Someone registered a domain like yours: what to do
Most lookalikes never do anything. The ones that do need evidence, the right abuse contact and a little patience. Here is the order that works.
First, work out what it is doing
Finding a domain that looks like yours is unsettling, but most lookalikes never host anything. Spend ten minutes classifying it before you write to anyone, because the right next step depends on the answer.
curl -s https://rdap.org/domain/lookalike.example | jq '.events[] | {eventAction, eventDate}'
dig +short NS lookalike.example
dig +short A lookalike.example
dig +short MX lookalike.exampleThen sort it into one of these:
- Yours. A brand-protection registrar (CSC, MarkMonitor, Corsearch, SafeNames, Com Laude) or your own company in the registrant field usually means a defensive registration. Ask legal and marketing first.
- Parked or empty. A registrar parking page, ads, or no website. Nothing to report as abuse yet, but worth monitoring.
- Mail-capable. It has MX records. This can be used against your customers and suppliers without any website. See lookalike domains with MX records.
- Live impersonation. A login page, your logo, a fake support number, a payment form. This is reportable today.
- Someone else's legitimate business with a similar name. Common for short and dictionary-word brands. Leave it alone.
To look at the site without visiting it from your own network, use urlscan.io with the visibility set to unlisted or private, so you do not publish the scan or tip off the operator.
Collect evidence before you report
Phishing pages are often cloaked (they show the real content only to some visitors) and short-lived. Abuse desks act on evidence they can verify, so capture it while it is there:
- Screenshots that show the full URL and a timestamp.
- The urlscan.io result link, which includes the DOM, requests and a screenshot.
- For email, the complete message with headers, saved as
.eml, not a forward. - The RDAP record and DNS answers from the commands above.
- A one-line statement of which real page it copies, with your official URL.
Report it to the registrar
The registrar can suspend the domain itself, which takes down the site and the mail at once. Find it with RDAP or lookup.icann.org. The registrar's abuse email and phone are usually listed in the RDAP record under the entity with the abuse role.
ICANN's Registrar Accreditation Agreement requires registrars of generic TLDs to publish an abuse contact and investigate reports, and amendments in force since April 2024 require them to take appropriate action, promptly, when they receive actionable evidence of DNS abuse. Phishing is explicitly included. Country-code registries set their own rules.
A report that gets read has a subject line that names the abuse and the domain, and a body like this:
Subject: Phishing: lookalike.example impersonating yourcompany.com
lookalike.example is hosting a copy of our login page at
https://lookalike.example/signin, collecting customer credentials.
Our official site is https://yourcompany.com/login.
Evidence:
- urlscan: https://urlscan.io/result/...
- Screenshot attached (captured 2026-10-01 14:05 UTC)
- Phishing email with full headers attached
Please suspend the domain under your abuse policy.
Name, title, company, phoneA domain that resembles your trademark but does nothing is not DNS abuse, so the abuse desk will usually decline it. That is a trademark dispute, handled through URS or UDRP below.
Report it to the host and the blocklists
Hosting providers often act faster than registrars on a clear phishing page. Look up the IP's network owner with whois on the address from dig +short A and use its abuse contact. If the site sits behind Cloudflare, use Cloudflare's abuse form; it forwards the report to the actual host and can put a warning page in front of the site.
Blocklists protect people even while the domain stays up. Submit to all of them:
- Google Safe Browsing at safebrowsing.google.com. A listing triggers warnings in Chrome, Firefox and Safari.
- Microsoft through its report-unsafe-site page, which feeds SmartScreen in Edge and Outlook.
- Netcraft at report.netcraft.com. Netcraft verifies the site and contacts the host and registrar itself.
- APWG by forwarding the phishing email to
reportphishing@apwg.org.
How long it takes
Greyphish tracks every live lookalike of a public brand it detects: when it was first seen, when it served a site, whether Google Web Risk listed it, and when it went down. Over the 30 days to 1 October 2026:
| Measure | Value |
|---|---|
| Lookalikes seen serving a live site | 623 |
| Listed by Google Web Risk | 19 (3.0%) |
| Went down | 23 (3.7%) |
| Median time from first sighting to down | 3.9 days |
| Median time from first sighting to Web Risk listing | 3.2 days |
Counts use whole-word brand matches; an earlier version counted brand names inside other words.
