Lookalike domains: how to assess the risk to your brand

Treat similarity as the start of an investigation

A domain resembling your company’s name can warrant attention. The next task is to establish how it is being used and whether it has a legitimate connection to your business. Similar spelling alone does not establish malicious intent.

Compare the finding with your own domain inventory and check for authorized agencies, resellers, regional operations, and campaigns. Involve the people who manage those relationships when ownership or purpose is unclear. That first check helps distinguish an unfamiliar company asset from a property that needs further investigation.

Record the exact domain, any relevant URL, the observation time, and the reason it was flagged. These details give later reviewers a consistent starting point.

Build context around what you can observe

Registration data can help identify the registrar and available registration details. RDAP provides current domain registration data in a standardized format. Keep a record of the information available at the time of the review and note any gaps.

DNS records and website observations add different kinds of context. They may help explain how the domain is configured and what visitors encounter. Treat them as parts of the investigation, rather than a standalone verdict about intent.

Where content can be inspected safely by trained analysts using approved tools, capture relevant screenshots and precise URLs. Note whether the page uses your branding, presents itself as your organization, requests credentials, or directs visitors toward a payment or download. Do not enter real credentials or payment details into a suspected impersonation page.

Explain the evidence and the potential harm

A clear assessment distinguishes observed behavior from inference. A page displaying a copied logo is one observation. A page presenting a branded login form at a documented URL provides additional evidence about what visitors are being asked to do.

Describe who may encounter the property and what information or action it requests. If an email or message directed someone to the page, preserve relevant evidence through your approved reporting process. Include enough context for the next reviewer to understand the concern without collecting unnecessary personal information.

Use this assessment to decide whether the finding needs continued observation, internal protective action, or a report to a relevant service provider.

Make the response specific and evidence-led

An abuse report should identify the domain, the precise offending URLs, the observed activity, and supporting evidence. Follow the recipient’s reporting process and retain the reference so your team can track the outcome.

ICANN’s DNS abuse guidance illustrates why a specific, actionable report matters. The appropriate response depends on the circumstances and may involve different parties. A takedown request is part of that process, not a guarantee of immediate removal.

Scryer helps surface lookalike domains and, where available, adds registration context, technical records, and screenshots. Managed takedown support can help move a substantiated finding into a removal process. The foundation remains a clear account of what was observed and why it warrants action.