Domain impersonation is when someone registers a domain that looks like yours and uses it to pass themselves off as your business. The domain might be a misspelling of yours, your name plus an extra word, or your name on another ending. It is used to email your customers, staff or suppliers in your name, or to host a copy of your website.
The domain is the attacker’s own. They registered it, and they control its email and anything it hosts.
TL;DR
Domain impersonation means a criminal uses a domain they registered to look like yours. Because the domain is theirs, nothing you set on your own domain can stop it. What can:
- Find out which lookalikes of your domain already exist, and which of those can send email.
- Shut the doors you own: set DMARC to enforcement on your own domains, and register the handful of lookalikes closest to your name.
- Watch for new lookalikes as they are registered, and for copies of your site wherever they turn up.
- Have each one taken down once it is used against you, and keep checking it stays down.
To start, see what has been registered around your domain, free.
Already dealing with a lookalike that is emailing people in your name? Go to what to do when someone is impersonating your company by email, or tell us through our urgent help page.
The forms domain impersonation takes
Attackers choose whichever version of your name a busy reader is least likely to notice. Taking yourcompany.com as the real domain:
- A misspelling. yourcompnay.com, or yourcornpany.com, where “rn” passes for “m” at a glance. Some swap in a letter from another alphabet that looks identical. This is typosquatting, the form most people picture.
- Your name plus a word. yourcompany-payments.com, yourcompanygroup.com, yourcompany-support.com. Nothing is misspelled, so nothing looks wrong. One of our published case studies began with exactly this: a lookalike that put a product word after the brand name, used to try to redirect customers’ invoice payments. Many free typo checkers never generate this kind.
- Your name on another ending. yourcompany.io, yourcompany.co, or .com when you trade on .co.uk. In another of our case studies, an attacker registered a PE-backed SaaS group’s exact brand name under another ending and copied its website onto it in a near-identical clone.
- Two changes at once. On 14 October 2026 the FCA warned that quorumcapitalltd[.]com was a clone of an authorised firm, Quorum Capital Limited, whose real website is quorumcapital.co.uk (FCA warning). Add “ltd”, swap the ending, and the name still reads as the company’s.
Whichever name it wears, the domain is then put to work. Some lookalikes are set up only to send email. There is no page to stumble across and nothing for a search engine to find, which suits fake invoices and payment-change requests: the invoice-fraud case above ran on one of these. Others host a copy of your website, such as a fake store or a copied sign-in page.
Domain impersonation vs domain spoofing
The two terms get used as if they meant the same thing, and search results often blur them. The difference decides what stops the attack.
Domain spoofing is email that carries your exact domain in the From line without having come from you. SPF, DKIM and DMARC were built for this, and the NCSC’s guidance on email security and anti-spoofing walks organisations through setting them up.
Domain impersonation uses a domain the attacker registered, such as yourcompany-payments.com. Because it is theirs, they can publish SPF, DKIM and DMARC records for it, and its email can pass those checks as cleanly as yours. Your DMARC record never comes into it. Most domains used for phishing belong to attackers in this way: in Interisle’s Phishing Landscape 2026, 74% had been registered maliciously and 26% were legitimate domains that had been broken into.
| Question | Domain spoofing | Domain impersonation |
|---|---|---|
| Whose domain is used | Domain spoofing: Yours, forged in an email’s From line | Domain impersonation: The attacker’s, registered to look like yours |
| Whether DMARC on your domain stops it | Domain spoofing: Mostly, at quarantine or reject, where the receiving server checks | Domain impersonation: No, because the lookalike is a different domain |
| What stops it | Domain spoofing: Enforcing DMARC on your own domains | Domain impersonation: Finding the lookalike early and getting it taken down once it is used |
Spoofing borrows your address and impersonation brings its own. Enforcing DMARC lets receiving servers reject or quarantine forged email in your name, which leaves impersonation as the open route.
Who domain impersonation hurts
A lookalike wears your name to reach the people who trust it.
- Your customers get invoices with new bank details, or land on a fake store or a copy of your sign-in page.
- Your staff get messages that seem to come from IT or the finance director, and type their passwords into a copied sign-in page.
- Your suppliers get purchase orders and payment-change requests in your name. Your own accounts team can also be sent a fake invoice from a lookalike of a supplier’s domain.
Most of it happens outside your systems. Emails to customers and suppliers land in their inboxes, and fake pages sit on someone else’s servers, so your own security tools never see them.
