Menu

TLD

de Domain Impersonation

de Domain Impersonation

< BLOG

Why .de domain impersonation matters

A lookalike .de domain may be used in several ways:

  • A cloned website designed to collect credentials or payment details.
  • A phishing email address that appears connected to a recognised business.
  • A supplier or invoice fraud campaign aimed at finance teams.
  • A misleading site that appears to be a local or European branch of an international company.
  • A defensive or speculative registration that creates confusion around a brand.

The risk is often not the domain extension by itself. It is the combination of a trusted brand name, a plausible European country-code domain, and content or email activity designed to mislead someone.

For that reason, businesses should monitor potentially relevant variations of their name, not only the exact-match .com or their own primary domain.

DENIC’s role in .de disputes

DENIC manages the .de country-code top-level domain. Its position is deliberately limited when disputes arise between a domain holder and a third party claiming name or trademark.

DENIC states:

“It is not DENIC’s job to become involved in such disputes.”

It further explains:

“DENIC does not check the contents and/or legality of domains; responsibility for any infringement of rights resides entirely with the holder of the domain concerned.”

DENIC also says it will generally intervene only when a domain dispute has reached a “definitive conclusion,” particularly where there is a final court decision on the substance of the case.

This does not mean a rights holder has no options. It means that a .de domain dispute should not be approached as though the registry will make a quick decision on which party owns the better right to the name.

DENIC does not offer an ICANN UDRP-style dispute-resolution process for .de domains. Its published guidance says it needs a “clear-cut conclusion” before transferring a domain, normally through agreement between the parties or a final legal decision.

What is a DENIC DISPUTE entry?

A DENIC DISPUTE entry is a protective mechanism for someone who believes their name or trademark rights may be infringed by a .de domain.

If DENIC accepts the application, the entry prevents the existing domain holder from transferring the domain to another party while the dispute is ongoing. If the current registration ends, the domain may then pass to the party recorded in the DISPUTE entry.

A DISPUTE entry is useful because it can stop a domain being moved beyond reach while a claim is assessed or pursued.

However, it is important not to overstate what it achieves.

A DENIC DISPUTE entry:

  • Does not prove that infringement has occurred.
  • Does not decide who has the superior right to the domain.
  • Does not automatically suspend a website or email service.
  • Does not automatically transfer ownership to the claimant.
  • Does not prevent the current holder from continuing to use the domain while it remains registered.
  • Is initially limited to one year, although it may be renewed where appropriate evidence is provided.

In short, it is a measure to preserve a possible claim—not a standalone takedown or recovery process.

A practical response process

When .de domain impersonation is suspected, it helps to separate the incident into two connected but different workstreams: stopping active abuse and protecting the long-term claim to the domain.

  1. Capture evidence quickly. Record the full domain name, registration date where available, DNS records, mail-exchange records, screenshots, page source, email headers and examples of misleading content.
  2. Assess the actual activity. Determine whether the domain is inactive, parked, being used for a misleading website, configured for email, or connected to phishing or fraud.
  3. Report active technical abuse. If there is a phishing page, fraudulent content or malicious email activity, report the relevant service through the hosting provider, registrar, email provider and other appropriate abuse channels. A domain-rights dispute and an abuse report are not the same process.
  4. Consider the brand-rights position. Review the relevant company name, registered trademarks, trading history, customer confusion and the evidence linking the domain to misuse.
  5. Consider a DENIC DISPUTE entry. Where there is a credible rights-based claim, a DISPUTE entry may help prevent transfer while the issue is dealt with. The application requires an enquiry to DENIC and supporting material.
  6. Obtain appropriate legal advice. Where the objective is domain transfer, a formal injunction or a decision on trademark or name rights, advice from a lawyer experienced in German domain and intellectual-property matters may be appropriate.

Brand protection is global

The central lesson is not that .de is unusually dangerous or that every lookalike domain will lead to legal action.

It is that domain protection is global, while enforcement processes are often local. A business may identify a suspicious domain in minutes, but the route to preserving or recovering that domain can depend on the rules of the specific registry and jurisdiction involved.

For businesses with an international footprint, effective domain brand protection means detecting suspicious registrations early, retaining evidence, understanding the difference between abuse disruption and ownership recovery, and knowing when a formal .de domain dispute may be necessary.

A proactive monitoring service should therefore flag .de variations alongside other country-code and generic top-level domains—before a potentially misleading registration becomes a live phishing, fraud or reputational incident.

de Domain Impersonation
The TLD Project: Empowering everyone to take professional action.

New gTLD Abuse

New gTLD Abuse: Why .shop, .online and .site Can Raise Risk

< BLOG

New gTLD Abuse: Why .shop, .online and .site Can Raise Risk

New gTLD Abuse is not about one “bad” extension. It is about the way an attacker uses an extension to make a fake domain feel believable. A criminal may choose .shop for a counterfeit store, .support for a fake helpdesk, or .online for what appears to be an alternative company website. The brand name, the added words, the extension, and the content all work together to create a false impression of legitimacy.

