A lookalike domain (examp1e.com, example-invoices.com, exarnple.com) is
the usual starting point for invoice fraud: a fake email "from" you, asking a
customer to pay to a new bank account. If someone already received an email
like that, start with
Someone is pretending to be my company:
warning customers and recalling payments come first.
This guide covers getting the domain itself shut down.
1. Collect the evidence first
Abuse teams act on evidence, not on similarity alone. Save:
- The fraudulent email with full headers (in Outlook: File > Properties; in Gmail: Show original). Headers show which servers sent it.
- Screenshots of any website on the domain, with the date.
- DNS records: whether the domain has mail servers (MX) and where its
website is hosted.
dig MX examp1e.comanddig A examp1e.comwill show them. - Registration date. A domain registered last week that copies your name is far more convincing to an abuse team than one from ten years ago.
A lookalike that is only parked, with no mail server and no website, is hard to get removed. Keep watching it; mail servers are often added right before an attack.
2. Find the registrar's abuse contact
Look the domain up on ICANN Lookup. The RDAP result shows the registrar and its abuse contact email and phone. ICANN requires registrars of generic domains (.com, .net and others) to publish an abuse contact and to take steps to investigate reports.
For country-code domains (.co.uk, .de, .co.il and so on), the rules come from the national registry; its website lists how to report abuse.
3. Write a short, specific report
Send it to the registrar's abuse contact, and to the hosting or email provider
the DNS records point to (their abuse address is usually abuse@ their
domain, or a web form). Include:
- the lookalike domain and the domain it imitates;
- what it is used for: "sending invoice fraud emails impersonating our company", not "it looks like ours";
- the evidence, with the email attached as a file or with full headers;
- that you are the owner of the real domain, with contact details.
Phishing and fraud get handled much faster than "trademark" complaints.
4. Report it to the blocklists
Even before a takedown, these reports get the domain blocked in browsers and mail filters:
- Google Safe Browsing
- Microsoft: report an unsafe site
- The Anti-Phishing Working Group: forward the email to
[email protected]
5. When to use UDRP
If the registrar won't act, the Uniform Domain-Name Dispute-Resolution Policy lets a trademark owner ask an approved provider (such as WIPO) to transfer the domain. You must show that the domain is confusingly similar to your mark, that the registrant has no legitimate interest in it, and that it was registered and used in bad faith. It costs fees and takes weeks, so it suits domains that keep being used, not one-off fraud attempts.
6. Prevent the next one
- Publish DMARC at reject so your exact domain can't be spoofed. See DMARC p=none to p=reject.
- Warn the people it's aimed at. Copy-ready emails for staff and customers: phishing warning email templates.
- Watch for new lookalikes, and especially for ones that add mail servers. Tools for this are compared in dnstwist alternatives.
- Agree a rule with customers: bank details never change by email alone.
Check your domain
The free scan generates hundreds of lookalikes of your domain and shows which are registered, how old they are, and which can already send email.