Menu

Domain

The Similar Domain Question

The similar domain question

< BLOG

The similar domain question every business should ask

Almost all business owners I speak to haven’t thought about this. Not because they’re careless. Because it doesn’t feel like their problem until someone calls to tell them it is.

By that point, a customer has paid a fraudulent invoice. A supplier has updated their bank details based on an email that looked like it came from you. A member of staff has handed over their login credentials to a page they were certain was the one they use every day.

The domain name was the thing that made all of it believable.

Here’s the reality most businesses don’t see until it’s too late

There are probably web addresses in existence right now that look a lot like yours. Some will be inactive. Some belong to unrelated businesses. A few may have been registered by domain investors with no particular purpose in mind.

Most of them are probably nothing.

But you cannot treat a domain as harmless until you actually know it exists, know what it’s doing, and know whether someone is using it to pass themselves off as you.

“Probably nothing to worry about” is not evidence. It’s an assumption. And assumptions are exactly what fraudsters rely on. That’s why it’s important to address the similar domain question sooner than. later.

The mechanics of this are simpler than people think

When a fraudulent message arrives, people immediately focus on the content. The wording sounds familiar. The request makes sense. The company name is right. The logo looks fine. The sender’s address gets a glance, not a second look.

A domain that differs by one character is often enough. Not to fool everyone. Just to fool one person, once, in a moment when they’re busy and not looking hard enough.

That’s the mechanism behind most business email compromise fraud. Not sophisticated technical attacks. Not elaborate deception. A domain close enough to be trusted, used at a moment when someone doesn’t stop to verify.

This matters because web addresses and email have become part of a business’s identity. In the UK, 43% of businesses reported a cyber breach or attack in the previous year. In Europe, phishing accounted for 60% of observed initial-access activity in ENISA’s 2025 threat landscape. In the United States, reported business-email-compromise losses totalled $3.05 billion in 2025.

A lookalike domain doesn’t need to host a convincing fake website to cause serious damage

It may only ever send emails. It may redirect visitors somewhere else. It may carry a login page quietly collecting staff credentials. It may sit completely dormant for a year and then be used once at exactly the right moment, against exactly the right person.

The risk isn’t the domain. The risk is the trust attached to your business name and what someone else can do with it once they have a plausible address to send from.

A supplier receives an email from accounts@yourcompany-ltd.co.uk instead of accounts@yourcompany.co.uk. It references a real project. It asks them to update bank details before the next payment. They’re busy. It looks right. They act.

The money goes elsewhere. Your name is on the transaction. The supplier will almost certainly bear the direct financial loss, but the cost of investigating it, managing the conversation, and rebuilding a relationship that may never fully recover lands on you.

Not every similar domain needs the same response

Some need immediate action: a site copying your brand or services, a domain sending or receiving email, a login page collecting credentials, or anything appearing in phishing emails or suspicious correspondence your customers or suppliers have received.

Others just need recording and watching: inactive domains, parked registrations, and variations with no obvious intent to impersonate.

The difference between those two categories matters. Being able to tell them apart is the whole point.

For most smaller businesses, this doesn’t need to be complicated

Know which variations of your name, brand and trading names exist. Understand what each one is doing. Keep a record of what you’ve checked and what you decided. Look again when something changes. Move quickly if you find evidence of active misuse.

The goal isn’t a long list of domains to worry about. It’s being able to answer one question with confidence:

Do we know whether anyone is currently using a web address that could credibly pass for ours? The similar domain question is here to stay, it’s up to your business to know if, not maybe when it happens.

Businesses find out the answer to the similar domain question the hard way

A worried customer. A supplier chasing a payment that went somewhere else. A member of staff who clicked something they shouldn’t have.

The domain was there before any of that happened. It just wasn’t being watched.

That’s the gap The TLD Project was built to close. Practical, affordable visibility for businesses, associations and business groups who want to know what’s out there before someone else uses it against them.

The Similar Domain Question
The TLD Project: Empowering everyone to take professional action.

Domain Variations

Domain Variations: The Small Changes Criminals Use to Impersonate You

< BLOG

Domain Variations: The Small Changes Criminals Use to Impersonate You

Domain Variations are the small changes that turn a genuine web address into a separate, potentially deceptive domain. A criminal might remove one letter, swap two characters, add “support” or “login”, use a different extension, or substitute a lookalike symbol. These changes are designed to be overlooked, allowing a fraudulent website or email address to borrow the familiarity of your real business name.

A different address can still look like your business.

Most people do not memorise a website address character by character. They recognise the shape of a familiar name.

Attackers understand this. They look for changes that are easy to miss but still allow a separate domain to be registered. The purpose is not always to create a perfect copy. It is to create an address that looks believable when someone sees it in a busy inbox, a search advert, a message on a phone, or a QR-code link.

This is why simply owning your main website address is not the whole picture. Your business name can appear in many possible combinations, and some may create a genuine risk even though they are not identical to your domain.

