How to take down a phishing lookalike domain

Finding a domain that imitates yours is unsettling, but most phishing domains can be taken offline within days if you report them to the right places with the right evidence. This guide walks through the order that works best for a small team.

NoteOnly report domains that are actually being misused. A parked lookalike with no website or mail is worth watching, not reporting: registrars act on abuse, not on similar names.

1Confirm it is being used against you

Before you report, check what the domain is doing. Registrars and hosts act fastest on clear harm.

• Is there a live website?A copy of your sign-in page, your logo, or a payment form is the strongest evidence.
• Does it have mail servers?An MX record means it can send or receive email, a common sign of invoice fraud and phishing.
• When was it registered?A domain registered in the last few weeks that mimics your brand is a red flag.
• Is it in a phishing email?If a customer or employee received a message from it, keep the full email with its headers.

2Collect the evidence once

Gather everything into one folder before you send anything, so every report is complete the first time.

• Full-page screenshots with the date and time, and the address bar visible.
• The exact addresses (URLs) of the fake pages, written in a safe form such as example[.]com.
• The domain's registration record from ICANN's lookup tool, which shows the registrar and their abuse contact.
• The IP address the site resolves to, which tells you who hosts it.
• Any phishing emails, saved with full headers.
• A short note proving it is yours: your real domain, your trademark if you have one, and how the fake copies you.

3Report it to the registrar

The registrar is the company the domain was bought from. Every ICANN-accredited registrar must publish an abuse contact and investigate reports. Since April 2024, ICANN's contracts also require registrars to promptly take appropriate action to stop or disrupt phishing when they receive actionable evidence.

Email the abuse contact from the registration record. Keep it short and factual: what the domain is, what it does, why it targets you, and your evidence attached. Ask them to suspend the domain.

4Report it to the hosting provider

The host runs the server behind the website. Look up who owns the IP address and send the same evidence to their abuse contact. Hosts can take the website down even when the domain itself stays registered, which stops the harm quickly.

5Get it blocked in browsers

While you wait for the registrar and host, browser warnings protect people right away. Google Safe Browsing warnings are used by Chrome, Firefox and Safari; Microsoft's list protects Edge.

6Follow up, then escalate

Most providers reply within a few days. If nothing happens after three to seven days, send a short follow-up with the original report attached. If a registrar ignores a well-evidenced report, ICANN Contractual Compliance accepts complaints about registrars that do not handle abuse reports.

7When to use UDRP

If the domain is not obviously criminal but clearly uses your trademark in bad faith, for example a parked name being offered for sale to you, abuse reports may not work. The Uniform Domain-Name Dispute-Resolution Policy (UDRP) lets a trademark owner ask for the domain to be transferred or cancelled.

• CostWIPO charges 1,500 USD for one to five domains with a single panelist, plus any lawyer's fees.
• TimeUsually around two months.
• What you must showThe domain is identical or confusingly similar to your trademark, the owner has no legitimate interest in it, and it was registered and is being used in bad faith.

For many newer endings (not .com, .net or .org) there is also the Uniform Rapid Suspension System (URS): faster and cheaper, but it only suspends the domain and needs clear and convincing evidence. Talk to a lawyer before filing either.

8Keep watching

Suspended domains sometimes come back, and attackers often register several lookalikes at once. Keep checking the domain until it is gone, and keep watching for new ones.

General information, not legal advice. Laws, contracts and provider processes change; check the linked sources for current details.