How to report a domain that imitates your company

You found a domain like yourbrand-invoice.com or yourbrnad.com. Here is what to check, what to collect, and who to write to, in that order. It usually takes under an hour.

This guide is general information, not legal advice. Registrars and hosts each have their own abuse rules and decide for themselves.

1. Work out what the domain actually does

Not every lookalike is a problem. A similar name owned by an unrelated business, or a parked page with ads, is usually not worth a report. Look at three things:

• Is there a website? Open it in a private window, without logging in or typing anything. Does it copy your logo, your login page or your checkout?
• Can it send or receive email? A public DNS lookup tool shows whether the domain has MX records. A lookalike with mail and words like "invoice", "billing" or "support" in the name is the pattern used for fake invoices.
• When did it appear? Search the domain on crt.sh. It lists the TLS certificates issued for it, with dates. A certificate issued last week matters more than a domain parked for ten years.

Do not log in, submit forms, scan or contact the people behind the domain. Look only at what anyone can see.

2. Collect the evidence once

Every report below asks for the same things. Gather them first:

• A screenshot of the lookalike page, with the date and time (UTC).
• A screenshot of your real page that it copies, if it copies one.
• The domain's DNS records (A and MX) and the date you looked them up.
• The crt.sh link for its certificate, if there is one.
• If a customer or supplier received an email from it: the full message with headers, saved as an .eml file.

3. Report it to the registrar

The registrar is the company the domain was registered through. It can suspend the domain. Find it, and its abuse email address, with ICANN Lookup. For country domains (.ch, .de, .fr and others) the national registry's lookup shows the registrar.

Keep the tone factual. Say the domain "appears to imitate" you. Do not call anyone a criminal: the registrar does not need it, and you may be wrong about who is behind it.

4. Report it to the hosting provider

Only if the domain has a live website or mail server. Look up the IP address the domain points to, then look up that IP in a public RDAP or WHOIS service. The record names the network owner and usually an abuse address.

5. Get the page blocked in browsers

Only if the page copies your site, your login or a payment page. These reports put a warning in front of the page in browsers and mail clients. They do not remove the domain, so do them as well as the registrar report, not instead of it.

• Google Safe Browsing (Chrome, Firefox, Safari): report a phishing page. Paste the full URL and add one line: "Imitates [company] ([your domain]). Copies our [login page / checkout]."
• Microsoft (Edge, Outlook): report an unsafe site. You can continue as a guest. Choose phishing and use the same line.
• Netcraft: report a URL. Netcraft passes reports on to browser and security vendors.

6. Follow up

• Write down each report: date, who you sent it to, any reply.
• Check the domain again after 3 and 7 business days. If it is still live and nothing came back, reply to your first report and ask for a status.
• If you want the domain itself rather than its suspension, the usual route for most generic domains is a dispute under the UDRP. That is a legal procedure with fees; ask a lawyer.

If money has already moved

Takedowns do not get money back. Call the bank that sent the payment straight away, then report to the police or your national cyber authority. In Switzerland that is the National Cyber Security Centre reporting form.

Want us to do the finding and the paperwork?

Mimicwatch watches public certificate logs and DNS for domains that imitate yours. A person checks every hit, and when one matters you get an alert with the evidence already collected and these reports already filled in. You send them. We never contact the domain or file anything in your name without your written OK.