The TLD Project helps SMEs see those Domain Variations early, assess which ones are likely to cause confusion, and take professional action where there is evidence of impersonation.

Domain Variations

Domain Variations are changes to a domain name that produce a different web address while retaining some resemblance to the original.

Not all Domain Variations are malicious. A business may use different domains for regional websites, campaigns, products, redirects, or separate services. Another organisation may use a similar name entirely legitimately.

The risk begins when someone deliberately uses a variation to make people believe they are dealing with your business.

Common Domain Variations include:

  • A letter removed: yourbrnd.com
  • A letter added: yourbrrand.com
  • Letters swapped: yourbrnad.com
  • A neighbouring-key error: yourbtand.com
  • A number replacing a letter: yourbr4nd.com
  • A hyphen added or removed: your-brand.com
  • A word added: yourbrand-login.com
  • A different extension: yourbrand.co or yourbrand.shop
  • A visually similar Unicode character: yourbrаnd.com
  • A missing dot: supportyourbrand.com instead of support.yourbrand.com

These methods are sometimes grouped under technical names such as Typosquatting, Combo Squatting, Homoglyph Attacks, TLD Abuse, or Doppelganger Domains. The names differ, but each relies on the same weakness: people scan addresses quickly and trust what looks familiar.

How small changes become fraud

A variation becomes dangerous when it is connected to a believable request.

An address such as yourbrand-payments.com may be used in a message about an overdue invoice. yourbrand-support.com may host a fake helpdesk. yourbrnad.com may appear as the sender address in an order-confirmation email. yourbrand.shop may host a copied store with products that will never be delivered.

The attacker can combine the domain with your public brand material, your logo, product images, wording, staff names, addresses, or terms and conditions. The visitor sees a familiar business identity and may not notice the changed address until after they have entered a password, supplied payment details, or made a transfer.

The domain name does not need to carry the whole deception. It only needs to make the rest of the scam feel credible.

Which variations matter most

There can be a very large number of theoretical Domain Variations. Monitoring every random combination equally is not practical.

Prioritise the variations most likely to be understood as part of your real business:

  • Common typing errors in your company name.
  • Shortened forms, abbreviations, and alternate spellings.
  • Variations using your main domain under common or relevant extensions.
  • Your brand name combined with customer-facing words.
  • Finance and payment-related combinations.
  • Login, support, account, delivery, order, refund, and security terms.
  • Locations, markets, products, services, or departments associated with your business.

The best watchlist reflects what an attacker would know about you. If your business sells products online, a variation involving “shop”, “order”, or “delivery” could matter more than a generic name change. If you send invoices, “accounts”, “billing”, “payment”, and “finance” variations deserve greater attention.

Do not assume every match is malicious

A similar domain is a signal to investigate, not proof of an attack.

Review the domain’s content, purpose, registration context, email configuration, redirects, use of your branding, and any claim of affiliation. A domain registered by an authorised partner, franchisee, reseller, or unrelated company may be legitimate. A blank domain may still be harmless, or it may be waiting to be used.

The important question is whether the domain is likely to cause confusion or is being used to exploit that confusion.

Evidence of copied content, false contact details, payment requests, credential forms, fraudulent emails, or customer reports makes the risk clearer.

What to do with a suspicious variation

Record the full domain exactly as it appears. Save screenshots, timestamps, messages, email headers, redirects, and examples of copied branding or false claims. Identify whether the domain is active as a website, configured for email, used in adverts, or linked to another fraudulent service.

Then classify it:

  • A legitimate or unrelated registration may need no action.
  • A brand-related domain with no active abuse may need monitoring.
  • A domain used to impersonate, deceive, collect data, or take payment requires evidence-led reporting and response.

The TLD Project helps SMEs find and prioritise Domain Variations across TLDs, so attention is focused on the registrations most likely to harm customers and the business.

Domain Variations
The TLD Project: Empowering everyone to take professional action.

Domain Spoofing

Domain Spoofing: How Attackers Make Fake Web Addresses Look Real

< BLOG

Domain Spoofing: How Attackers Make Fake Web Addresses Look Real

The address contains your name. It is still not your domain.

A person receives a message from what appears to be a business they recognise. The sender address contains the right brand name. The link includes the expected words: secure, account, payment, support, order, or login.

It feels legitimate because the attacker has placed familiar information where people expect to see it.

Domain Spoofing relies on how quickly we read. Most people do not break a web address into its technical parts. They notice a known name, a reassuring word, and perhaps a padlock in the browser. That is enough for the false address to pass a quick visual check.

For an SME, this can create fraud without any compromise of the real website or email system. The attacker creates an independent address, borrows the identity of the business, and uses it as the entry point to a scam.

That is why The TLD Project looks beyond exact copies of your domain. A deceptive address can be built in several ways, and the most convincing one may still include your correct business name.

Domain Spoofing

Domain Spoofing is the practice of making a domain, email address, or URL appear to belong to a trusted organisation when it does not.