The low takedown rate is not mainly registrars being slow. Most live lookalikes are never reported by anyone, and many are parked or legitimate. The ones that do come down tend to come down within a few days. The point for you is that nothing happens on its own: the owner of the impersonated brand has to report.
Two large networks show the same picture. On Amazon (139 tracked) the median live lookalike had been up 8.3 days with none taken down; on Cloudflare (109 tracked), 7.9 days with five taken down. The current figures, by registrar and by network, are in the lookalike domain report.
When the registrar says no: URS and UDRP
If the domain is not being used for abuse but still infringes your trademark, or the registrar will not act, ICANN's dispute policies apply to generic TLDs:
| URS | UDRP | |
|---|---|---|
| Covers | Most new gTLDs (.xyz, .online, .shop...) | All gTLDs incl. .com, .net, .org |
| Outcome | Suspension until expiry | Transfer to you or cancellation |
| Standard of proof | Clear and convincing | Balance of probabilities |
| Provider fee | From about US$375 | From US$1,500 (WIPO, 1 to 5 domains) |
| Typical time | Weeks | About two months |
Both require a trademark, and a UDRP complaint has to show three things: the domain is identical or confusingly similar to your mark, the registrant has no rights or legitimate interest in it, and it was registered and is being used in bad faith. Most country-code TLDs have their own procedure, such as Nominet's DRS for .uk. Use a lawyer for anything contested; this guide is not legal advice.
UDRP is the right tool when you want the domain, for example a typo of your main domain that keeps attracting your customers' email. For a live phishing site it is far too slow; use the abuse route.
Afterwards
- Look for siblings. Lookalikes come in sets. Search for other domains created the same day at the same registrar, and on the same IP or nameservers.
- Block it internally on your mail gateway and DNS resolver, so staff cannot be phished from it while it stays up.
- Tell the people it targets. Support and finance teams should know the exact name.
- Watch for its return. Suspended domains expire and get re-registered.
Greyphish handles the tracking: each finding shows the registrar's abuse contact from RDAP, whether the site is live, whether Google Web Risk lists it, and when it went down. Reporting to Netcraft is a button on Pro that a person has to confirm; nothing is reported automatically, because many lookalikes belong to legitimate businesses. See pricing, or start with one domain free.
Questions
Can I get a lookalike domain taken down if it is only parked?
Usually not through an abuse report, because a parked domain is not phishing or malware. If it infringes your trademark, URS (for new gTLDs) or UDRP can suspend or transfer it. Otherwise monitor it and act if it starts serving content or mail.
How do I find a registrar's abuse contact?
Look the domain up in RDAP, for example at lookup.icann.org. The registrar entity lists an abuse email and phone number. Accredited registrars for generic TLDs are required to publish them.
How long does a phishing domain takedown take?
In Greyphish's tracking, live lookalikes that came down did so a median of 3.9 days after first being seen. Reports with clear evidence sent to both the registrar and the host are fastest.
What does a UDRP complaint cost?
WIPO's fee starts at US$1,500 for one to five domains decided by a single panelist, plus any legal fees. URS, available for most new gTLDs, starts at around US$375 but only suspends the domain.
More guides
- How to find lookalike domains of your company
Generate the names an impersonator would pick, find out which already exist, and sort the handful that matter from the thousands that do not.
- What is combosquatting? Examples from 5,600 domains
A combosquat keeps the brand spelled correctly and adds a word around it. They are the newest lookalikes we see when they appear, often only days old.
- Homoglyph and punycode domains, explained
A homoglyph domain swaps a letter for one that looks the same. Some swaps stay in plain ASCII; others need Unicode and travel as punycode.
- Monitoring Certificate Transparency logs for phishing domains
Every publicly trusted certificate is logged before browsers accept it. That makes the logs one of the earliest public signs that a lookalike is being set up.
- Lookalike domains with MX records: the email risk
A lookalike with mail records can sit inside a supplier thread for weeks. More than a quarter of the registered lookalikes we checked could receive email.
Numbers in these guides come from the lookalike domain report, which updates hourly. Plans and limits are on the pricing page.