What to do about a fake domain pretending to be you

You found a lookalike of your domain that is phishing, selling fake goods, or sending email in your name. Here is what to do, in order. Most steps are free and take minutes. Start with the ones that protect people fastest.

LookalikeGuard finds and monitors lookalike domains. We do not take sites down for you and this is general information, not legal advice.

1. Check it is really a fake

   Many lookalikes are harmless: a domain your own company registered, an unrelated business with a similar name, or a parked page. Look for signs of impersonation: your logo or page title, a login or payment form, copied product pages, or emails sent from it. Ask your IT or marketing team whether anyone registered it for you.

2. Save evidence before you report

   Fake sites often disappear or change once reported. Take screenshots of the page (with the address bar visible and the date), save the page (File, Save as), and keep any emails it sent with their full headers. Note the date and time you saw it. If you use LookalikeGuard, the finding page keeps the score, reasons and history.

3. Find who registered and hosts it

   Look the domain up at ICANN Lookup (the official registration lookup, which uses RDAP, the modern replacement for WHOIS). It shows the registrar and usually a registrar abuse contact email. The owner's name is often hidden by a privacy service; that is normal.

4. Report to the registrar's abuse contact

   Email the abuse address from the lookup. Keep it short: the domain, what it is doing (phishing, impersonation, fake store), a link to your real site, and your screenshots. ICANN requires accredited registrars to take reasonable steps to investigate abuse reports such as phishing.

5. Report to the hosting provider

   The company that hosts the site can take the page offline even if the domain stays registered. Find the host from the site's IP address (many lookup tools show the network owner) and use its abuse contact or form.

6. If the site is behind Cloudflare, report to Cloudflare

   If the lookup shows Cloudflare name servers, the real host is hidden. Report at abuse.cloudflare.com. Cloudflare forwards reports to the host and can show phishing warnings.

7. Report to Google Safe Browsing

   Use Google's phishing report form. If Google agrees, Chrome, Firefox and Safari can show a red warning page to anyone who visits.

8. Report to Microsoft (SmartScreen)

   Use Microsoft's report an unsafe site form. This feeds the warnings in Edge and Windows.

9. Tell your payment processor and bank

   If customers paid the fake site, or the fake is using your name to collect payments, tell your processor (for example Stripe, PayPal, Shopify Payments) so they can expect related disputes and may act on accounts linked to the fraud. If your business sent money because of a fake email, call your bank right away: speed matters for recovery. In the US, also file at ic3.gov (FBI) and, for consumer fraud, reportfraud.ftc.gov.

10. Warn your customers, calmly

    A short notice is enough: "We have seen a fake site at [domain]. Our only website is [your domain]. We will never ask for your password or payment by email." Post it on your site and social accounts, and email customers if the fake is actively targeting them. Brief your support team so they recognise complaints about orders from the fake.

11. Protect your own email

    Make sure your real domain publishes SPF, DKIM and a DMARC policy so receivers can tell your mail from forgeries. This does not stop a lookalike domain sending its own mail, but it protects your exact domain and supports deliverability.

12. Consider a domain dispute or legal advice

    If the domain stays up, or you want it transferred to you, the UDRP is the standard dispute process for most domains, run by providers such as the WIPO Arbitration and Mediation Center. It generally requires showing trademark rights, no legitimate interest by the registrant, and bad faith. Fees apply. This is general information, not legal advice; talk to a lawyer about your situation, especially if money was lost.

13. Keep watching

    Taken-down fakes often come back under a new spelling. Re-check the reported domain over the following weeks, and watch for new lookalikes. LookalikeGuard monitoring re-checks every variation daily, watches public certificate logs, and follows up on risky domains at 1, 7 and 30 days.

Quick checklist

• Screenshots, saved page, email headers, date and time
• Registrar abuse report (from ICANN Lookup)
• Hosting provider or Cloudflare report
• Google Safe Browsing and Microsoft reports
• Payment processor and bank told; IC3 report if money was lost
• Customers and support team warned
• Monitoring on

See real examples in our lookalike domain case studies.