It is an umbrella term for different methods of misleading people about the real destination of a link or the real owner of an address. The criminal may register a lookalike domain, use a misleading subdomain, copy a brand into a longer URL, or disguise the destination behind a button or shortened link.

Common examples include:

  • A typo: yourbrnad.com
  • A brand-plus-keyword domain: yourbrand-account.com
  • A changed extension: yourbrand.shop
  • A character substitution: yourbrаnd.com
  • A deceptive subdomain: yourbrand.com.attacker-example.net
  • A deceptive path: attacker-example.net/yourbrand.com/login

The last two examples are important. In a web address, the genuine domain is the part immediately before the first / after https://. In:

https://yourbrand.com.attacker-example.net/login

The actual domain is attacker-example.net, not yourbrand.com.

Attackers often place a real company name earlier in the address because they know that is where many people stop reading. ICANN notes that phishing campaigns can use any domain and create URL strings that appear to carry the meaning of another domain or extension.

Domain spoofing and email spoofing

These terms are related, but they are not identical.

Domain Spoofing normally involves a fake or lookalike domain controlled by the attacker. The email might come from billing@yourbrand-payments.com, or the link might lead to yourbrand-login.com.

Email spoofing can involve forging the visible sender of an email to make it appear to come directly from your real domain. Email authentication controls such as SPF, DKIM, and DMARC can help reduce unauthorised use of your exact email domain, but they cannot prevent someone registering a different, lookalike domain.

This is why a business needs both email security and domain monitoring. One protects the domain you own; the other helps identify domains that imitate it.

Why fake addresses work

Domain Spoofing does not need to fool everyone. It only needs to fool one busy customer, supplier, or employee.

A supplier may receive an email about revised bank details from a domain that appears to belong to your finance team. A customer may click a “secure payment” link that leads to a copycat checkout page. A member of staff may receive a fake Microsoft 365 or cloud-document login request that uses a domain resembling your company or a trusted software provider.

  • The attacker often combines the fake address with pressure:

    Your account will be suspended.
  • A payment is overdue.
  • A parcel cannot be delivered.
  • A document requires approval.
  • A refund is waiting.
  • Your password has expired.
  • Bank details have changed.

The urgency makes people act before they inspect the address properly. Once the victim reaches the fraudulent site, the attacker may collect credentials, payment details, personal information, or an instruction to transfer money.

Phishing is built around this kind of deception: fraudulent messages or lookalike websites designed to obtain sensitive personal, corporate, or financial information.

What to check

When reviewing a suspicious link, begin with the real domain—not the most familiar word in the URL.

Check:

  • The complete sender address after the @ symbol.
  • The full website address before entering any information.
  • Whether the actual domain matches one your business owns or has publicly confirmed.
  • Whether the brand name appears only in a subdomain or after the first /.
  • Whether an extra word, hyphen, spelling change, number, or unusual extension changes the address.
  • Whether the message creates urgency, requests payment, asks for a login, or demands a security code.

A secure padlock or https:// does not prove a site is genuine. It means the connection between the browser and that site is encrypted; it does not confirm who operates the site.

What businesses should do

Publish the domains your customers, staff, and suppliers should expect you to use. Make payment, support, login, and official contact channels clear on your genuine website.

Monitor variations of your name across common spelling errors, added words, TLDs, and character substitutions. Treat domains that combine your name with finance, payment, login, account, delivery, support, or security terms as a priority for review.

If a fake address is actively impersonating your business, preserve evidence before it disappears. Save the exact URL, screenshots, fraudulent emails, sender details, headers, copied content, and any payment or login form. Use relevant provider abuse channels to report the domain, host, email account, payment flow, advert, or social profile involved.

The TLD Project helps SMEs identify deceptive domain variations, assess how they are being used, and prepare evidence-led action against Domain Spoofing.

Domain Spoofing
The TLD Project: Empowering everyone to take professional action.

Domain Takedowns

Domain Takedowns: How to Remove a Fraudulent Website

< BLOG

Domain Takedowns: How to Remove a Fraudulent Website

Domain Takedowns are not a click on a single button or one request to one provider. A fraudulent website may depend on a domain registrar, web host, email service, payment processor, advert platform, and search listing—all of which can require separate reports. The strongest approach is to preserve evidence first, identify which service is enabling the harm, and submit a factual report that shows exactly how the domain is impersonating your business. Screenshots, full URLs, fraudulent messages, page copies, email headers, and proof of your genuine brand give providers the information they need to act.

Finding the scam is only the first step.

A copied website can be live within minutes. It may disappear when challenged, reappear on a new host, change its content, or move behind another domain. The task is not simply to ask somebody to “take it down”; it is to identify the right part of the attacker’s setup and provide a clear reason for action.

One scam may involve several separate services:

  • A domain registrar that manages the web address.
  • A hosting provider that serves the copied website.
  • An email provider used to send fraudulent messages.
  • A payment provider receiving money.
  • An advertising or social-media platform directing people to the scam.
  • A search engine indexing the fraudulent page.

