Log in Request a demo

How To Defend

How To Respond To Lookalike And Phishing Domains.

A lookalike domain alert means someone registered a web address that imitates yours, by a small spelling change, a lookalike character or a new ending. Check whether the site is live, collect evidence, and send an abuse report to the registrar and the hosting provider. Then block the domain on your own systems.

  • Brand
  • Raised by Phishing Monitoring & Domain Abuse
Alert area
Brand
Raised by
Phishing Monitoring & Domain Abuse
First 24 hours
7 steps
Investigation
7 checks
Who acts
SOC analyst, Threat analyst, IT admin and 4 more
Last updated October 17, 2026

What This Alert Means.

A lookalike domain alert means a web address that imitates yours has been registered or has gone live. Typosquatting is a small spelling slip such as a missing letter. A homograph attack swaps in characters that look the same, such as those from another alphabet. The module page lists these, plus newly registered domains, phishing kit reuse and SSL certificate abuse, among the cases it covers.

MITRE notes that attackers acquire lookalike domains using homoglyphs, other endings, typosquatting and internationalised domain names. A domain with no site yet may still be used later, so treat a quiet one as a risk.

First 24 Hours.

First, find out whether the domain is live and what it does. Then block it and start the reports.

Do now
  1. SOC analyst Open the alert from the Brandefense phishing monitoring and domain abuse module and save the domain, registration date, registrar, name servers and screenshotsCapture the page before it changes
  2. Threat analyst Check whether the domain shows a login page, a copy of your site or nothingDo not enter real credentials
  3. IT admin Block the domain on web filters, DNS filters and mail gatewaysAdd the web address and any linked hosts
  4. Mail admin Search mail logs for messages sent from or linking to the domainList every recipient and every click
  5. Security lead Reset accounts for anyone who entered a login and revoke their sessionsCheck for new mail rules
  6. Communications Prepare a short warning for customers or staff if people were targetedName the real address only
  7. Legal Ask which complaint routes are open and who should file themCheck with your legal counsel before any formal notice

Investigation Checklist.

Look at the domain itself, what it hosts and who it is aimed at.

Check the domain
  • How does it differ from yours: missing letter, extra word, other ending or lookalike character?This helps you find sibling domains
  • Who is the registrar, and when was it registered?A very recent date raises concern
  • Where is it hosted, and what else is on that server?Other fake sites may sit beside it
  • Is there a TLS certificate, and who issued it?Certificate logs show when it appeared
  • Is it a copy of your site or a reused phishing kit?Kit files may point to related domains
  • Does it have mail records, so it could send email as your brand?Check its MX records
  • Who has been sent to it: customers, staff, partners?Warn them directly

Containment And Removal.

Domains are removed by the parties that control them. Report to each in turn and keep a dated log. If one stalls, add more evidence and escalate.

  • Hosting provider abuse contact: look up who hosts the site and send a report with the web address, screenshots and a plain statement that it imitates your brand for phishing.
  • Registrar abuse contact: find the registrar in the domain's public registration record and email its abuse address. ICANN says registrars must publish an abuse email address and take reasonable and prompt steps to investigate and respond to reports.
  • ICANN compliance route: if a registrar ignores a well-evidenced report, ICANN has a compliance complaint form for registrar failures.
  • USOM for .tr domains and Turkiye: report malicious links and domains to USOM (usom.gov.tr), which says its services, including incident reports and malicious link lists, now continue on the Cyber Security Directorate site (siberguvenlik.gov.tr).
  • Browser and search safety lists, and email providers: report the page as phishing so warnings appear to users.
  • Law enforcement: in the US, file with the FBI IC3 if money or data was lost. In the UK, NCSC takes reports of scam websites.
  • UDRP and URS: these are formal dispute procedures to win back or suspend a domain. Ask your legal counsel whether they fit your case.
  1. Save evidenceDomain, page, dates, records
  2. Block internallyWeb, DNS and mail filters
  3. Report to host and registrarAbuse contacts, then escalate
  4. Warn peopleCustomers and staff

Longer-Term Hardening.

Make spoofing your domain harder and spot new copies early.

