Lookalike domains used to send fake emails

A lookalike domain is a name close enough to yours that a customer, supplier or job applicant reads it as yours: yourbrand-hr.com, yourbrand-invoices.com, or yuorbrand.com with two letters swapped. The registrant does not need a website. They set up an email address on the domain and write to the people who already trust you.

What do lookalike domain scams look like?

Section 3.4 of the WIPO Overview 3.1 names two patterns: deceptive emails "to obtain sensitive or confidential personal information from prospective job applicants", and emails soliciting "payment of fraudulent invoices" from a brand owner's customers.

In the LinkedIn case, D2015-1679, the fake job offers asked applicants to pay "Interview Security Fees". The website on linkedlnjobs.com only redirected to linkedin.com. The panel held that the email use alone was bad faith use.

What should I do in the first 24 hours?

Work in this order. The first two steps protect people, the rest protect the case.

1. Warn the people being targeted. Tell customers, suppliers or applicants the exact domain and that you never send mail from it. Put the warning on your careers page if the scam uses job offers.
2. Keep the evidence before it changes. Save at least one scam email with full headers, not a forwarded copy. Take dated screenshots of any website on the domain.
3. Look up the registrar and the creation date on ICANN Lookup. The creation date matters later: a domain registered before your trademark rights existed is much harder to recover under the UDRP.
4. Report the domain to the registrar's abuse contact, with the email headers attached. ICANN Lookup lists the abuse email address for every registrar of a generic domain.
5. Report the domain to the bodies that block it in browsers and mail systems. In the UK that is the National Cyber Security Centre, through its scam website form. Anywhere, report it to Google Safe Browsing.
6. If anyone has lost money, report it to the police. In England, Wales and Northern Ireland that is Report Fraud.

Do not write to the registrant. Fraudsters rarely answer, and a warning only tells them to move to the next domain.

Will the registrar take the domain down?

Usually, for a generic domain such as .com, .net or .shop. Section 3.18.2 of ICANN's Registrar Accreditation Agreement, in force since 5 April 2024, says that when a registrar has "actionable evidence" that a domain is being used for phishing, it "must promptly take the appropriate mitigation action(s)" to stop it. In the first worked example of ICANN's advisory on the amendment, a registrar suspended a phishing domain within two business days.

Country-code domains such as .es, .de or .bg are outside that ICANN contract. Each registry sets its own abuse rules, so the timing varies.

A suspension stops the domain resolving. It does not give it to you. The registrant still holds the domain, and it can come back when the suspension is lifted or the registrant moves registrar.

Why file a UDRP complaint as well?

Because a UDRP complaint is the only fast route that moves the domain into your name. A WIPO panel can order a transfer in about two months, with no court and no hearing.

Lookalike fraud cases are among the strongest a trademark owner can bring. Section 2.13.1 of the WIPO Overview 3.1 says panels "have categorically held" that using a domain for phishing, identity theft or other fraud "can never confer rights or legitimate interests" on the registrant. Section 1.9 says a deliberate misspelling of a trademark is confusingly similar to it. That covers two of the three elements before the registrant says a word.

A UDRP complaint costs €1,050 in our fees, plus the WIPO filing fee from $1,500 for one to five domains with one panelist. Up to five lookalike domains held by the same registrant go in one complaint for the same WIPO fee. What a complaint costs has the full fee table.

You need a registered trademark, or provable unregistered rights, in the name the domain copies. Without one there is no first element.

How do I stop the next one?

Register the variants a fraudster would pick first, before they do: your trademark with "hr", "jobs", "careers", "invoice" and "pay" on your main extension, plus the obvious one-letter misspellings. Each costs roughly what your main domain costs a year.

Publish a DMARC record on your own domain. DMARC, defined in RFC 7489, lets receiving mail servers reject mail that forges your exact domain. It does nothing against a different lookalike domain, which is why fraudsters register one.

A trademark watch reads trademark registers. It does not see new domain registrations, so it will not warn you about a lookalike domain.

Next

• Cybersquatting and its other patterns
• What a UDRP complaint costs
• Finding the respondent behind a privacy service
• How to file a complaint