Brand Impersonation and Typosquatting: Protecting Your Customers

Attackers do not need to breach you to hurt your customers. They can register yourcompany-login.com, copy your login page, and send emails that look like yours. Brand impersonation targets the trust your customers have in you.

Common impersonation techniques

• Typosquatting: domains with small typos, like exmaple.com or example.co.
• Combosquatting: your brand plus words like -login, -support, -billing or -secure.
• Homoglyphs: characters that look identical in some fonts, including internationalised domain names using non-Latin letters.
• New TLDs: your name on .app, .io, .support and other extensions.
• Fake social profiles and support accounts contacting your customers.
• Fake mobile apps and browser extensions.
• Ads impersonating your brand in search results.
• Leaked credentials and keys posted publicly, enabling attackers to impersonate your services.

What attackers do with them

• Credential phishing pages copying your login.
• Invoice and payment fraud against your customers.
• Malware distribution under your name.
• Fake support scams.
• Business email compromise using lookalike domains.

Detection

1. Monitor new domain registrations and certificate transparency logs for names similar to your brand.
2. Watch for your brand in phishing feeds and threat intelligence.
3. Search app stores and social platforms regularly for impersonating apps and profiles.
4. Monitor DMARC reports, which show who attempts to send as your exact domain.
5. Scan public code and paste sites for leaked keys and credentials tied to your organisation.

Prevention and response

• Register key variants of your domain, such as common typos and main TLDs, especially for login and billing subdomains.
• Enforce DMARC so your exact domain cannot be spoofed.
• Educate customers: publish your official domains, support channels and what you will never ask for.
• Use consistent official domains for login and billing, so customers learn what is legitimate.
• Prepare takedowns: know how to report abuse to registrars, hosting providers, certificate authorities, app stores and social platforms.
• Act quickly: phishing sites do the most damage in the first hours.

Takedown basics

When you find an impersonating site:

1. Capture evidence: screenshots, URLs, WHOIS and hosting details.
2. Report to the hosting provider and registrar abuse contacts.
3. Report to browser safe-browsing services so warnings appear.
4. Notify affected customers if credentials may have been captured.

Brand intelligence with SecurityInfinity

SecurityInfinity's brand intelligence scanner looks for leaked keys and exposures associated with your organisation and helps you see your brand the way attackers do. Start free.

Frequently asked questions

Should I buy every typo domain?

Not every one. Prioritise the most likely typos and TLDs, and rely on monitoring and takedowns for the rest.

Can I force a registrar to remove a lookalike domain?

Registrars act on abuse such as phishing. For trademark disputes without active abuse, formal processes like UDRP may apply.

Does DMARC stop lookalike domains?

No. DMARC protects your exact domain. Lookalike domains require monitoring and takedowns.