The extension looks relevant. That does not make the site real.

A business may own one or two domain names that reflect where it trades: perhaps a .com, .co.uk, or country-specific address. Customers come to recognise that address over time.

An attacker can register the same or a similar business name under another extension. They do not need to copy every part of the genuine address. All they need do is generate a new gTLD abuse domain. They only need an alternative that feels plausible when someone sees it in an email, advert, search result, text message, or social-media post.

A .shop address can look appropriate for a retailer. A .support address can appear to belong to a customer-service team. A .online or .site domain can pass as an alternative official website. The extension becomes part of the deception because it supports the story the attacker is telling.

That is why The TLD Project monitors beyond the domains you already own. Your customers may encounter your business name under an extension you never registered.

New gTLD Abuse

A gTLD is a generic top-level domain: the final part of a web address, such as .com, .net, .shop, or .online.

“New gTLD” usually refers to the large range of generic extensions introduced beyond the older, familiar group of .com, .net, .org, and similar domains. These give legitimate businesses more choice when creating an online identity.

They also create more opportunities for impersonation.

New gTLD Abuse happens when an attacker registers a domain using a newer extension and uses it to support phishing, counterfeit sales, fake customer support, fraudulent payments, cloned websites, or other misleading activity.

Examples might include:

  • yourbrand.shop
  • yourbrand.online
  • yourbrand.site
  • yourbrand.store
  • yourbrand.support
  • yourbrand.services
  • yourbrand.accountants
  • yourbrand.help

The domain could contain your exact business name, a misspelling, or your name combined with another word. The new extension is only one component. The concern is whether the full domain is being used to falsely suggest a connection with your business.

Why these extensions can help a scam

People read domain names as language, not as technical identifiers.

A customer looking for products may see .shop and assume the site is an official store. Someone who needs help may trust an address that includes .support or .help. An email linking to a .online or .site domain may look like a normal alternative to a company’s main .com address.

The attacker chooses an extension that reduces questions.

For example, a fake retailer may use yourbrand.shop and reproduce product images, prices, delivery information, and a checkout form. The customer sees a familiar name and a shopping-related extension, then enters payment details.

A different criminal may use yourbrand.support to create a fake service desk. They can send messages telling customers that an account has been compromised, an order needs attention, or a refund is available. The goal may be to capture login details, card information, or a payment.

The extension does not need to be suspicious. In fact, it is more useful to the attacker if it appears normal and relevant.

Do not treat every new gTLD as dangerous

A new extension is not evidence of criminal activity.

Legitimate businesses use .shop, .online, .site, .store, .agency, .services, and many other gTLDs every day. An SME may choose one because its preferred .com is unavailable, because it better describes its service, or because it offers a clearer brand identity.

Criminals can also use older extensions. A fraudulent domain may be a .com, .net, country-code domain, or any other available ending. ICANN notes that a phisher can use any domain in any TLD to spoof any other TLD string.

The right question is not:

  • Is .shop or .online unsafe?

The better question is:

  • Is this domain falsely claiming to be connected to my business, and is it being used to mislead people?

Look for evidence such as copied branding, fake login pages, fraudulent emails, payment requests, counterfeit products, misleading adverts, or a false claim that the site is your official business.

What to monitor

Monitoring only the extensions you own leaves gaps. You do not need to register every possible TLD, but you should know when your business name appears under extensions that fit common scam scenarios.

Prioritise combinations connected to how your business operates:

  • Retail and orders: .shop, .store, .sale, .online
  • Customer support: .support, .help, .services, .contact
  • Logins and accounts: .site, .online, .app, .cloud
  • Payments and finance: domains combining your name with payment, billing, invoice, account, or secure-related terms
  • Locations and expansion: country-code domains or extensions associated with markets where you trade

A single registration may not justify action. However, a cluster of domains using your name across shopping, support, payment, or login-related extensions can indicate deliberate preparation for impersonation.

ICANN introduced safeguards for the new gTLD programme specifically because expanding the domain space created potential for abusive, malicious, and criminal activity.

What to do when you find one

First, establish whether the registration is genuinely connected to your business. It could be an authorised reseller, franchise, distributor, partner, or an unrelated organisation using a similar name.

If it is not legitimate, record the exact domain, registration information where available, screenshots, copied content, redirects, fraudulent messages, and any payment or credential collection process. Do not enter personal information, passwords, or card details into a suspicious site.

Then assess the level of risk:

  • A registered but inactive domain may need monitoring.
  • A domain claiming to represent your business may require a report or formal contact.
  • A domain hosting a cloned site, phishing page, or fraudulent checkout requires prompt, evidence-led action.