  • Set up SPF, DKIM and DMARC. NCSC explains that DMARC lets you set a policy for mail that fails SPF or DKIM checks, and advises protecting all of your organization's domains.
  • Read DMARC reports. They show who is sending mail in your name.
  • Watch certificate transparency logs. These are public records of issued TLS certificates. A new certificate for a name close to yours can be the first sign of a fake site.
  • Watch new registrations. MITRE suggests tracking newly acquired domains, for example through WHOIS data and passive DNS, including similar names under other endings.
  • Register key variants defensively. MITRE notes this technique is hard to prevent because it happens outside your own defenses.
  • Tell staff and customers your real address and that you never ask for logins by link.

How To Measure That It Worked.

Use numbers from your own case log.

  • Domains found, reported, taken down and still live.
  • Time from first sighting to first report, from your own log.
  • Staff or customers who reached a fake page, from filter and mail logs.
  • Share of your domains with a DMARC policy and its setting.
  • Number of fake mails blocked at your gateway.
  • Repeat domains from the same registrar, host or kit.

Common Mistakes.

These mistakes cost time or hide the evidence.

  • Reporting without a saved copy of the page and domain records.
  • Reporting only to the registrar and not the host.
  • Entering real credentials to test the page.
  • Blocking the domain but not checking who already clicked.
  • Treating a parked, empty domain as harmless.
  • Filing a formal dispute without legal advice.
  • Forgetting related domains with other endings.

Questions.

  • How do I report a lookalike domain?

    Send the evidence to the hosting provider and the registrar abuse contacts. ICANN says registrars must publish an abuse email address and investigate reports. In Turkiye, also report to USOM. Keep a dated log of each report.

  • What is typosquatting?

    Typosquatting is registering a web address that differs from a real one by a small typing slip, such as a missing or swapped letter. Attackers use it to catch visitors and send phishing mail that looks like it comes from you.

  • What if the registrar ignores my abuse report?

    ICANN has a complaint form for registrars that fail to meet their abuse handling duties. Send the registrar clear evidence first, keep copies of every report and reply, and report the site to the hosting provider at the same time.

  • Should I use UDRP or URS to get the domain?

    Those are formal domain dispute procedures. Whether they suit your case depends on your trademarks, the domain's history and the facts, so ask your legal counsel before you file anything or contact the domain owner.

  • How does DMARC help with lookalike domains?

    DMARC lets you tell receiving mail servers what to do with mail that fails SPF or DKIM checks. It protects your own domains from direct spoofing, but it does not stop a lookalike domain, so pair it with monitoring.

Sources

  1. 1 MITRE ATT&CK T1583.001: Acquire Infrastructure, Domains
  2. 2 ICANN: Registrar abuse reports
  3. 3 USOM
  4. 4 NCSC: Email security and anti-spoofing
  5. 5 NCSC: Phishing and scams
  6. 6 FBI IC3: Business email compromise

This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.

More Playbooks.

All Playbooks
Brand Counterfeit product promotion A counterfeit promotion alert means a post, shop page, listing or ad is selling fake goods under your name. Save proof of the page and the seller first. Then report it to the platform's brand protection channel, check whether the shop is also taking card details, and ask your legal counsel about the next legal steps. Open Brand Fake mobile apps A fake mobile app alert means someone has published an app that copies your name, icon or look, in an app store or on a download site. Do not install it on a normal phone. Save proof of the listing, then report it to the store and warn your customers where to find the real app. Open Brand Fake social media accounts A fake social account alert means someone is using your brand name, logo or staff identity on a social network. Save proof first, then check whether the account is contacting customers or staff. Report it through the platform's impersonation form and warn your own people not to engage with it. Open

Keep Exploring.

Knowledge Hub
Article Lookalike Domains: How A Single Character Difference Becomes A Brand’s Worst Nightmare Lookalike domains use typosquatting, homoglyphs and phishing infrastructure to impersonate brands. Learn how they work and how to detect and remove them. Open Glossary term Typosquatting Typosquatting is registering a domain name that looks almost like a real one, such as a common misspelling or a different ending. Open Glossary term DMARC, SPF And DKIM DMARC, SPF and DKIM are three email authentication standards that help a receiving mail system check whether a message really comes from the domain it claims. Open

Browse The Library.