What is brand impersonation? How attackers copy your company online, and how to spot the fake domains
Brand impersonation is when an attacker uses your company's name, logo or domain to make a fake website or email look like it comes from you.
What does brand impersonation mean? Examples first.
The goal is to borrow your reputation. People trust a name they know, and attackers use that trust to steal logins, payments and personal details.
What is an example of brand impersonation?
- A fake sign-in page. Staff get a message about their pay. The link goes to
acme-payro11.com, a copy of the real payroll portal that records what they type. - A fake supplier email. A message from
accounts@acme-co.ukasks a customer to pay an invoice into a new bank account. The real domain isacme.co.uk. - A fake profile or listing. A social media account or marketplace seller uses your logo to sell goods or collect messages.
The first two use a domain the attacker registered to look like yours. That is the part of the problem a domain search can see, and the part this guide covers in most detail.
What is the difference between spoofing and impersonation? Your domain versus a lookalike.
Spoofing forges your real domain. Impersonation uses a different domain that looks like yours.
Spoofing means sending email that claims to come from your exact domain, for example ceo@acme.co.uk, when it does not. Email authentication records (SPF, DKIM and DMARC) exist to stop this, and a correct set-up lets receiving servers reject forged mail.
Impersonation means registering a similar domain, such as acme-co.uk or acrne.co.uk, and using that. The attacker owns it, so the email authentication on your domain does not apply. The only way to catch it is to find the domain.
You need both defences. Authentication closes the door on your exact name. Finding lookalike domains covers the names around it.
Where does brand impersonation happen? Four channels, one covered here.
Online brand protection, also called digital brand protection or brand monitoring, covers several channels. No single tool covers all of them, so it helps to know which one yours does.
| Channel | How it is found | EdgeProtect |
|---|---|---|
| Lookalike domain | Continuous lookalike-domain discovery for the domains you add, showing which names are registered and which can receive email. | Covered by EdgeProtect |
| Social media profile | Found by searching the platform for the company name and logo. | Not covered by EdgeProtect |
| Marketplace listing | Found by searching the marketplace for the company name and product images. | Not covered by EdgeProtect |
| App store listing | Found by searching the store for the company name and logo. | Not covered by EdgeProtect |
What should you do if someone is impersonating your business? Six steps.
Act in this order. Most of the value comes from the first three steps.
- Capture evidence. Save the full web address, a dated screenshot and, for email, the original message with its headers.
- Check what it does. Find out whether the page is live, whether it asks for logins or payments, and whether the domain can receive email.
- Report it. Tell the registrar, the hosting provider or the platform. Our guide on how to report a phishing website shows where each report goes.
- Warn people. Tell staff and affected customers what to look for and what to do if they already clicked.
- Report to the authorities. In the UK, forward suspicious emails to the National Cyber Security Centre at
report@phishing.gov.uk. - Block it. Add the domain to your email filter and web filter so your own staff cannot reach it.
Reports do not always lead to removal, and the time it takes varies with the registrar, the host and the evidence you supply.
How do you find lookalike domains? Check the names around yours.
Attackers pick names that survive a quick glance. Knowing the common patterns tells you what to look for.
- Typing mistakes:
acem.co.ukforacme.co.uk. - Swapped lookalike characters:
acrne.co.uk, where "rn" stands in for "m", or a zero in place of an "o". - Added words:
acme-payroll.comoracme-support.co.uk. - Different endings:
acme.netwhen you own onlyacme.co.uk.
EdgeProtect brand protection runs continuous lookalike-domain discovery for the domains you add. For each lookalike it records whether the name is registered and whether it can receive email, and it alerts you to new lookalikes and changes. A lookalike that can receive email is a bigger risk than one that cannot. Read more on the brand protection feature page.
Brand impersonation is when an attacker uses your company's name, logo or domain to make a fake website, email, profile or listing look like it comes from you. The aim is to steal logins, payments or personal details.
Spoofing forges your exact domain in the sender address of an email. Impersonation uses a different domain, profile or listing that merely looks like yours. Email authentication helps against spoofing. Finding lookalikes is how you catch impersonation.
Brand impersonation protection is the set of checks and responses that find and act on fake versions of your brand. It can cover domains, social profiles, marketplaces and app stores. EdgeProtect covers the domain side: it finds lookalike domains and tells you which are registered and can receive email.
No. EdgeProtect covers lookalike domains only. Fake social media profiles, marketplace listings and app store listings are not covered.
Sometimes. Removal depends on the registrar, the hosting provider and the evidence you give them, and it can take time. EdgeProtect finds the domain. You decide whom to report it to.
A fake sign-in page on a domain such as acme-payro11.com that copies a real company's payroll portal is a common example. Another is an email from acme-co.uk asking a customer to pay an invoice into a new account, when the real domain is acme.co.uk.
Find the fake domains. Before your customers do.
Add your domain and see which lookalike domains exist, whether they are registered and whether they can receive email. Social profiles, marketplaces and app stores are not covered.