Lookalike domain takedown: how to report a phishing domain and get it removed

A lookalike domain takedown means getting a domain that imitates yours suspended, or at least cut off from its website and mailboxes. If someone registers a variant of dupont-immo.fr to send fake invoices in your name, the people who can act are the companies that provide that domain, its hosting and its email service, each under its own abuse policy.

This guide sets out the order we recommend to take down a fraudulent website and the domain behind it: secure the evidence, report the domain to the right contacts, write a report an abuse desk can act on, follow up, and turn to dispute-resolution procedures such as UDRP when reports are not enough. It is general information, not legal advice.

First steps: do not engage, collect evidence

Do not reply to the fraudulent emails, click their links or log in to the site to see what it does. You do not need to visit the site to make your case: the messages your clients received and the public DNS records usually say enough, and visiting can expose your computer or alert the operator.

Collect the following, noting the date and time of each item:

• the exact lookalike domain, and the legitimate domain it imitates;
• its DNS records: name servers (NS), web hosting (A and AAAA), mail servers (MX) and TXT records such as SPF;
• its registration data from RDAP or WHOIS: registrar, creation date, status;
• the fraudulent emails as original files (.eml) or with their full headers, plus screenshots;
• what the messages asked for (new bank details, a payment, a password) and, if a client lost money, when it happened.

Public DNS records can be read from any terminal, without contacting the suspicious site. Save the output with the date, since the records can change at any moment:

dig NS <lookalike-domain> +short
dig A <lookalike-domain> +short
dig AAAA <lookalike-domain> +short
dig MX <lookalike-domain> +short
dig TXT <lookalike-domain> +short
whois <lookalike-domain>

Full headers matter because they show which servers actually handled the message. Most mail clients offer an option such as “show original” or “view source” to display them.

Who to contact for a lookalike domain takedown, and in what order

1. The registrar

The registrar sold the domain and can suspend it, which removes it from DNS: the website and the mailboxes stop working together. RDAP, the successor to WHOIS, gives the registrar's name and usually its abuse email address. For generic extensions such as .com, ICANN requires accredited registrars to publish an abuse contact and to investigate the reports they receive. ICANN also provides a lookup tool for registration data. Country-code extensions follow their own registry's rules: for .fr, the registry is Afnic.

2. The hosting and mail providers

The A and AAAA records point to the servers hosting the website, the MX records to the servers receiving mail for the domain. Look up the network that owns each IP address in the RDAP or WHOIS of the regional internet registry (RIPE NCC for Europe, ARIN for North America, and so on): the result includes an abuse contact. A host can take the site offline and a mail provider can close the mailboxes even if the registrar does nothing.

3. Browser blocklists

Google Safe Browsing, used by several major browsers, has a public form to report phishing pages. Once a site is listed, visitors see a warning, which limits the damage while the other reports are processed. Other browser vendors run comparable reporting services.

4. Email providers and authorities

If the fraudsters write from, or ask for replies to, an address at a webmail provider, report that address to the provider's abuse service with the headers. In France, cybermalveillance.gouv.fr publishes guidance for victims; in the UK, the NCSC accepts reports of suspicious emails and websites. If money was transferred, contact the bank at once and file a police report.

What a good domain abuse report contains

Abuse desks handle large volumes of reports. A short, factual message with evidence attached is easier to act on than a long complaint. Include:

1. The domain and the type of abuse in the subject line, for example “Phishing: domain impersonating dupont-immo.fr”.
2. The facts: what the domain is used for and since when, with the dates of the emails received.
3. The evidence: DNS records, RDAP data, emails with full headers and screenshots, as attachments.
4. Your authority to act: you own the imitated domain or brand, or you hold a mandate from its owner.
5. The harm: clients asked to pay to new bank details, passwords requested, your name used to deceive.
6. The request: suspend the domain, remove the site, close the mailboxes.

Write as if the domain holder could read it, because some providers forward reports to their customer. Redact your clients' personal details from screenshots and keep internal information out.

What to expect from a lookalike domain takedown request

Each provider applies its own policy, and none is bound to follow your request to the letter. The outcome can be a suspension of the domain (RDAP then shows a status such as clientHold or serverHold, and the domain drops out of DNS), the removal of the site or the mailboxes, or no action at all. Some providers ask for more information; others only send an automatic acknowledgement.

Follow up if nothing changes. Check the DNS records again, reply in the same ticket with any new evidence, and widen the circle to the registry operator of the extension. For a gTLD registrar that ignores abuse reports, ICANN accepts complaints about registrars that do not meet their contractual obligations.

Keep a log of every report: who, when, what was sent and what came back. You will need it if you escalate to a dispute procedure or consult a lawyer.

When abuse reports are not enough: UDRP and .fr procedures

An abuse report targets an activity such as phishing. If the domain is parked, or the provider finds the evidence insufficient, a dispute-resolution procedure targets the registration itself.

UDRP for generic extensions

The Uniform Domain-Name Dispute-Resolution Policy (UDRP) applies to generic extensions such as .com. It is administered by approved providers, notably the WIPO Arbitration and Mediation Center. The complainant must show that the domain is identical or confusingly similar to a trademark in which it has rights, that the holder has no rights or legitimate interests in the domain, and that it was registered and is being used in bad faith. The possible outcomes are the transfer or the cancellation of the domain.

SYRELI and PARL EXPERT for .fr

For .fr, Afnic runs two procedures: SYRELI, decided by Afnic itself, and PARL EXPERT, decided by an independent expert. Both can lead to the transfer or the deletion of the domain when the conditions are met. Afnic's website sets out who can file and how.

These procedures require a structured file and, for UDRP, trademark rights. Talk to a lawyer who handles intellectual property or domain disputes before filing.

Protect your clients in the meantime

A takedown takes time and may not succeed, so act on your side too. The playbook is the same one used against payment diversion fraud:

• warn your clients through your usual channel that a domain imitating yours is in use, and state that your bank details never change by email;
• confirm any change of bank details by calling a number you already know;
• publish DMARC on your own domain, following our DMARC p=reject guide, so that fraudsters cannot also send from your exact address;
• keep watching for new lookalikes: a fraudster whose domain goes down can register another one.

Property managers and letting agents, who handle deposits and rent, will find specific advice in our guide to payment fraud in property management.

Assisted takedown with Spamr

The free scan lists the registered lookalikes of your domain from public DNS and RDAP data only, without ever visiting them. Anyone sees the counts and the three most dangerous; the full list is available once you prove you manage the domain.

From there, you can request an assisted takedown. You give Spamr a mandate to act on your behalf and the request is reviewed manually. Abuse reports with an evidence PDF then go to the registrar and to the hosting providers' abuse contacts found in RDAP, and you receive a prefilled Google Safe Browsing report link. The domain is checked every night, and you are told when it disappears from DNS. Each provider still decides under its own abuse policy, so no outcome is guaranteed. A request costs €79, and takedowns are included in the Pro and Agency / Firm plans (see pricing).

Key takeaways

• Do not engage with the site. Collect the domain, dated DNS records, RDAP data and emails with full headers.
• Report to the registrar first, then the hosting and mail providers, Google Safe Browsing and any webmail provider involved.
• Keep each report short, factual and backed by evidence, and state your authority to act.
• No provider guarantees an outcome: follow up and keep a log.
• When reports fail, UDRP (generic extensions) or SYRELI and PARL EXPERT (.fr) target the registration itself.