How to check if someone is impersonating your domain
Three checks, in this order.
- Find the lookalikes that already exist. List the close variations of your domain and look up which are registered. The ones set up to send email come first, because they are ready to write to people as you. Our free domain threat analysis scans more than 150 lookalikes of your domain and flags which are registered and which of those are set up to send email.
- Ask the people who would hear first. Your finance and customer service teams see the symptoms: a customer asking about an invoice you never sent, a supplier confirming a bank-detail change you never made, an order nobody recognises. When an email like that turns up, read the full sender address, not just the name shown.
- Look for copies of your website. Search for an unusual sentence from your homepage in quotation marks, and look at any result that is not your own site, including ones on addresses that have nothing to do with your name.
A check shows what has been registered so far. The lookalike that gets used against you may be registered next week, and a domain that looks harmless today can be set up to send email tomorrow. Checking once is where watching starts.
How to stop domain impersonation
There are three jobs: shut the doors you own, find everything else early, and get it taken down fast.
1. Shut the doors you own
Set DMARC to enforcement on every domain you own, including the ones that never send email, so that forging them gets harder. Then register the handful of lookalikes a customer would type or misread most easily. Buying the rest is out of reach: every name has hundreds of believable variations, spread over hundreds of endings. Our brand impersonation prevention guide covers this part in detail.
2. Watch from the day a lookalike is registered
The domain has to exist before the email can be sent, and that gap is where it can be caught. A lookalike can be spotted at three points: when it is registered, when mail settings are added to it, and when a security certificate is issued in its name. Each can come before the first fake invoice or the first visitor. If you are choosing a tool for this, seven questions to ask before you buy lookalike domain monitoring will help.
3. Get it taken down once it is used
Registrars and hosts seldom do anything about a lookalike that is just sitting there. Once it is put to work against you, sending fake invoices or serving a copy of your site, the companies behind it can take it offline. Watch it from registration and you report it with the evidence already in hand, as soon as it is used. Which lookalikes can be taken down, and when has the detail. Every impersonating domain has a lifespan, from the day it is registered to the day it stops working. Most of what it costs you builds up inside that window, so the job is to make it short.
By hand, this is the step that eats the time. Taking a lookalike offline usually means going to several parties at once, each with its own abuse process:
- the company it was registered through
- the company hosting its website
- the providers handling its email
- the blocklists that mail filters and browsers check
Some reports come back saying the domain isn’t their customer and pointing you elsewhere. Some get no answer. Each needs chasing, and someone has to keep checking that the domain has really stopped working. When the same attackers return on a fresh lookalike, the whole process starts over. At a mid-sized business, that someone is usually the IT or operations lead, on top of a full-time job.
Or let us do the chasing. DefendDomain watches the domains registered around yours continuously, including lookalikes set up only to send email, and finds copied pages and text from your website, even where the address has nothing to do with your name. Once one is put to use against you, a single click sets the takedown going, and the reports, follow-ups and checks run from there, with updates on where each one stands. If you would rather we run it for you, we make that click too. More on how we protect your brand.
For the PE-backed SaaS group above, the copy of its website was detected and taken down before any customer was known to have interacted with it.
Run a free check to find out whether lookalikes of your domain are already registered.
Frequently asked questions
Is domain impersonation the same as domain spoofing?
No. Domain spoofing forges your exact domain in an email’s From line, and DMARC on your domain is the defence against it. Domain impersonation uses a different domain that the attacker registered to look like yours, so its email can pass authentication checks and your DMARC has no say over it.
Is domain impersonation the same as typosquatting?
Typosquatting is one kind of domain impersonation: a domain one typing mistake away from yours, such as a missing, doubled or swapped letter. Domain impersonation also covers your name plus an extra word, your name on another ending, and lookalikes set up only to send email. Many free typo checkers stop at misspellings and lookalike characters, so they miss the name-plus-a-word kind.
How do I check if someone is impersonating my domain?
Run a lookalike check: it shows which close variations of your domain exist and which can send email, and the ones that can send email are the ones to look at first. Then keep checking, because new lookalikes are registered all the time. DefendDomain’s free domain threat analysis runs the first check for you.
Can an impersonating domain be taken down?
Yes, once it is in use against you, for example sending fraudulent email or hosting a copy of your site. The registrar, the host and the email providers can act when there is evidence of that use. An unused lookalike usually gives them nothing to act on yet.
