Brand impersonation is the use of your name, logo, product imagery and reputation by someone who is not you, on a domain you do not control, to take money or credentials from people who believe they are dealing with you. The impersonation site is almost always built on a freshly registered domain, promoted through paid social advertising or phishing email, and abandoned once the payment processor or ad platform catches up. Brand impersonation domains cost their operators very little and cost the brand its customers’ trust and its support queue. This guide explains how these sites are built, how they are found, how to shut them down, and why blocking and monitoring in advance costs less than the takedowns that follow.
What an impersonation campaign looks like in practice
We investigated one such campaign in our write-up of the $250 mowers fake-domain Facebook ad scam. The pattern is typical. Paid ads on a social platform promised name-brand lawn mowers at a fraction of retail. Each ad clicked through to a storefront on a domain registered days earlier, carrying a name close enough to a real retailer or manufacturer to pass a glance, and built from product photographs, descriptions and logos copied from legitimate sites. Buyers entered card details on a working checkout. Nothing shipped. When complaints accumulated and the ad account was shut off, the operator moved to the next domain in a batch registered at the same time, with the same template, under the same cheap top-level domain.
That sequence, paid reach, a cloned storefront on a fresh domain, a lookalike brand name and no fulfillment, is the same whether the product is mowers, cosmetics, event tickets or a bank login page. The brand usually learns of it from customers, by which time the operator has been collecting payments for days.
The anatomy of an impersonation site
Impersonation sites share features that make them identifiable once you know what to look for. The domain is new, often registered within the past week, because fraud operators treat domains as disposable. The top-level domain is cheap, frequently one of the new generic TLDs where promotional pricing brings a registration down to cents, because a campaign that will burn through a dozen names has no reason to pay .com prices. Interisle Consulting counted 1,542,922 unique domain names used in phishing between May 2024 and April 2025, found that 77% of them were maliciously registered rather than compromised, and reported that new gTLDs hold 11% of the domain market but 51% of phishing domains, according to its 2025 phishing study.
The site itself is a template. The logo is the brand’s own, copied as an image file. The product photographs and descriptions are scraped from the real catalog. The reviews are lifted from the brand’s site or a marketplace, names and star ratings included. The one component that always works is the payment form, because it is the point of the exercise: usually a legitimate processor’s checkout attached to a merchant account opened under a false identity. Contact details are a web form or a free email address.
How victims and brands find impersonation domains
Customers find them first. A complaint about an order that never arrived, a refund request for a purchase your company has no record of, or a social media post tagging your brand in a warning is usually the earliest notice. Treat every such contact as an indicator and ask for the exact URL, the ad screenshot and the payment receipt.
Brands that look proactively find them earlier. The ad libraries that the major social platforms publish can be searched by brand name and keyword, and a search for your own product names will surface ads you did not place. DMARC reports (the aggregate reports email receivers send a domain owner about messages claiming to come from that domain) reveal when a spoof is being used in phishing email against your customers. Certificate transparency logs record every TLS certificate issued for a domain containing your brand name, usually before the site is live. Domain monitoring, the continuous watch for new registrations that contain or resemble a brand term, catches the domain at registration rather than at the first complaint. Our guide to phishing domain monitoring covers these sources in detail, and our post on brand monitoring and online threat detection covers the wider program.
The FBI Internet Crime Complaint Center received 859,532 complaints in 2024 with reported losses of $16.6 billion, a 33% increase from 2023, with phishing and spoofing alone producing 193,407 complaints, according to the FBI 2024 Internet Crime Report. APWG recorded 892,494 phishing attacks in the third quarter of 2025 targeting 427 unique brands, according to its Phishing Activity Trends Report for Q3 2025. Any name a buyer will trust at a glance is a candidate.
The takedown sequence
A takedown is a sequence of reports to the parties whose services the site depends on, and it works best when every report carries the same evidence package. Before contacting anyone, capture the evidence: full-page screenshots with the URL and date visible, an archived copy of the pages, the RDAP (Registration Data Access Protocol) record showing the registration date and registrar, the nameservers and hosting IP address, the TLS certificate, the ad creative and ad library entry, and any customer receipts that identify the payment processor. Sites disappear quickly once reported, and the evidence supports every later step, including a dispute over the domain.
Then report in parallel. The registrar’s abuse contact, published in the RDAP record, can suspend the domain for fraud under its terms of service, which stops the site resolving everywhere at once. The hosting provider, identified from the IP address, can take the content offline if the registrar is slow. The payment processor, identified from a customer receipt, can freeze the merchant account, which removes the operator’s reason to continue. The ad platform’s intellectual property and scam reporting channels stop the paid reach, and the social platform’s impersonation report removes the page that hosted the ads. The certificate authority can revoke the TLS certificate on evidence of fraud, which triggers browser warnings on any surviving copy of the site. Each party acts on its own timetable, so the brand that reports to all of them the same day shortens the campaign by days.
Where the domain contains your trademark and you want to own it rather than merely suspend it, a UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaint transfers it to you. A suspended domain can be released and reused; a transferred one cannot. For a fraud site built on a distinctive brand name, bad faith is rarely in doubt, and the takedown evidence package is most of the complaint.
Why prevention costs less than takedowns
Every takedown responds to a domain that already exists and has already been used. The operator paid a few dollars for it; the brand pays for the investigation, the reports, the customer service, the goodwill refunds and, in some cases, the UDRP. The arithmetic favors blocking. Domain blocking reserves your brand term across hundreds of extensions at once, so the name the fraud operator would have registered is unavailable, at a fraction of the cost of registering those names defensively. Monitoring covers what blocking cannot: the lookalike domains that add a word, swap a character or use a different script, which no block list can enumerate. CSC reported that 80% of homoglyph (lookalike) domains resembling Global 2000 brands are owned by third parties and that 42% of those had MX records in 2024, meaning they were configured to send or receive email, according to its 2024 Domain Security Report. A lookalike with mail configured is a campaign waiting for a target list. DNShield domain name monitoring is built to surface those registrations the day they appear, which is the difference between a report filed before the ads run and a refund queue afterward.
The legal routes
Trademark rights are the foundation of every legal remedy against brand impersonation, which is why registering the marks you rely on online is a brand protection decision, not only a legal one. With a registered mark, the UDRP delivers the domain, and the Anticybersquatting Consumer Protection Act (ACPA, the federal statute that provides a civil action for bad-faith registration of a domain confusingly similar to a mark) adds statutory damages and injunctions against operators who can be identified. Consumer fraud is also a matter for law enforcement, and a referral to the FBI Internet Crime Complaint Center, the Federal Trade Commission or the state attorney general, supported by the same evidence package, adds weight to the platform and processor reports. For how these remedies fit together, see our guide to what brand protection is.
How DNAccess handles brand impersonation
Our online brand protection service combines domain blocking, continuous monitoring and takedown management. We identify the impersonation domains, capture the evidence, run the registrar, host, processor, platform and certificate reports in parallel, and pursue the UDRP where the domain is worth owning. Contact us with the URL or the ad and we will provide a quote.