Domain Use Complaint FAQ
Unauthorised domain use complaint FAQ
Domain spoofing, impersonation, TLD-based attacks and brand mimicking
For the uninitiated this may have already hit you, costing thousands to resolve. This is one of those things that sits there without cost or knowledge of the risks your brand is exposed to every day – forever.
The TLD Project’s domain usage complaint FAQ page helps answer some concerns in a simple, easy to understand way. Our goal is to educate, monitor, protect and empower brands to take the right action at the precise time someone tries to copy-cat your domain and websites.
Is this a problem that IT or website developers can fix?
No – the problem of web address impersonation is that it is external. Anyone can register and activate lookalike email and website – there is not preemptive checks within the current domain registration process. Larger organisations may employ enterprise level domain defense but these dedicated services come with enterprise level pricing costing thousands per month.
The TLD Project looks to remove both cost and complexity from lookalike web address monitoring, identification and fake takedowns.
Do we have to install anything to use The TLD Project?
No – The TLD project is a web application that you access via a web browser and is 100% autonomous to your internal systems.
How does it work?
The TLD Project catches newly activated domains using a different TLD and/or combination of prefix and suffix words, letters and numbers to your core domain. The exact patterns used to spoof your brand and mimic you live websites and emails.
Our 3 step domain takedown request let’s anyone quickly respond to brand impersonation attacks.
What are the chances of a lookalike web address targeting our business?
There is no single answer to this question, the only arguments not to reduce the risk would be cost and ease of use.
From a criminals perspective they do not care about your size, sector or online presence, they are opportunists looking to take advantage of gaps within online interactions. Having early warning and visibility of possible threats is no longer an nice to have in today’s AI driven world. The chances are 1% to 100% and anything in between.
You cannot stop it, but you can see it when it happens.
What is the average price of a commercial domain impersonation takedown?
There isn’t a single “average” price, for a commercial domain impersonation takedown, but UK-market data suggests a typical price runs from roughly £200–£500 at the low end up to £2,500+ for full legal/UDRP-style action per domain, with subscription monitoring/takedown services starting around £750–£1,500/month for ongoing protection.
The TLD Project quashes those prices at £54 per domain, per year.*
*Excluding tax.
How much does it cost?
We believe domain protection should be accessible to all. Cyber threats should not come with enterprise-only pricing. Monitoring for lookalikes should not cost more than the threat itself.
Fair use takedowns included: Your plan includes a reasonable number of standard takedowns per domain per year. No additional charges, everything’s included in one low-cost, annual subscription.
The TLD Project monitoring is £54.00 plus tax, a year, per core domain (£60.80 including tax).
Core Domain Examples:
thetldproject.com
thetldproject.co.uk
Owned Domain Examples:
thetldproject.uk
thetldproject.net
supportthetldproject.com
*£60.80 per protected brand domain a year, including tax. You can add verified domains you own at no extra cost, ensuring you are not alerted to your own web assets.
Your subscription comes with a 100% money-back guarantee for the first three months. You may request a full refund at any time during this period, provided no Complaint Report has been created.
**Please note: Creating, downloading, sending or submitting a Complaint Report during the trial period indicates that you are using the Service’s case-management process. Once any of these actions has taken place, the money-back guarantee and eligibility for a trial-period refund no longer apply.
Why is The TLD Project £54 per year?
The TLD Project is built for small businesses that need a practical way to keep watch over their domain name—not an enterprise security platform with complex dashboards, consultants, or long contracts.
For £54.00 (£60.80 including tax) a year, you get focused daily monitoring for suspicious lookalike domains and the tools to prepare clear evidence when you need to make a report.
We keep the service simple: no tiers, no per-report fees, no managed-takedown retainers, and no features designed only for large security teams. That helps keep domain monitoring accessible to the businesses that need it most.
Is there a per domain cost?
Yes, but if you own multiple domains under the same core name these are treated as associated and there is no additional charge.
For example, the following domains would all fall under one (1) subscription.
Core domain
thetldproject.com
Associated domains
thetldproject.net
thetldproject.org
appthetldproject.com
thetldproject-portal.com
etc…
The core is “thetldproject” so anything that includes that is exempt through you listing them as owned by your brand.
Is The TLD Project an enterprise app?
No, in terms of price and yes in terms of functionality. Enterprise solutions garner enterprise price tags. We believe every size of business should be able to monitor their web address and be able to act when targeted.
