Lookalike domain registered: triage, takedown, and email protection

TL;DR — If someone registered a domain that looks like yours, treat it first as a customer-protection and email-security incident, not just a branding issue. The fastest wins are: confirm whether the domain resolves, check whether it can send mail, lock down your own SPF/DKIM/DMARC (email authentication records), and report phishing or trademark abuse to the registrar/host. Reading time: ~6 min

The scenario

It is a normal Tuesday afternoon and a customer forwards you an email from billing@yourcornpany.com asking them to "re-verify payment details." Your real domain is yourcompany.com, but this one swaps the m for rn, and at a glance it looks close enough to fool people. You open the domain in a browser and either see a parked page, a fake login page, or nothing at all. Now you need to answer three practical questions fast: is it active, can it send email, and what can you do today to reduce harm?

Symptoms

• Customers report emails from a lookalike sender, for example:

From: invoices@yourcornpany.com
Subject: Payment failed - update card today

• A browser visit to the suspicious domain shows one of these:

This site can’t be reached
ERR_NAME_NOT_RESOLVED

Parking page generated by the registrar

Your Microsoft 365 session has expired. Sign in again.

• DNS lookups return active records:

$ dig +short yourcornpany.com
198.51.100.24

$ dig +short MX yourcornpany.com
10 mx1.mailhost.example.

• TLS (HTTPS certificate) is present on the lookalike domain:

subject=CN = yourcornpany.com
issuer=C = US, O = Let's Encrypt, CN = R11

• Your own DMARC reports show abuse or alignment failures from similar domains:

dmarc=fail header.from=yourcompany.com

• Search results or social posts show the lookalike domain being used in ads, forms, or login pages.

Likely causes

Step-by-step diagnosis

1. Confirm the exact domain and save evidence. Take screenshots of the email, website, and full headers if you have them.

   • In most mail apps: open the message and use View source, Show original, or Download .eml.
   • This is your problem if you can show the sender domain, links, or reply-to using the lookalike domain.
   • Then continue to Step 2.

2. Check whether the domain resolves in DNS (the internet phonebook).

dig +short suspicious-domain.example A

• If you get an IP address, the domain is live enough to point somewhere. Jump to Fixes → Typosquatting for phishing or fake login pages.
• If you get no output, continue to Step 3.

1. Check whether it can receive or send mail.

dig +short suspicious-domain.example MX

• If you get one or more mail servers, the domain is configured for email. Jump to Fixes → Lookalike domain set up to send email.
• If there is no MX output, continue to Step 4.

1. Open the domain in a browser from a safe machine or browser profile. Use a private window and do not enter credentials.

   • If you see a fake login, payment page, or brand copy, jump to Fixes → Typosquatting for phishing or fake login pages.
   • If you see a registrar parking page or blank page, jump to Fixes → Domain is parked or defensively registered by someone else, not active.
   • If the page does not load, continue to Step 5.

2. Check registration and hosting clues.

whois suspicious-domain.example

• This is your problem if the output shows a recent creation date, registrar abuse contact, or nameservers/registrar details you can report to.
• Jump to Fixes → Brand/trademark abuse without active hosting yet.

1. Check your own DMARC record. In your DNS provider dashboard, open your domain's DNS records (for example, in your provider's dashboard, e.g. Cloudflare: DNS → Records), or use:

dig +short TXT _dmarc.yourdomain.example

• If you see no record, or a weak policy like p=none, this is part of your problem because customers have less protection from spoofed mail. Jump to Fixes → Your own email authentication is weak, making impersonation easier.
• If DMARC is already strict (p=quarantine or p=reject), still continue with takedown steps for the suspicious domain.

[Customer Email] ---- 1. report ----> [You]
      |                                  |
      v                                  v
[Headers/Screenshots] ---- 2. check ----> [DNS/MX/WHOIS]
                                           |
                                           v
                              [Parked] / [Email] / [Phishing]
                                           |
                                           v
                         [Takedown + protect your own domain]

Fixes

Typosquatting for phishing or fake login pages

1. Report the site to the hosting provider and registrar. Use the IP and WHOIS data you collected.

dig +short suspicious-domain.example A
whois suspicious-domain.example

• Send a short abuse report with: suspicious domain, screenshots, full URL, your real domain, and why it is impersonation.

1. Report it to the browser and search ecosystems if it is a credential or payment phish. Use each provider's public phishing-report form.
2. Warn customers and staff using your real domain only. Post a short notice on your real site and status page.