Each may have a different reporting route and may be able to act on a different part of the operation.

That is why The TLD Project helps businesses prepare evidence-led Domain Takedowns rather than relying on a vague complaint that may be delayed or rejected.

Domain Takedowns

Domain Takedowns do not always mean the domain itself is deleted. The outcome depends on the type of abuse and the provider that can act.

A hosting provider may remove a cloned webpage while the domain remains registered. A registrar may suspend the domain so it no longer resolves. An email provider may disable mailboxes used for impersonation. A payment provider may close a fraudulent checkout account. A search engine or browser service may warn users or reduce the page’s visibility.

The immediate objective is to stop the harmful use as quickly as possible.

For active phishing, malware, and other DNS Abuse, registrar and registry rules can support action against the domain. In the first six months of formal DNS-abuse enforcement under updated ICANN requirements, more than 2,700 abusive domains were suspended and more than 350 phishing websites were disabled through resolved investigations.

What makes a strong report

A report works best when it allows the recipient to verify the issue without guessing what has happened.

Include:

  • The exact fraudulent domain and complete URLs.
  • The date, time, and time zone when you captured the evidence.
  • Screenshots showing the domain in the browser address bar.
  • Copies of phishing emails, text messages, adverts, or social posts using the domain.
  • Full email headers where the domain has been used for email fraud.
  • Screenshots of copied branding, pages, product images, contact details, login forms, or payment journeys.
  • A link to your genuine website and proof that you own or represent the business being impersonated.
  • A concise explanation of the fraud: credential theft, payment diversion, counterfeit sales, copied site, false job advert, or customer-support scam.
  • Any evidence of customer confusion, attempted payments, or messages received.

For rights-based domain disputes, standard evidence can include dated website screenshots, fraudulent emails, correspondence, and proof of brand or trademark rights.

Send it to the right place

A fake website can involve a chain of providers. Reporting only one may not always stop every part of the operation.

Start with the hosting provider when the urgent issue is an active cloned page, credential form, malware download, or fraudulent checkout. The host is often the party able to remove the visible content quickly.

Report to the registrar when the domain itself is being used for phishing, malicious email, or other abuse and the host cannot resolve the issue. The registrar can investigate the registration and, where appropriate, suspend or disable the domain.

Report supporting infrastructure too. If an advert is sending traffic to the scam, report the advert. If a payment page is collecting money, report the merchant account. If an email platform is being used for impersonation, report the sender and include full headers.

This is not duplication of effort. It removes the routes an attacker uses to find victims, collect money, and continue operating.

What not to do

Do not enter passwords, card details, payment information, or personal data into a fraudulent site to prove that it works. Do not rely on one screenshot without showing the full address. Do not make allegations you cannot support with evidence.

Avoid contacting the attacker unless you have taken advice and understand the purpose of doing so. A warning can cause them to remove evidence, move the site, or switch to another domain before you have documented the abuse.

Also avoid treating every similar domain as a takedown case. A business with a similar name may have a legitimate reason to use it. Domain Takedowns are most effective when there is clear evidence of fraud, impersonation, harmful content, or bad-faith use.

After the takedown

Domain takedowns are interruption, not always a final resolution. The attacker may register a new variation, move the copied site, or use a different email address.

Keep your evidence record, warn affected customers through trusted channels where necessary, and monitor for related domains and content. If a customer has entered credentials or made a payment, advise them to contact the relevant account or payment provider promptly through an independently verified route.

The TLD Project helps SMEs identify fraudulent domains, assemble evidence, and submit professional Domain Takedown requests across the infrastructure supporting the scam.

After the takedown

A takedown is an interruption, not always a final resolution. The attacker may register a new variation, move the copied site, or use a different email address.

Keep your evidence record, warn affected customers through trusted channels where necessary, and monitor for related domains and content. If a customer has entered credentials or made a payment, advise them to contact the relevant account or payment provider promptly through an independently verified route.

The TLD Project helps SMEs identify fraudulent domains, assemble evidence, and submit professional Domain Takedown requests across the infrastructure supporting the scam.

Domain Takedowns
The TLD Project: Empowering everyone to take professional action.

DNS Abuse

DNS Abuse: How Criminals Exploit the Domain Name System

< BLOG

DNS Abuse: How Criminals Exploit the Domain Name System

DNS Abuse is the use of domain names or the Domain Name System to support harmful online activity. DNS is what connects a web address, such as yourbusiness.com, to the server that hosts it; criminals can exploit this infrastructure by registering deceptive domains, sending phishing emails, hosting malware, or redirecting visitors to fraudulent sites. In the formal ICANN definition, DNS Abuse covers malware, botnets, phishing, pharming, and spam when it is used to deliver one of those attacks.

The internet needs addresses. Criminals use them too.

When someone enters your website address, their browser needs to locate the server where your site is hosted. The Domain Name System or DNS makes that possible.

