Also known as: Phishing Domains, Typosquatting, Cybersquatting
Domain spoofing is a fraud tactic in which someone registers a web address that closely imitates a legitimate broker or affiliate — swapping a letter, using a zero for an 'O', or adding a word — to deceive visitors into thinking they are on the real site. The goal is to steal traffic, credentials, or affiliate commissions.
The most common form is typosquatting: registering predictable misspellings such as 'xm-br0ker.com' or 'exness-login.net' and either phishing the visitor's deposit or funnelling the traffic through the fraudster's own affiliate link. A related variant is homograph spoofing, which uses look-alike Unicode characters (a Cyrillic 'а' in place of a Latin 'a') so the address looks pixel-perfect in the browser bar.
For partners, domain spoofing cuts both ways. Fraudsters spoof well-known broker domains to hijack organic and paid traffic; they also spoof successful IBs' branded review sites to divert clicks. Both erode brand trust and can put an honest partner in breach of the affiliate agreement if the broker's compliance team cannot distinguish the spoofer from the partner.
Example: a scammer registers 'exness-vip.com', clones the broker's landing page, and runs Google Ads on the broker's brand name. Traders who deposit believe they used the official site; in reality their sign-ups were tagged to the fraudster's affiliate account, and the broker later voids every conversion and reports the domain for takedown.
A spoofer buys a domain that is one small edit away from the target — a transposed letter, an added hyphen, a different TLD (.net instead of .com), or a homograph character. They clone the genuine site's design and either capture logins and deposits (phishing) or rewrite the affiliate tracking parameter so conversions credit their own account.
Traffic is driven to the spoofed domain through brand-bidding on search ads, spam messages, or SEO on the misspelled term. Because the page looks authentic, victims complete real deposits. Brokers detect the pattern through brand-monitoring services, chargeback clusters, and mismatched referrer data, then issue DMCA and registrar takedown requests and blacklist the affiliate account behind the fraud.
The fraudster buys a misspelled, hyphenated, alternate-TLD, or homograph version of the brand's address.
They copy the broker's or IB's landing page and branding so the spoof is visually indistinguishable.
Brand-bidding ads, phishing messages, and SEO push users to the fake domain.
Sign-ups are re-tagged to the fraudster's affiliate ID, or credentials and deposits are stolen outright.
The broker traces the pattern, files registrar/DMCA takedowns, and terminates the offending affiliate account.
Why it matters for partnership: Spoofed domains steal your traffic and can get your own account terminated when compliance cannot tell you apart from the fraudster. Registering your brand's common misspellings and monitoring look-alikes protects both revenue and reputation.
A fraudster registers 'xm-br0ker.com' (a zero for the 'o'), clones XM's sign-up page, and runs search ads on 'XM login'. Traders deposit believing it is official; the sign-ups are tagged to the scammer's affiliate ID. XM's compliance team detects the referrer mismatch, files a registrar takedown, voids the conversions, and permanently bans the account behind it.
| Variant | Method | Example |
|---|---|---|
| Typosquatting | Register a common misspelling | exness-login.net |
| Alt-TLD | Same name, different extension | broker.co vs broker.com |
| Homograph | Look-alike Unicode characters | Cyrillic 'а' in the name |
| Combosquatting | Brand plus an added word | brand-vip.com |
Register the obvious misspellings and alternate TLDs of your own brand and 301-redirect them to your primary site, so a spoofer cannot grab them first.
Bidding on a trademarked broker name while showing a spoofed or misleading display URL — brokers and ad networks treat this as fraud and suspend the account immediately.
Domain spoofing is the look-alike address itself; phishing is one use of it — tricking visitors into entering credentials or deposits. Spoofed domains are also used to hijack affiliate traffic.
Yes. Register the common misspellings and alternate TLDs yourself, trademark your brand, and monitor new registrations with a service like DNSTwist so you can request takedowns fast.
Not if you report it promptly with evidence. The risk is being mistaken for the spoofer, so proactive disclosure to your affiliate manager protects your account.
Yes — defensively registering your own variants and redirecting them to your real site is a legitimate, recommended protection tactic.
They analyse referrer data, chargeback clusters, and brand-monitoring alerts, then trace conversions back to the affiliate account behind the spoofed domain.
The broker files registrar and DMCA takedowns, voids all conversions from the domain, terminates the affiliate account, and may pursue legal action for trademark infringement.
A fast, repeatable 30-minute screen for verifying a broker's license, fund-safety mechanics, complaint history, and corporate identity before you partner with them.