Can we create an account without subscribing?
Yes, there is no cost to create an account, subscriptions are based on a single domain with payment due when you add one. There is no cost to assign domains under the same core domain – e.g. brand.com, you can add brand.co.uk, brand.net, brand.uk, portal-brand.com, etc without additional subscriptions.
Is The TLD Project a security product?
No. The TLD Project is a domain monitoring and reporting platform, designed as an early-warning tool for the growing risk of web-address impersonation.
It continuously identifies domains that may imitate a business’s legitimate web address, brand, or trading name, helping users spot potential phishing, fraud, customer diversion, and brand-abuse risks earlier.
While it supports wider cybersecurity and brand-protection activity, The TLD Project does not prevent attacks or replace security controls. Instead, it provides timely, actionable intelligence that enables organisations to investigate suspicious registrations and decide whether further action, including reporting or takedown, is appropriate.
It is also a reactive tool, helping victims quickly gather the evidence and produce takedown reports for the relevant recipients.
What is domain mimicking?
Mimicking is also known as spoofing, impersonation and classed as TLD-based attacks. This is when someone intentionally registers a similar domain and copies your brand for their own financial benefit and to the detriment of not only your business but your customers too.
Can The TLD Project be used for domain mimicking takedown?
Yes. Prevention is best, but should you be undergoing domain mimicking, impersonation or domain spoofing The TLD Project’s authoritative reporting and takedown is the fastest solution. The Registrar, Host and Registry report generators allow you to take immediate action.
Is there a subscription?
Yes, you pay a low-cost yearly monitoring fee for each core domain.
Is there a trial?
Yes. Each initial subscription includes a three-month trial period backed by our 100% money-back guarantee. If you decide the Service is not right for you, you can cancel during the first three months and receive a full refund, provided you have not created a case using our case-management process.
Creating a case means asking the Service to prepare a Complaint Report or related complaint record about a suspected mimic domain. Before you create a case during the trial, we will remind you that doing so ends eligibility for the money-back guarantee. This guarantee is separate from, and does not affect, any statutory cancellation rights available to Consumers.
We’ve suffered a domain impersonation, what can we do?
Subscribe to The TLD Project, add the affected domain. Click or enter the offending domain. Build your evidence reports for authoritative submission.
Do you offer membership discounts?
Yes – we work closely with business groups and associations delivering packages that benefit their members not only financially but also, of course, through the monitoring and reporting functions The TLD Project offers.
Can compliance teams benefit?
The TLD Project is not a compliance platform. It is the early warning system that makes a compliance response possible through identifying the threat before your customers, your regulators, or the press do.
For regulated businesses — financial services, healthcare, legal, and insurance firms in particular — domain impersonation isn’t just a reputational risk, it’s a compliance exposure. Regulators increasingly expect firms to demonstrate active monitoring and response to brand abuse, especially where fraudulent domains are used to conduct phishing, credential harvesting, or fraudulent services sold under a firm’s name.
The TLD Project creates a structured record of detected threats, their risk scoring, and takedown activity, giving compliance teams a starting point for demonstrating awareness and response, rather than leaving them with nothing documented at all.
What information does a complaint report contain?
Everything the domain authority, registrar and host need to take immediate action. Each report is prepared separately with the correct evidence for you to simply and efficiently report abuse. For further information simply reach out calling 020 3051 7341 or emailing theteam@thetldproject.com.
What happens if a domain is found to be mimicking our brand?
When a close matching domain becomes active and available to host a website and email you receive email notification asking for human review.
It’s at this point that you’re able to check and if found to be malicious initiate and complete your complaint. Only taking minutes the process allows you to react quickly and take the appropriate action in the knowledge that you are following best practice procedures.
Is a finding and takedown guaranteed?
No. Neither a finding nor a takedown is guaranteed. Identifying potentially impersonating domains is a moving target. Reporting them is important and the app does not need a finding should you discover an attack.
Submitting a takedown request does not guarantee that a suspicious domain, website, email account, or online content will be removed. The final decision rests with the relevant third party, such as the domain registrar, hosting provider, website platform, email provider, search engine, social-media platform, or law-enforcement authority. Each organisation has its own abuse policy, evidence requirements, jurisdictional rules, and review process.
The TLD Project can help identify possible impersonating domains, gather relevant evidence, and support the preparation or submission of an abuse or takedown report. However, we cannot control the recipient’s decision, investigation, timescale, or enforcement action.