It works in the background. People do not need to remember numerical internet addresses. They use a name such as yourbusiness.com, and DNS helps direct them to the right place.

That convenience also creates an opportunity for abuse.

A criminal can register a convincing domain, configure it to send emails, point it at a fake website, or use it to direct victims to harmful content. The address becomes part of the attack infrastructure: it helps make the scam look like a normal online interaction.

DNS Abuse is the technical term for malicious activity that makes use of domain names or DNS processes. It is broader than a fake website and broader than brand impersonation.

DNS Abuse

The Domain Name System is often described as the internet’s address book. It connects memorable names—such as yourbusiness.com—to the IP addresses that computers use to communicate.

DNS Abuse is not one specific attack. It is a category covering harmful activity that uses domains or DNS to deceive, redirect, infect, or control systems.

Under the definition used in ICANN’s registry and registrar agreements, DNS Abuse includes:

  • Phishing — tricking people into revealing passwords, account details, or financial information.
  • Malware — software that damages systems, steals information, or provides unauthorised access.
  • Botnets — groups of compromised devices controlled by an attacker.
  • Pharming — secretly redirecting someone to a fraudulent site or service.
  • Spam — when bulk messages are used to distribute or support one of the other forms of abuse.

This definition is intentionally specific. Not every unwanted, misleading, or disputed website will meet the formal definition of DNS Abuse. A complaint about copied content, a trademark dispute, or poor business practice may need a different reporting or legal route.

How it affects businesses

For most SMEs, DNS Abuse does not begin with a technical alert. It begins with a customer asking why they received a strange email, a supplier querying a payment instruction, or an employee reporting a suspicious link.

The domain may use your business name, imitate one of your services, or appear unrelated. What matters is the role it plays in the harm.

For example, an attacker may register a domain that resembles your company and send messages from it. The website may host a login page that captures passwords, or the domain may be used only for email-based invoice fraud. In another case, the attacker may compromise a legitimate domain and use it to distribute malware, making the message appear more trustworthy.

The common thread is that domains and DNS are being used as part of the attack—not merely as a place to publish information.

Phishing, pharming and impersonation

These terms are often confused, but they describe different forms of risk.

Phishing persuades someone to take an action. The attacker sends a message or creates a fake page and relies on the victim entering information, making a payment, or downloading something.

Pharming changes or interferes with where the victim is sent. Instead of the person choosing a deceptive link, the attacker may manipulate DNS information so that a genuine-looking address leads to a fraudulent destination.

Domain impersonation is about false identity. The attacker uses a domain that suggests a connection with your business to gain trust. It may be used for phishing, payment diversion, cloned websites, or other fraud.

A business can be affected by any one of these on its own, or by several at once.

Why DNS Abuse can be hard to spot

The DNS operates behind the scenes, and attackers can change their setup quickly. A malicious domain can move to a new hosting provider, switch from a fake shop to a phishing page, stop resolving, or redirect only certain visitors.

This means that a domain should be assessed based on evidence, not appearance alone. A parked page, error message, or blank screen may not tell the whole story. The same domain could still be sending emails, used in a QR-code campaign, or configured for a future attack.

For an SME, the practical question is not whether you can diagnose DNS records yourself. It is whether a domain is connected to your business name and being used to mislead, harm, or defraud people.

What to do

If you discover a suspicious domain, preserve the details while they are available. Record the full address, screenshots, timestamps, copied content, message headers, redirect paths, and any payment or login request.

Identify the nature of the problem before reporting it. A malicious login page, malware download, fraudulent payment request, or deceptive email may be handled through an abuse process. A disputed brand name with no active fraud may require a different evidence and enforcement route.

Do not enter passwords, payment details, or personal information into a suspected fraudulent site. The TLD Project helps SMEs monitor domains connected to their brand, identify signs of DNS Abuse and impersonation, and prepare evidence for professional action.

DNS Abuse
The TLD Project: Empowering everyone to take professional action.

Domain Squatting

Domain Squatting: When Someone Registers Your Brand Name First

< BLOG

Domain Squatting: When Someone Registers Your Brand Name First

You may legitimately not be the only business using a domain name. Many names are descriptive, local, or used independently by businesses in different sectors or countries. A domain registered by someone else is not automatically evidence of wrongdoing, domain squatting or even where it resembles your trading name.

The concern begins when the registration appears intended to exploit your reputation: for example, the holder has no genuine connection to the name, tries to sell the domain to you at an inflated price, redirects visitors for commercial gain, or creates confusion about who they represent. In a formal domain dispute, the key questions are usually whether you have rights in the name, whether the registrant has a legitimate interest, and whether the domain was registered and used in bad faith. The TLD Project monitors, reports and allows valid business users to act.

You launch a business. Someone else owns the address.

You have chosen a name, started trading, developed a website, printed stationery, gained customers, or built a reputation. Then you discover that the matching domain has already been registered.

Sometimes this is frustrating but innocent. The name may be generic, used by another legitimate business, or registered long before you started trading.

