Is someone running a fake login page on a lookalike of my SaaS domain?

Software companies are copied for one reason: their customers log in. A lookalike domain with a copied sign-in page collects usernames and passwords, and a lookalike that can send email lets someone write to your customers as if they were you. The first step is finding out which lookalikes of your domain already exist and which of them show a live page.

Free, no account needed. A scan takes 15 to 60 seconds. You get a shareable result link.

What our SaaS scans found

In October 2026 we scanned 21 well-known software and SaaS brands (for example Slack, Shopify, DocuSign and Zoom) with the same scanner you can use above. Counted from the stored scan data:

• 6,474 registered lookalike domains across the 21 brands, a median of 245 per brand.
• 9 confirmed fakes among the 767 flagged sites we checked by hand, at 5 of the 21 brands. Five of the nine showed a copied "sign in" or "log in" page, one copied an app's admin screen, one copied a meeting-launch page, one was an unofficial download site for a well-known app, and one was blocked by Cloudflare as suspected phishing.
• 7 of the 9 used the brand name spelled correctly, with an extra word or a different ending. The other two used a look-alike letter.
• Where we could see a registration date (6 of the 9), 4 of the fake domains were less than a year old.
• 35% of the SaaS lookalikes had a real mail server set up, and 65% were found because they got a new HTTPS certificate in the previous 24 hours.

The full breakdown, method and limits are on lookalike domains by industry and our 95-brand research.

Signs a lookalike is after your users' logins

• Your brand name in the domain with a word like "app", "login", "secure", "my" or "account", or one letter swapped for a look-alike character.
• Your page title or site icon on a page you don't run, especially a sign-in page.
• A recently registered domain or a brand-new HTTPS certificate.
• A working mail server, so it can send email under a name that looks like yours.

Our scan checks all four automatically: it compares each live lookalike's title and site icon with your real site, looks up registration age, watches public certificate logs, and checks for a real mail server. It can't log in or test what a form does with a password, so a site we flag still needs a quick look by a person before you act.

If you find one

1. Save evidence: screenshots of the page and the address.
2. Report it to the domain's registrar and hosting company, and to Google Safe Browsing so browsers start warning visitors.
3. Tell your users which address is really yours, and reset any accounts that may have entered a password on the fake page.

Step-by-step details are in what to do about a fake domain. New lookalikes appear every day; monitoring re-checks daily, watches new certificates around the clock, and emails you when a new lookalike appears or an existing one gets riskier.

What it does not do

LookalikeGuard is monitoring and early warning. It does not take down domains, send legal notices, or give legal advice. Scores are automated and can be wrong in both directions: a high score is a reason to look, not proof of abuse. Many lookalike domains are parked, owned by unrelated businesses, or registered defensively by the brand itself; you can mark those as yours or dismiss them.