# What is brand impersonation? How attackers copy your company online, and how to spot the fake domains

> Brand impersonation is when an attacker uses your company's name, logo or domain to make a fake website or email look like it comes from you.

Canonical page: https://www.edgeprotect.io/guides/brand-impersonation
Breadcrumb: [Resources](https://www.edgeprotect.io/resources) > Brand impersonation

## What does brand impersonation mean?

The goal is to borrow your reputation. People trust a name they know, and attackers use that trust to steal logins, payments and personal details. Examples:

- **A fake sign-in page.** Staff get a message about their pay. The link goes to `acme-payro11.com`, a copy of the real payroll portal that records what they type.
- **A fake supplier email.** A message from `accounts@acme-co.uk` asks a customer to pay an invoice into a new bank account. The real domain is `acme.co.uk`.
- **A fake profile or listing.** A social media account or marketplace seller uses your logo to sell goods or collect messages.

The first two use a domain the attacker registered to look like yours. That is the part of the problem a domain search can see, and the part this guide covers in most detail.

## What is the difference between spoofing and impersonation?

Spoofing forges your real domain. Impersonation uses a different domain that looks like yours.

- **Spoofing** means sending email that claims to come from your exact domain, for example `ceo@acme.co.uk`, when it does not. Email authentication records (SPF, DKIM and DMARC) exist to stop this, and a correct set-up lets receiving servers reject forged mail.
- **Impersonation** means registering a similar domain, such as `acme-co.uk` or `acrne.co.uk`, and using that. The attacker owns it, so the email authentication on your domain does not apply. The only way to catch it is to find the domain.

You need both defences. Authentication closes the door on your exact name. Finding lookalike domains covers the names around it.

## Where does brand impersonation happen?

Online brand protection, also called digital brand protection or brand monitoring, covers several channels. No single tool covers all of them, so it helps to know which one yours does.

| Channel | How it is found | EdgeProtect |
|---|---|---|
| Lookalike domain | Continuous lookalike-domain discovery for the domains you add, showing which names are registered and which can receive email. | Covered by EdgeProtect |
| Social media profile | Found by searching the platform for the company name and logo. | Not covered by EdgeProtect |
| Marketplace listing | Found by searching the marketplace for the company name and product images. | Not covered by EdgeProtect |
| App store listing | Found by searching the store for the company name and logo. | Not covered by EdgeProtect |

## What should you do if someone is impersonating your business?

Act in this order. Most of the value comes from the first three steps.

1. **Capture evidence.** Save the full web address, a dated screenshot and, for email, the original message with its headers.
2. **Check what it does.** Find out whether the page is live, whether it asks for logins or payments, and whether the domain can receive email.
3. **Report it.** Tell the registrar, the hosting provider or the platform. The guide on how to report a phishing website shows where each report goes.
4. **Warn people.** Tell staff and affected customers what to look for and what to do if they already clicked.
5. **Report to the authorities.** In the UK, forward suspicious emails to the National Cyber Security Centre at `report@phishing.gov.uk`.
6. **Block it.** Add the domain to your email filter and web filter so your own staff cannot reach it.

Reports do not always lead to removal, and the time it takes varies with the registrar, the host and the evidence you supply.

## How do you find lookalike domains?

Attackers pick names that survive a quick glance. Knowing the common patterns tells you what to look for.

- **Typing mistakes:** `acem.co.uk` for `acme.co.uk`.
- **Swapped lookalike characters:** `acrne.co.uk`, where "rn" stands in for "m", or a zero in place of an "o".
- **Added words:** `acme-payroll.com` or `acme-support.co.uk`.
- **Different endings:** `acme.net` when you own only `acme.co.uk`.

EdgeProtect brand protection runs continuous lookalike-domain discovery for the domains you add. For each lookalike it records whether the name is registered and whether it can receive email, and it alerts you to new lookalikes and changes. A lookalike that can receive email is a bigger risk than one that cannot.


## Questions

### What is brand impersonation?

Brand impersonation is when an attacker uses your company's name, logo or domain to make a fake website, email, profile or listing look like it comes from you. The aim is to steal logins, payments or personal details.

### What is the difference between spoofing and impersonation?

Spoofing forges your exact domain in the sender address of an email. Impersonation uses a different domain, profile or listing that merely looks like yours. Email authentication helps against spoofing. Finding lookalikes is how you catch impersonation.

### What is brand impersonation protection?

Brand impersonation protection is the set of checks and responses that find and act on fake versions of your brand. It can cover domains, social profiles, marketplaces and app stores. EdgeProtect covers the domain side: it finds lookalike domains and tells you which are registered and can receive email.

### Does EdgeProtect find fake social media profiles, marketplace listings or apps?

No. EdgeProtect covers lookalike domains only. Fake social media profiles, marketplace listings and app store listings are not covered.

### Can a lookalike domain be removed?

Sometimes. Removal depends on the registrar, the hosting provider and the evidence you give them, and it can take time. EdgeProtect finds the domain. You decide whom to report it to.

### What is an example of brand impersonation?

A fake sign-in page on a domain such as acme-payro11.com that copies a real company's payroll portal is a common example. Another is an email from acme-co.uk asking a customer to pay an invoice into a new account, when the real domain is acme.co.uk.

## Related

- [How to report a phishing website](https://www.edgeprotect.io/guides/how-to-report-a-phishing-website)
- [Brand protection](https://www.edgeprotect.io/features/brand-protection)
- [Domain monitoring](https://www.edgeprotect.io/features/domain-monitoring)
- [Credential exposure](https://www.edgeprotect.io/features/credential-exposure)
- [SSL certificate monitoring](https://www.edgeprotect.io/features/ssl-certificate-monitoring)