# How to report a lookalike domain and get it taken down

A lookalike domain (`examp1e.com`, `example-invoices.com`, `exarnple.com`) is
the usual starting point for invoice fraud: a fake email "from" you, asking a
customer to pay to a new bank account. If someone already received an email
like that, start with
[Someone is pretending to be my company](/guides/someone-is-pretending-to-be-my-company):
warning customers and recalling payments come first.

This guide covers getting the domain itself shut down.

## 1. Collect the evidence first

Abuse teams act on evidence, not on similarity alone. Save:

- **The fraudulent email** with full headers (in Outlook: File > Properties;
  in Gmail: Show original). Headers show which servers sent it.
- **Screenshots** of any website on the domain, with the date.
- **DNS records:** whether the domain has mail servers (MX) and where its
  website is hosted. `dig MX examp1e.com` and `dig A examp1e.com` will show them.
- **Registration date.** A domain registered last week that copies your name
  is far more convincing to an abuse team than one from ten years ago.

A lookalike that is only parked, with no mail server and no website, is hard
to get removed. Keep watching it; mail servers are often added right before an
attack.

## 2. Find the registrar's abuse contact

Look the domain up on [ICANN Lookup](https://lookup.icann.org). The RDAP
result shows the registrar and its **abuse contact email and phone**. ICANN
requires registrars of generic domains (.com, .net and others) to publish an
abuse contact and to take steps to investigate reports.

For country-code domains (.co.uk, .de, .co.il and so on), the rules come from
the national registry; its website lists how to report abuse.

## 3. Write a short, specific report

Send it to the registrar's abuse contact, and to the hosting or email provider
the DNS records point to (their abuse address is usually `abuse@` their
domain, or a web form). Include:

- the lookalike domain and the domain it imitates;
- what it is used for: "sending invoice fraud emails impersonating our
  company", not "it looks like ours";
- the evidence, with the email attached as a file or with full headers;
- that you are the owner of the real domain, with contact details.

Phishing and fraud get handled much faster than "trademark" complaints.

## 4. Report it to the blocklists

Even before a takedown, these reports get the domain blocked in browsers and
mail filters:

- [Google Safe Browsing](https://safebrowsing.google.com/safebrowsing/report_phish/)
- [Microsoft: report an unsafe site](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site)
- The Anti-Phishing Working Group: forward the email to `reportphishing@apwg.org`

## 5. When to use UDRP

If the registrar won't act, the
[Uniform Domain-Name Dispute-Resolution Policy](https://www.icann.org/resources/pages/help/dndr/udrp-en)
lets a trademark owner ask an approved provider (such as WIPO) to transfer
the domain. You must show that the domain is confusingly similar to your mark,
that the registrant has no legitimate interest in it, and that it was
registered and used in bad faith. It costs fees and takes weeks, so it suits
domains that keep being used, not one-off fraud attempts.

## 6. Prevent the next one

- **Publish DMARC at reject** so your exact domain can't be spoofed. See
  [DMARC p=none to p=reject](/guides/dmarc-none-to-reject).
- **Warn the people it's aimed at.** Copy-ready emails for staff and
  customers: [phishing warning email templates](/guides/lookalike-domain-warning-email-template).
- **Watch for new lookalikes**, and especially for ones that add mail
  servers. Tools for this are compared in
  [dnstwist alternatives](/guides/dnstwist-alternatives).
- **Agree a rule with customers:** bank details never change by email alone.

## Check your domain

The free scan generates hundreds of lookalikes of your domain and shows which
are registered, how old they are, and which can already send email.

## Sources

- [ICANN Lookup (RDAP)](https://lookup.icann.org)
- [ICANN: Uniform Domain-Name Dispute-Resolution Policy](https://www.icann.org/resources/pages/help/dndr/udrp-en)
- [Google Safe Browsing: report phishing](https://safebrowsing.google.com/safebrowsing/report_phish/)

---
Source: https://nameward.app/guides/report-lookalike-domain-takedown (updated 2026-10-29)