Sometimes it is deliberate. The registrant may know your business exists and be waiting for you to make an offer. They may list the domain for sale, hold it inactive, redirect it to another company, or use it to confuse people looking for you.

That distinction matters. A domain name is registered on a first-come, first-served basis, but registration alone does not give someone unlimited rights to exploit another business’s brand by domain squatting.

Domain Squatting

Domain squatting is often used interchangeably with cybersquatting. It generally describes bad-faith registration of a domain name that matches or closely resembles someone else’s protected brand, business identity, product, or service.

The key phrase is bad faith.

If a person independently owns a similar name for a legitimate business, has a genuine reason to use it, or registered it before your brand existed, they may have a valid interest in the domain. A dispute is not automatically won because the address contains words that resemble your company name.

However, certain facts can indicate a more serious issue:

  • The domain is identical or confusingly similar to your established brand.
  • The registrant has no apparent business, product, or service connected to the name.
  • The domain is offered to you for a price far beyond normal registration costs.
  • It redirects visitors to a competitor, advert page, or unrelated commercial site.
  • The registrant has registered multiple domains based on other businesses’ names.
  • The domain is used to falsely suggest affiliation with your company.
  • The registration appeared after your business, trademark, website, or marketing campaign became visible.

Under the UDRP framework used for many generic domain extensions, a complainant generally needs to establish rights in a relevant trademark or service mark, show that the registrant lacks legitimate interests in the domain, and show that the domain was registered and used in bad faith.

Squatting is not always phishing

A squatted domain may never send a phishing email or host a fake website.

The registrant may be holding it because they expect the real business to want it. They may place it on a resale marketplace, cover it in adverts, or use it to divert search traffic. In some cases, the domain remains inactive for years.

That can still cause a commercial problem. You may be unable to use the address for a new product, international expansion, a campaign name, or a clearer version of your business identity. Customers may also end up at the wrong site, especially where the name is short, memorable, or commonly typed.

This makes domain squatting different from an active impersonation attack. Domain impersonation focuses on deceiving people by pretending to be your business. Domain squatting can involve that behaviour, but it can also be about blocking, resale, or traffic diversion.

The distinction affects your next step. Active fraud may require urgent abuse reporting and customer protection. A disputed inactive domain may instead require evidence gathering, negotiation, or a formal rights-based complaint.

What to check first

Before assuming a domain has been squatted, establish the facts.

Check when the domain was registered and compare that date with your business launch, use of the name, trademark registration, website history, and public marketing. Review the domain’s current content, historical use where available, sale listing, redirects, and any connected social or business profiles.

Then ask practical questions:

  • Does the registrant appear to have a legitimate connection with the name?
  • Is the name distinctive, or is it a common descriptive phrase?
  • Is the domain being offered for sale specifically to you or your competitors?
  • Is it being used to benefit from confusion with your brand?
  • Has the registrant created other domains that follow the same pattern?
  • Is there evidence that customers, suppliers, or staff have already been confused?

Keep records of everything. Screenshots, registration dates, sale pages, redirected destinations, emails, proof of your brand use, and examples of confusion can all be important if the matter escalates.

Your options

Do not assume you must pay immediately. A high asking price can be part of the strategy, and payment does not always resolve the wider risk if related domains have also been registered.

Your available route depends on the domain, your rights, the evidence, and whether there is active harm:

  • Monitor the domain and related registrations where there is no immediate abuse.
  • Contact the registrant only where this is appropriate and you have a clear commercial reason.
  • Report active phishing, malware, fraud, or impersonation to the relevant provider through its abuse channel.
  • Seek specialist legal advice where the domain affects a valuable name, active trading, or a registered trademark.
  • Consider a domain-dispute procedure where you can evidence your rights and bad-faith registration and use.

For many generic domain extensions, the UDRP is an administrative process that can lead to the transfer or cancellation of an abusive domain registration, rather than financial compensation.

The TLD Project helps SMEs identify brand-related domain registrations, distinguish potential squatting from active impersonation, preserve evidence, and decide when professional action is justified.

Domain Squatting
The TLD Project: Empowering everyone to take professional action.

Domain Impersonation

What is domain impersonation? How fake website targets your web address

< BLOG

Domain impersonation: when criminals copy your website address

A criminal does not need access to your website, email account, or internal systems to impersonate your business. They can register a separate domain that borrows your name and use it as the foundation for a scam.

That domain becomes a false point of contact. It can appear in an email address, a paid advert, a QR code, a social-media profile, an invoice, or a cloned website. To the recipient, it can look like your business is behind the communication.

The threat is not limited to a single typo or one type of scam. Domain impersonation is the wider problem: the deliberate use of a domain name to create a false association with a genuine business.

Understanding what is happening matters, but it does not remove the fake domain or stop the harm. That is why we built The TLD Project: to help businesses identify suspicious domain registrations, collect evidence, and take professional action.

