If a lookalike domain is being used to impersonate your organization, you can report it to the providers that operate its domain registration, website, or email services. Suped helps you identify and investigate lookalikes; you submit and manage takedown requests directly with those providers.
When to report a domain
Similarity alone is not proof of abuse. Strong reports show a fake login page collecting credentials, fraudulent invoices, malware, or another specific scam using your identity. A registered typo, parked page, SPF record, or MX record alone is usually insufficient for an abuse takedown. First rule out your own domains, authorized partners, and legitimate unrelated businesses.
What a takedown can achieve
- Content removal: A host or website platform removes the scam page. The domain may still work for email or another website.
- Domain suspension: A registrar or registry disables DNS resolution, generally disrupting both the website and domain-based email after caches expire.
- Security blocking: Browser or email-security services warn users or block traffic. This does not remove the site itself.
- Domain recovery: A successful trademark dispute, settlement, or court order can transfer the domain to you.
Collect evidence
Save evidence before reporting, because the scam may change or disappear. Use the domain's View data details in Suped as supporting context, then collect evidence of the actual abuse:
- Exact abusive URLs, observation dates, and times in UTC.
- Screenshots showing the address bar and misleading content.
- Your legitimate website and a short explanation of how the scam impersonates it or defrauds users.
- Original fraudulent emails with full headers, if email is involved.
- Relevant DNS records, redirects, and provider information, plus your contact details and any required proof of rights or authorization.
Remove victim credentials and unnecessary personal information from the material you share. For email-only fraud, original messages and headers are more useful than screenshots of an empty website.
Send reports to the right providers
- Registrar: Use ICANN Lookup or RDAP to identify the registrar, then use its published abuse form or contact. Ask it to investigate the domain's use for phishing or fraud.
- Host or website platform: Report the exact abusive pages through its abuse process. Suped's network details may help, but a CDN or proxy IP does not necessarily identify the origin host. Cloudflare, for example, publishes a service-specific reporting process.
- Email, security, and payment providers: Where relevant, report fraudulent messages to the email provider, phishing URLs to browser/security reporting services, and scam transactions to the payment provider.
For active scams, submit relevant reports in parallel. Follow each provider's requirements and keep the report factual and specific. There is no universal takedown form or automatic right to removal.
Subject: Phishing impersonating [Organization] — [domain] Abusive URL: [exact URL] Observed: [UTC date and time] Legitimate website: [your website] This page impersonates [Organization] and asks visitors to [enter credentials / make a fraudulent payment]. We do not operate or authorize this domain. Evidence: [screenshots, original emails, supporting details] Contact: [name, role, email] Please investigate and disable the abusive resource under your applicable policy. Please provide a case ID and confirm the action taken.
Reporting on someone else's behalf
Providers commonly accept phishing reports from third parties. If you represent a customer or another organization, obtain written authorization identifying the organization, covered brands or domains, and complaints you may submit. Trademark and copyright claims may require additional rights documents and declarations. Ordinary abuse reports do not generally require a lawyer; formal legal work may need specialist help.
Trademark disputes and copied content
For cybersquatting, the Uniform Domain Name Dispute Resolution Policy (UDRP) provides a formal route to transfer or cancel a domain. You must establish trademark rights and confusing similarity, the registrant's lack of rights or legitimate interests, and registration and use in bad faith. Country-code domains may use different dispute policies.
WIPO's published standard fee is US$1,500 for a single-panelist case covering 1–5 domains that qualify for a joint complaint, excluding legal costs. Straightforward proceedings normally take about two months, with an implementation waiting period afterward. Transfer is often preferable to cancellation, which can allow someone else to register the domain. Check the WIPO guide and current fees before filing.
A copyright complaint, such as a US DMCA notice, may help remove copied protected text or images. It requires specific statements and evidence, and a counter-notice may lead to restoration. It is not a general remedy for a similar domain name. Courts and law enforcement may be appropriate for serious fraud or cases requiring binding orders.
Follow up and verify the outcome
Keep case IDs, reports, and provider responses. Supply requested evidence and follow up through the provider's escalation process. Clear active phishing can be disrupted within hours, but action may take days or longer, and some reports do not succeed. Most ordinary abuse reports have no filing fee; formal disputes and litigation have separate costs.
Confirm what changed: the page was removed, the domain stopped resolving, email service was suspended, or a warning was added. An acknowledgment or a temporary connection failure is not confirmation of a takedown. Keep monitoring for reactivation and replacement domains. While reports are being reviewed, block confirmed threats in your own security tools and warn affected staff or customers.
Return to Lookalike monitoring to review scan results and investigate related variations.
