The police called a client about a fake version of their domain

A few months back, one of our clients got a phone call from the police.

Someone overseas had registered a web address built to look almost exactly like theirs. Their real domain ends in .com.au, the way most Australian businesses do. The fake one took their name and tacked "-au.com" on the end. At a glance, in an email, you might not spot the difference.

That is the whole point of it. These lookalikes get used for what the police call business email compromise. A scammer sends invoices or messages from an address that looks like a real company, the money goes overseas, and once it is gone it is gone. The officer told us prevention is really the only good defence, because chasing it afterwards almost never gets the money back.

He also said the "-au.com" trick is currently the most common way Australian businesses are being mimicked. Take yourname.com.au, register yourname-au.com, and you have a convincing fake.

So I have started thinking about domains the way you would think about protecting a business name, not a website. While I was writing this, I went and registered our own jezweb-au.com. Practising what I preach.

Here is how I would think about it, scaled to how much your name is worth protecting.

The basics, for everyone. Own the three obvious versions of your name if you can: yourname.com.au, yourname.au, and yourname.com. Most businesses grabbed the .com.au years ago and stopped there. The .au opened up in 2022, and the priority window for .com.au holders closed in September 2022, so if you never claimed yours it is probably still sitting there for anyone to take. The .com stops someone overseas planting your name offshore.

A bit more, if you want the extra cover. The lookalike the scammers actually use, yourname-au.com, plus the next-closest endings: yourname.net.au, .net, .org, .biz. They are cheap, and they close the obvious gaps around your name.

Serious brand protection, if your name is valuable or high risk. Newer and overseas endings like .app, .ai, .nz, .co.uk, .us. Most small businesses genuinely do not need these. But if your brand is well known, or the damage from someone impersonating you would be big, the extra few dollars a year is cheap insurance.

You do not need all of them. Most businesses are fine with the first group. The point is to make a deliberate decision about your name, rather than discover the gap the way our client did, with a phone call.

And you do not have to build anything on the ones you register. Point them at your real site, or just park them so they are yours and not someone else's.

Further reading, from the source: auDA's guide to .au domain names, the body that runs .au.

If you are not sure what you own or what is exposed, we can check it for you. Sorting out domains is one of the things we do for clients, so reply to this and I will run your name across the obvious variations and tell you where the gaps are. Prefer to do it yourself? Your registrar or your IT provider can check the same list. Either way it is worth knowing. I would rather you heard it from us than from the police.