Domain Impersonation

Domain Impersonation is the use of a misleading domain name to pretend to be a genuine organisation, brand, person, product, or service.

A domain name is the address people type into a browser, such as yourcompany.com. Criminals know that customers rarely inspect every character carefully, particularly when they are busy, on a mobile device, or responding to an urgent-looking email.

They register a similar address and rely on that moment of inattention.

A fake domain might include:

  • A spelling mistake, such as yourcompnay.com
  • A missing or repeated letter, such as yourcomany.com or yourccompany.com
  • A hyphen, such as your-company.com
  • A word added to the brand, such as yourcompany-login.com
  • A different ending, such as yourcompany.co, yourcompany.shop, or yourcompany.site
  • A visually similar character that makes a fake address look legitimate at a glance

This is not always one single attack method. Domain Impersonation is the umbrella term for several ways a criminal can misuse a similar or deceptive domain name. Typosquatting, combo squatting, homoglyph attacks, website cloning, and phishing domains are all ways an attacker may carry it out.

The fake domain may be used immediately, or it may sit dormant until the attacker launches a campaign. A newly registered domain can become a phishing site within hours, then disappear or redirect somewhere else once it has been reported.

What attackers want

The attacker is trying to borrow the credibility your business has already built.

A familiar company name reduces suspicion. A domain such as yourbrand-billing.com can make a payment request, customer-support message, delivery update, quotation, or recruitment email appear credible before the recipient has checked it properly.

The domain itself may support several stages of fraud. It can give the attacker a believable sender address, host a cloned page, redirect a victim to another destination, or be used as proof that a fraudulent organisation is “real”.

For SMEs, the most damaging outcome is often payment diversion. A criminal can use a brand-related domain to impersonate a finance contact, advise that bank details have changed, and attempt to intercept a payment from a customer or supplier. They may also use it to run fake support conversations, obtain copies of invoices, or build trust before making a fraudulent request.

In this context, the domain is not merely a web address. It is part of the attacker’s identity.

Why it matters

Domain impersonation creates a problem that can spread beyond the initial victim. When a customer, supplier, or employee believes the scam came from your business, you may need to investigate the incident, explain what happened, reassure affected people, and restore confidence.

The business impact can include:

  • Disputed or diverted payments.
  • Lost sales from fake offers, fraudulent quotations, or counterfeit listings.
  • Customer-service time spent handling reports of messages you did not send.
  • Suppliers questioning whether legitimate emails or invoices are genuine.
  • Reputational harm caused by a fraudulent operation using your name.
  • Pressure to respond quickly while evidence, hosting arrangements, and the attacker’s infrastructure can change.

A domain with no visible website may still have a purpose. It could be used only for email, redirect traffic elsewhere, or remain available until the attacker chooses to launch a campaign.

What to do next

Treat the discovery as an evidence and communications issue, not simply a domain-name issue.

First, preserve what you can see before the domain changes. Capture the full URL, the date and time, screenshots, copied content, email messages, sender addresses, and full email headers. Keep a record of who received the message and what the attacker asked them to do.

Next, establish the business impact. Has the domain been used to request payment, collect credentials, advertise products, impersonate staff, or contact suppliers? Are customers already receiving messages from it? This determines whether you need an immediate warning through your verified website, customer mailing list, or established account-management channels.

Then prepare a clear report that separates suspicion from evidence. The strongest takedown requests identify your genuine domain, the suspected impersonation domain, the way it is being used, and the supporting material, such as screenshots, copied content, email messages, headers, redirects, or payment requests.

Do not enter passwords, payment details, or personal information into a suspected fraudulent website to investigate it. Use the official abuse-reporting channels provided by the relevant domain registrar, hosting provider, email provider, browser security service, or payment platform.

Domain Impersonation
The TLD Project: Empowering everyone to take professional action.

Defensive domain registrations

Defensive Domain Registration

< BLOG

Defensive Domain Registration: What to Register and What to Monitor

Defensive domain registration can reduce brand impersonation risk, but it does not stop attackers registering the many other lookalike domains you do not own. The TLD Project monitors newly registered domains that may impersonate your business, helping you find and assess suspicious activity early.

What Is Defensive Domain Registration?

Defensive domain registration is the practice of registering domains that are similar to your primary brand domain. Organisations may acquire these domains to reduce the opportunity for third parties to use them in phishing campaigns, fraud or customer impersonation.

For example, a business operating from yourbrand.com might own related domains that contain a common spelling variation, an alternative top-level domain or a hyphenated version of its trading name.

A domain you own cannot be registered and used by someone else. However, ownership only protects the finite list of domains in your portfolio. It does not tell you when a third party registers a new domain that resembles your business.

That gap is where domain impersonation monitoring becomes essential.

Why Defensive Registration Has Limits

Every brand has a large potential domain-variant space. This includes misspellings, character substitutions, additional words, alternate top-level domains, internationalised domains and phishing-oriented terms.

Even a short brand name can be adapted into hundreds or thousands of plausible domains.

