The fix, in one snippet
paypa1-secure-login.top <- digit one, and not paypal.com
paypal.com <- the real registrable domainIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The checker extracts the registrable domain with the Public Suffix List and compares its main label against several hundred frequently impersonated brands (banks, mail providers, parcel carriers, software vendors, government services) using Damerau-Levenshtein distance (one edit for short names, two for long ones), keyboard-adjacency typos, homoglyph substitutions (rn for m, vv for w, 0 for o, 1 for l), inserted hyphens or words (paypal-secure), and TLD swaps (.co or .cm for .com). An exact match with the brand's domain or a known official alias passes. Limits: the brand list is finite; real companies can have similar names; a two-edit match on a short common word is noise, so short brands are weighted down; trademark ownership is not checked.
Why it matters
Typosquatting and combosquatting are the foundation of credential phishing and business email compromise: paypa1.com, micros0ft-login.com, amazon-support.co. A TLS certificate is free and automatic, so the padlock only proves the connection is encrypted to whoever registered the name. In BEC the lookalike is often of the victim's own company (contoso-inc.com for contoso.com), used to email the finance team a changed bank account. Everyone reading links in email, SMS and chat is exposed.
How to fix it
Do not sign in through the link. Compare the domain character by character with the one you know, or simply open the service from a bookmark. Use a password manager, which fills only on the exact domain. Check the domain's age with the registration-date check; a days-old domain claiming a global brand is decisive. Report to the brand (most publish an abuse or phishing address), to Google Safe Browsing, and to APWG at [email protected]. Companies: register the common variants of your own domain, deploy DMARC at enforcement, and watch certificate transparency logs for your name. Guides: how to spot phishing, SPF, DKIM and DMARC and browser password managers.
Where this fits
Lookalike of a well-known brand domain is check 5 of 13 that the phishing url checker runs under url and phishing indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Internationalised (punycode) domain (high), where the domain contains internationalised (non-ASCII) characters encoded as punycode (xn--), which can make a lookalike address display as a trusted brand. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Lookalike of a well-known brand domain closes one route in. Immediately below it: Domain registered very recently, where the domain was registered very recently, which is typical of phishing infrastructure that is created, used for days and discarded; Link uses plain HTTP, where the link uses plain http://, so anything you send to the page, including a password, would travel unencrypted, and the page itself could be altered on the way; Long or cross-domain redirect chain, where following the link produced several redirects, or a redirect onto a different domain, so where you land is not where the link appears to go.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Lookalike of a well-known brand domain (high severity)
Scanner check id: url-lookalike-domainThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 13, 2026
How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work
Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...
Read the guide
9 min read · Updated Sep 10, 2026
SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain
Without SPF, DKIM and DMARC anyone can send email that appears to come from your domain. What each record does, how to write them, how...
Read the guide
6 min read · Updated Sep 17, 2026
Are Browser Password Managers Safe? Built-In vs Dedicated Managers
Chrome, Firefox, Safari and Edge all store passwords, and they are safer than reuse. This guide compares built-in managers with...
Read the guide