The TLD Project helps SMEs monitor their business names across gTLDs, identify suspicious extensions and brand variations, and take professional action when a domain is being used to impersonate them.

New gTLD Abuse
The TLD Project: Empowering everyone to take professional action.

TLD Abuse

TLD Abuse: How Domain Extensions Are Used to Impersonate Brands

< BLOG

TLD Abuse: How Domain Extensions Are Used to Impersonate Brands

It’s a common pattern where others look to impersonate a business and its brand through TLD abuse.

The name may be yours. The ending may not be.

You may own yourbusiness.co.uk, but that does not prevent someone else registering yourbusiness.com, yourbusiness.shop, yourbusiness.support, or another available variation.

For many customers, the first part of the address is what they notice. They see a familiar business name and assume the rest must be legitimate. An attacker can take advantage of that assumption by selecting an extension that fits the message they are sending.

A .shop address can support a counterfeit store. A .support or .help address can make a fake customer-service message feel credible. A .finance, .accountant, .pay, or .billing style name can add apparent legitimacy to an invoice or payment request.

The extension is not the attack by itself. The abuse comes from using a domain name to misrepresent who is behind a website, email, or online service.

That is why The TLD Project monitors more than one version of your business name. Impersonation does not stop at the extensions you have chosen to register.

What is a TLD?

TLD stands for Top-Level Domain. It is the final part of a domain name, after the last full stop.

In yourbusiness.co.uk:

  • yourbusiness is the domain name.
  • .co.uk is part of the address ending used for UK commercial domains.
  • .uk is the country-code top-level domain.

In yourbusiness.com, .com is the TLD. In yourbusiness.shop, .shop is the TLD.

There are now many extensions available. Some are broad, such as .com, .net, and .org. Others indicate a country or territory. Others describe a subject, industry, activity, or audience, including extensions such as .shop, .online, .app, .agency, .store, and .services.

That choice gives legitimate businesses more naming options. It also gives criminals more opportunities to register a brand-related domain that looks relevant to the fraud they want to run.

How extensions add credibility

An attacker does not need to find an exact copy of your domain. They need a variation that looks believable in context.

Consider a business that trades from:

  • yourbrand.co.uk

A criminal might register:

  • yourbrand.com
  • yourbrand.shop
  • yourbrand-support.com
  • yourbrand.online
  • yourbrand-payments.com
  • yourbrand.store

Each one can serve a different story.

A fake shop may use .shop or .store. A false technical-support message may point to an address containing “support”. A payment scam may use “billing”, “accounts”, or “payments”. A recruitment scam may use “careers” or “jobs”.

The attacker is using the domain extension and the words around your brand to create a quick impression of legitimacy. The full address may be false, but it is designed to look reasonable before the recipient stops to question it. This is what TLD abuse looks like.

This matters because phishing does not always rely on obvious misspellings. A domain can be spelled perfectly and still be fraudulent if it falsely suggests a connection with your business. Phishing through fraudulent messages or copycat websites is recognised as DNS Abuse.

Why SMEs should monitor TLDs

SMEs often register the domain extension most relevant to their market and leave the rest alone. That is sensible: no business can defensively register every possible extension and every variation of its name.

But not registering every domain does not mean ignoring what is being registered.

A business can be exposed when an attacker uses its name under an alternative extension to:

  • Operate a fake online shop.
  • Send emails that appear to come from customer support or accounts.
  • Create false payment pages or invoice portals.
  • Promote fake job vacancies or recruitment services.
  • Divert traffic from a genuine brand search.
  • Imitate a supplier, distributor, franchise, or regional office.

The risk is shaped by the domain name, its content, how it is configured, and the messages surrounding it—not simply by the extension. A .com can be malicious. A .shop can be completely legitimate. The correct question is not “Is this TLD bad?” but “Is this domain being used to deceive people about who it represents?”

What to look for

Start with domains containing your exact business name or its most likely variations. Then consider the context in which customers, staff, and suppliers expect to interact with you.

Watch for domains that combine your brand with:

  • Support, help, login, secure, account, portal, or verify.
  • Pay, payment, billing, invoice, accounts, refund, or finance.
  • Shop, store, order, delivery, tracking, or returns.
  • Careers, jobs, recruitment, HR, payroll, or training.
  • A country, city, region, or market where you operate.

A suspicious registration is not proof of fraud. It may belong to another legitimate organisation with a similar name, a reseller, a customer, or an unrelated business. What matters is the evidence: copied branding, misleading claims, fraudulent messages, cloned content, credential capture, payment requests, or a deliberate claim of association.

The TLD Project helps businesses identify brand-related domains across TLDs, separate genuine registrations from potential impersonation risks, and gather the evidence needed to take professional action.

TLD Abuse
The TLD Project: Empowering everyone to take professional action.