Publishing

Impersonation and Lookalike Pages: Protecting a Small Game and Its Players

Once a game has a name, somebody can borrow it. Fake download pages and copied store listings hurt players first and your reputation second.

How small studios get impersonated

You do not need to be famous. Automated copying is cheap, and any game with a public page can be cloned. The usual forms are:

Lookalike domains. Typosquatting is a form of cybersquatting that relies on mistakes such as typing errors made by people entering a web address. A lapsed or misspelt version of your studio name is registered and filled with adverts or harmful downloads.
Re-uploaded builds. Your free demo appears on another site wrapped in an installer you did not write.
Cloned store pages. Screenshots and description are copied to a different store under another publisher name.
Fake "press" and "publisher" emails. Messages ask for keys or offer deals in your name, a variety of phishing.

Give players one place to check

The most effective defence is dull: a single page you control that lists every genuine place to get the game and every genuine account that speaks for it. Link to that page from each store listing and profile. When a player wonders whether a download is real, there is a definite answer.

List each store page by full link.
List your social and community accounts.
State where you do not distribute, for example "we do not offer direct downloads".
Give one contact address for reports.

Keep hold of your names

Renew your domain automatically and keep the registrar account under two-step sign-in. Expired studio domains are routinely bought by strangers.
Register the game's name on the main platforms even if you do not plan to post there.
Keep dated records of your builds, art and announcements. They are your evidence when filing a takedown.

How a careful player verifies, and what that teaches you

It helps to look at verification from the other side: what does a cautious person do when several websites all claim to be the same brand? This problem is far worse in industries where real money changes hands, and the checking methods developed there are instructive. One worked example is a Traditional Chinese page that asks whether one gaming brand is a scam by going through public police fraud-report data, the several domains each claiming to be the brand's own site, and ways readers can confirm things for themselves (搖錢樹娛樂城詐騙). The page states that it is not run by the brand it examines. For a developer, the takeaway is the method: compare domains, look for public records, and distrust any single page's description of itself. If a stranger did that exercise on your studio, would they reach the right answer?

When you find a fake

Capture it. Screenshots with the address and date visible.
Report through the platform's own form. Stores, hosts and registrars have procedures for copyright and impersonation complaints.
Tell your community briefly. Say what is fake and point to your list of genuine links. Do not link to the fake.
Do not negotiate with whoever runs it.

Protecting keys and builds

Send review keys only to addresses you have confirmed through the outlet's or creator's public profile. A request that arrives from a free mail account with a familiar-sounding name deserves a second look. Keep pre-release builds watermarked per recipient where you can, so that a leak can be traced.

// Kit Farrowdale // revised 2026-11-12