We are aware of a fraudulent domain, suspicious-domain.example, impersonating our company. Do not enter credentials or payment details there. Our official domain is yourdomain.example.

1. Block the domain in your mail gateway and browser security tools if your organization uses them.

Verify it worked: the domain starts returning a host suspension page, browser warning, or no longer resolves.

Lookalike domain set up to send email

1. Collect proof from message headers. In the suspicious email source, look for Return-Path, Received, and Authentication-Results.
2. Report to the registrar and the mail host named in MX records.

dig +short suspicious-domain.example MX

1. Add or tighten DMARC on your real domain. In your DNS dashboard, add a TXT record named _dmarc.

Host/Name: _dmarc
Type: TXT
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.example; adkim=s; aspf=s
TTL: 3600

1. If you already have good DMARC coverage, move to p=reject after confirming legitimate mail passes.

⚠️ Moving to p=reject can block real mail if your senders are not fully configured. Check all services that send as your domain first.

Host/Name: _dmarc
Type: TXT
Value: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.example; adkim=s; aspf=s
TTL: 3600

1. Confirm SPF and DKIM (two email authentication methods) are present for your real domain.

dig +short TXT yourdomain.example
dig +short TXT selector1._domainkey.yourdomain.example

Verify it worked: new mail claiming to be from your real domain fails or is quarantined unless it comes from your approved senders.

Domain is parked or defensively registered by someone else, not active

1. Decide whether to monitor, buy, or dispute. If the domain is only parked and not abusing your brand, the least disruptive action is monitoring plus customer guidance.
2. Set up monitoring for DNS and content changes. If your provider offers DNS monitoring, add the domain there; otherwise use a third-party monitoring service.
3. If you own a registered trademark, prepare a dispute or legal notice. Save WHOIS, screenshots, and examples of confusion.

Verify it worked: you receive alerts if the domain later gains A, MX, or web content records.

Brand/trademark abuse without active hosting yet

1. File an abuse report with the registrar using the WHOIS abuse contact.

whois suspicious-domain.example

1. If you have trademark rights, start a domain dispute process with your counsel or brand-protection provider. The common route is a registrar complaint first, then a formal domain dispute if needed.
2. Register the highest-risk variants yourself if they are available: common typos, swapped letters, missing letters, and common TLDs (top-level domains like .com or .net).

Verify it worked: the registrar acknowledges the complaint, or the domain is put on hold / transferred / removed.

Your own email authentication is weak, making impersonation easier

1. Add SPF for your real domain in your DNS dashboard.

Host/Name: @
Type: TXT
Value: v=spf1 include:mail.your-provider.example -all
TTL: 3600

1. Enable DKIM in your email provider's admin console, then publish the selector record they give you. The exact menu varies by provider, but it is usually under Admin → Email → Authentication.
2. Publish DMARC starting with monitoring if you are unsure.

Host/Name: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.example; adkim=s; aspf=s
TTL: 3600

1. After 1-2 weeks of clean reports, change p=none to p=quarantine, then p=reject.

Verify it worked: dig +short TXT _dmarc.yourdomain.example returns your DMARC policy, and mail reports show aligned passes for your legitimate senders.

Prevention

1. Turn on DMARC reporting and review it weekly. Publish a reporting mailbox and watch for unknown senders.

Host/Name: _dmarc
Type: TXT
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.example; adkim=s; aspf=s
TTL: 3600

1. Register the obvious typo variants and key TLDs. At minimum: missing-letter, doubled-letter, rn for m, l for I, and your main ccTLD (country-code TLD) if you operate there.
2. Add a scheduled DNS check for high-risk lookalikes. Even a daily script run from a laptop or CI job helps.

for d in yourcornpany.com yourcompnay.com yourcompany.co; do echo "== $d =="; dig +short $d A; dig +short $d MX; done

1. Create a customer-facing trust page on your real domain. List your official domains, payment portals, and support email addresses. Link to it from invoices and login emails.
2. Add a mail rule to flag external domains similar to yours. In your mail gateway or provider, create a rule for domains that match common brand typos and prepend a warning banner.
3. Keep a ready-to-send abuse template. Store a standard email with placeholders for domain, registrar, screenshots, and timestamps so you can report within minutes.

Subject: Abuse report - phishing/impersonation using suspicious-domain.example
We are reporting suspicious-domain.example for impersonating our brand and attempting to collect credentials/payment details. Evidence attached: screenshots, headers, timestamps, and our official domain ownership details.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.