence. Just a reply.