A request may be declined or delayed where, for example:
- The evidence does not meet the provider’s threshold for action.
- The domain or site appears legitimate, inactive, parked, or protected by a lawful use.
- The issue falls outside the recipient’s abuse policy or legal jurisdiction.
- The provider needs additional information or a formal legal order.
- The reported content has already changed, been removed, or moved elsewhere.
- The provider’s review process takes longer than expected.
Where a request is not accepted, we may be able to suggest alternative reporting routes.
Important: Our service is intended to support monitoring, evidence gathering, and reporting. It is not legal advice, and it does not guarantee that any domain, website, email service, or content will be suspended, disabled, removed, or transferred.
What is domain mimicking, spoofing, impersonation and TLD-attack?
Basically it’s when a bad actor registers a domain in an attempt to fool people into thinking it is from a legitimate business for fraudulent reasons and financial gain. There are many patterns to this but all have the same negative impact on the affected business – reputational damage, legal exposure and takedown costs.
Common patterns include adding prefix/suffix words, hyphenation and numbers. For example anyone could register “thetldprojectportal.com” and then use that to mimic The TLD Project.
Do you offer a managed takedown service?
The TLD Project is designed as a self-managed platform, giving you full control over monitoring and takedown actions. Our mission is to empower you to take action directly. However, if you ever feel overwhelmed or need extra help, you can raise a support ticket for our team to assist where needed.
Will a mimic get past The TLD Project service?
The TLD Project works upon a domain configuration process focusing on the entered core domain for matching. As a user, you also play a crucial role in identifying domain mimicking – the human in the loop.
No service alone can ever be fully defensive against mimicking, because anyone can register a domain without checks. The TLD Project is an early warning system giving you a valuable first-line of defence to catch and report abuse of your brand. Sophisticated players will outsmart all but the most advanced security services. The good news, these highly-technical attacks tend to target enterprise organisations.
What is a typosquat?
A typosquat is a domain designed to catch people who mistype your web address. It may use a missing, doubled, swapped or adjacent-key letter, or place your brand name on another extension such as .net, .co or .org.
Cybercriminals can use these domains to divert visitors, impersonate your business or support phishing campaigns. For example, someone intending to visit yourbrand.com might be sent to yourbrnad.com instead.
What is the difference between a typosquat and a homoglyph domain?
A typosquat is based on a predictable spelling or keyboard mistake, such as paypa1.com, where the number 1 replaces the letter l.
A homoglyph domain uses characters that look identical or nearly identical to standard letters, often by substituting characters from other alphabets. These domains can be especially convincing because, at a glance, the address may appear to be your genuine domain. The TLD Project monitors both conventional typosquats and internationalised-domain-name (IDN) homoglyph risks.
How many lookalike domains should we register?
You do not need to register every possible variation of your domain. Start with the variants that are most likely to be abused: your exact name on major extensions, plus the closest and most believable typing errors.
The more practical long-term approach is to defensively register a focused set of high-risk domains, then continuously monitor the wider lookalike landscape. That way, you are alerted when a new suspicious registration appears without carrying the cost of owning hundreds of domains.
Does The TLD Project confirm whether a lookalike domain is malicious?
Not automatically. A lookalike domain being registered or active does not, by itself, prove malicious intent, it could be parked, defensively owned or unrelated to your business.
The TLD Project identifies and monitors likely copycat domains, preserves relevant evidence and helps you assess risk. Where a domain appears to be impersonating your brand or supporting fraud, the platform prepares the information needed to escalate a complaint to the appropriate registrar, host or other recipient.
Is there ongoing protection?
A one-off domain search only shows what exists today. The TLD Project monitors your domain landscape every day, records evidence of emerging threats and helps you move quickly when a suspicious lookalike needs investigating or reporting.
How can I check to see that The TLD Project is a legitimate service?
The TLD Project has been developed and is maintained by Unlimited Application Ltd. a UK company registered in England No. 15913087. You can confirm this by visiting the UK Companies House website.
The purpose of this domain use complaint FAQ is to ensure you have full confidence and trust in The TLD Project. If we have no achieved this please let us know. We are more that happy to engage here or through Unlimited Application’s LinkedIn.
Are we missing something in our domain use complaint FAQ?
Please let us know and we’ll be happy to answer that for you and add it to this domain use complaint FAQ page. Simply email theteam@thetldproject.com.
Checkout The TLD Project blog. or send us a message through our contact form.