Attackers may register domains that include:

  • Typographical variations of a company or product name
  • Brand names paired with words such as “login”, “secure”, “verify”, “account”, “billing” or “support”
  • Alternative domain extensions
  • Hyphenated versions of a brand
  • Character substitutions designed to look similar at a glance
  • Variations targeting specific products, services, campaigns or regions
  • Domains made to resemble customer portals, payment pages or employee login systems

It is neither practical nor necessary to own every possible variation. More importantly, defensive registration alone cannot tell you which third-party registrations are appearing, becoming active or being used maliciously.

The Role of Domain Monitoring

Domain monitoring provides visibility beyond your organisation’s own portfolio.

The TLD Project monitors newly registered domains that may resemble your brand. It is built to help businesses identify potential impersonation domains, assess whether they are relevant and decide whether they require investigation or escalation.

Monitoring gives your team the opportunity to see potential threats earlier, rather than learning about them only after a customer receives a phishing email or a fraudulent website is reported.

The TLD Project can support investigations involving:

  • Newly registered lookalike domains
  • Potential typo-squatting domains
  • Brand-plus-keyword domain registrations
  • Suspicious use of alternative TLDs
  • Domains that may imitate login, billing, account or support services
  • Registrations that may warrant internal review, reporting or takedown action

Registration and Monitoring Work Differently

Defensive registration and monitoring are complementary, but they solve different problems. Registration concerns the domains under your control. Monitoring concerns the domains outside it.

What Should Your Team Monitor?

A domain is not automatically malicious because it resembles your brand. Many registrations will be harmless, unrelated or made by legitimate businesses with similar names.

The key is to identify registrations that have the potential to confuse your customers, employees, suppliers or partners.

High-interest domains may include those that:

  • Closely resemble your primary brand or product domain
  • Contain a likely typing mistake in your name
  • Use brand terms alongside phishing-related language
  • Mimic a customer login, payment, verification or support service
  • Appear shortly before a major campaign, product launch or seasonal sales period
  • Target a region, market or service that is important to your business
  • Are associated with suspicious web content, email activity or other indicators of misuse

The TLD Project helps bring these potential cases into view so your team can apply business context and decide whether the registration represents a credible impersonation risk.

From Detection to Response

Finding a lookalike domain is the beginning of the process, not the end.

When a potentially relevant registration is identified, an organisation may need to determine:

  • Whether the domain is genuinely similar enough to create confusion
  • Whether it has active DNS records, web content or email configuration
  • Whether it is being used in phishing, fraud or brand impersonation
  • Whether customers, employees or suppliers could be affected
  • Whether the issue should be monitored, investigated, reported or escalated
  • Whether legal, security, fraud or customer-support teams need to be involved

The TLD Project provides the domain visibility that supports this initial assessment. Your team retains control over the decision to investigate, report, pursue a takedown or take no further action.

Domain Monitoring Supports Earlier Action

Brand impersonation often develops quickly. A domain may be registered, configured and used in a phishing campaign within a short period.

Earlier visibility can help organisations:

  • Reduce time spent manually searching for brand lookalikes
  • Identify potential phishing infrastructure before it is widely reported
  • Prioritise suspicious registrations for review
  • Preserve details for internal investigation and external reporting
  • Provide security, fraud and legal teams with relevant domain intelligence
  • Improve awareness of how attackers may be targeting the brand

Monitoring does not guarantee that every malicious domain will be detected or that every suspicious domain is malicious. It gives organisations a more informed starting point for evaluating the threat landscape around their brands.

Secure the Domains You Already Own

Your existing domain portfolio still needs strong controls. A legitimate domain can become an impersonation risk if it expires, is transferred without authorisation or has its DNS records changed by an attacker.

For domains your organisation owns, good operational controls include:

  • Using multi-factor authentication on registrar accounts
  • Enabling registrar or transfer locks
  • Restricting account access to authorised personnel
  • Maintaining accurate ownership and billing details
  • Enabling auto-renewal for important domains
  • Reviewing DNS records and domain configuration regularly
  • Maintaining clear ownership records for legacy and defensive domains
  • Using appropriate email authentication for domains that send legitimate email

These controls protect domains already under your control. The TLD Project helps provide visibility into relevant domains outside it.

Defensive Registration Is Not a Complete Solution

Defensive domain registration may form part of a wider brand-protection strategy, but it cannot eliminate domain impersonation risk.

Third parties can continue to register new typo variants, combinations of your brand name and phishing language, alternative extensions, internationalised domains and lookalikes that target a specific product or service.

A practical approach recognises the difference between owning known domains and monitoring the expanding set of domains you do not control.

The TLD Project helps organisations monitor for potential brand impersonation domains as they are registered, so teams can identify relevant risks and take informed action. The source article similarly distinguishes a finite defensive-registration portfolio from the need for continuous monitoring of the wider variant landscape.

Defensive domain registrations
The TLD Project: Empowering everyone to take professional action.