Can you take down a lookalike domain?

Yes, when a lookalike is being used to pass itself off as you: to defraud your customers, staff or finance team, or to sell fakes of your products under your name or trade mark. Usually not while it is registered and sitting empty. And not when it belongs to a business trading under its own name, even a competitor selling goods like yours.

That answer matters most when you are holding a list. Check your domain and you will often find names already registered around it: your name on another ending, with a letter swapped, or with a word like “pay” or “group” added. The natural next step is to ask for all of them to be removed.

Most of them cannot be taken down yet. What you can do is know the day one of them starts being used. That is the day a takedown usually becomes possible, and the time between that day and the takedown decides what the lookalike costs you.

If a lookalike is already being used against you, skip ahead to what to do today: a lookalike writing to people in your name, a copy of your website, or urgent help from us.

When a lookalike can be taken down

Two kinds of use give the companies behind a domain something to act on.

Fraud. A copy of your website, a fake sign-in or payment page, or email sent in your name: invoices, changed bank details, requests to sign in. This is the clearest case. When the fraud is a fake sign-in or payment page on an ending such as .com, the companies that register domains are bound by contract to act promptly on evidence of phishing, and in 2026 one lost its accreditation for failing to do so.

Fake goods. A shop on a lookalike domain that uses your name, logo or product photos to sell fakes of what you make. It takes orders meant for you and leaves your customers holding the fakes and your support team answering their complaints. It can be taken down once it is live. Within 12 hours of an upmarket e-commerce brand starting with us, we had found seven fake stores impersonating it. We then had them taken down.

When a lookalike cannot be taken down

A resemblance on its own is not enough. Plenty of names close to yours are registered for ordinary reasons: a business with a similar name in another country, someone holding domains to sell, a product that happens to share a word with your company.

A rule that let any company remove the domains that look like its own would let other companies remove yours. So the line sits at use, and a lookalike that is registered and empty falls short of it.

Set up for email, with nothing sent. This usually falls short too, until there is a message that anyone can show. Of the unused names, it is the one to watch most closely.

There is one exception to the rule about use. When a new lookalike can be tied to an earlier attack on you, through the same registrant or the same set-up, the companies behind it will sometimes act before it is used. Usually they will not, and when they do, it depends on the evidence and is their decision. It matters because lookalikes tend to arrive in groups: in about three out of four of the attack campaigns in our data, the attackers registered a cluster of similar domains rather than one. When one of a group is used, what ties the others to it is what gives them a chance of being taken down too.

A competitor trading as itself. A business selling goods like yours under its own name, from a domain that resembles yours, gives the companies behind the domain nothing to act on. That changes the day it uses your name, logo or content to pass itself off as you, or sends email in your name. From then it can be taken down like any other impersonation.

Trade marks: two routes

A registered trade mark opens two routes. They are easy to confuse. The first is a takedown: a lookalike that uses your mark to pass itself off as you is impersonating you and can come down once it is in use.

The second is a domain dispute. If a lookalike plainly trades on your mark but sits empty, or you want the domain itself rather than its removal, a formal dispute may win it for you. That is a legal claim, often run with a lawyer, with fees and a timetable measured in weeks rather than days, and it runs separately from a takedown. You need rights in the name, usually a registered trade mark, to bring one. It is unlikely to succeed against a business with its own genuine claim to the name.

Which lookalikes to watch first

Most of the list has to be watched, so decide which part to watch most closely. Start with the lookalikes set up to send email.

A lookalike needs no website to do damage. Once it can send email, it can ask your finance team for an urgent payment in a director's name, send your staff a link to a fake sign-in page, or tell a customer that your bank details have changed. Anyone visiting the domain in a browser may see nothing at all.

After those, watch the names closest to yours that nobody in your company recognises, and the ones that combine your name with another word. Then watch everything on the list for change: a website appearing where there was none, a security certificate being issued, email being set up on a domain that had none. Each can mean a lookalike is being made ready. Many names on the list may never change, and nobody can tell from the name which ones, so the whole list gets watched.

Comparing tools that do the watching? The questions worth asking, including whether a tool notices a quiet domain changing, are in our lookalike domain monitoring buyer's guide.

Why the day it is used decides the cost

Because a takedown usually has to wait until a lookalike is used, the cost of an impersonation is set by two stretches of time: how long the lookalike works before someone with the evidence notices, and how long the takedown takes once it starts.

If you have watched it since it was registered, the first stretch is short. You already know the domain and hold its registration and set-up details, and the request to take it down can go out the day it is first used. If the first you hear of it is a customer asking why your bank details changed, or a director asking why finance paid an invoice nobody approved, it may have been in use for days or weeks. By then the cost is yours: payments to recover, passwords to reset across your staff, and customers who now read every email from you twice.

Doing it yourself

By hand, this is two jobs that pull in opposite directions. The first is patient: going back through every name on the list, every working day, for weeks in which nothing happens to most of them. The second is urgent: on the one day something does happen, gathering the evidence, getting it to every company that can act on it, each through its own form, and chasing each of them until the lookalike is gone.

The patient job is the one that slips, because on most days it finds nothing, and when it slips, the urgent job starts late. In a mid-sized company both tend to land on the head of IT, alongside everything else they are responsible for. Some companies hand the urgent job to their lawyers instead, which turns each takedown into billed legal work.

We run both for you. DefendDomain watches the lookalikes of your domain and of your company's name around the clock, including email-only lookalikes, and flags the ones that get set up to send email or start showing a website, with the evidence gathered. When one is used against you, we run the takedown, from the first report through every follow-up and check, and tell you where it stands as it goes. Every plan includes unlimited takedowns. Book a demo to see what we would be watching for you, or check your own domain now, free.

What the list is for

A list of lookalikes tells you who could impersonate you. Watching it tells you who has started. Many of the names on it may never be used against you, and the cost sits in the one that is: in how many days it works before someone with the evidence asks for it to come down. Early detection and fast takedown keep those days few.

Frequently asked questions