Fake website impersonating your brand: what to do first
A fake website impersonating your brand needs the right route fast. Triage by type, evidence to keep, registrar, host and domain-dispute steps.
If a fake website impersonating your brand is live, the first move is to classify it by what it does to visitors, not by how much it annoys you, because the type decides which party can act and how fast. A page that collects logins or payments can be reported to the registrar, the web host, browsers and search engines at once. A page that only copies your name, or a domain that is parked, usually needs a trademark or domain-dispute route that takes weeks.
Most advice here is a list of places to report. The real difficulty is that each party acts on a narrow set of grounds, and a report filed on the wrong ground is closed without explanation. The work is matching the ground to the party, keeping evidence that survives a takedown, and telling your customers while the formal routes run.
This guide is written for the owner or counsel of a company whose name, logo or product is being used by a site that is not theirs. It is defensive only. It says nothing about how such sites are built, and it names no real cases or companies. Rules and policies are described as the pages read for this guide state them, with the source named. It is information, not legal advice, and a lawyer who practices trademark and domain law should decide anything that involves a filing or a letter.
- Classify the fake first: lookalike address, credential or payment trap, cloned store, fake support or recruitment page, or a site that only trades on your name. Each type has a different fastest route.
- Capture evidence before you report anything. Reports lead to takedowns, and a page that disappears takes your proof with it.
- Registrars act fastest on phishing and similar harms. They are not the forum for a pure trademark argument, which goes through a domain dispute or a legal letter.
- A domain dispute needs a trademark you can show, and its remedies concern the name, a transfer or a cancellation, not money. Use it when the name matters or keeps coming back.
- Tell customers which address is real while the routes run. Silence is the most expensive part of this problem.
Five kinds of fake, and why the type decides the route
Sort a fake by the harm it does to a visitor, because registrars, hosts, browsers and regulators are each built around a particular harm. This is a working classification from practice, not an official one.
Related readBrand Ambassador Scandal: The First 24 HoursA lookalike address with nothing on it. A name close to yours that is parked, redirects, or shows advertising. The harm is confusion and diverted traffic. Registrars and hosts often will not act on this alone, and the realistic routes are a domain dispute or a letter.
A credential or payment trap. A page that imitates your login, checkout or invoice screen to collect details. This is the clearest case for fast action, because phishing is a recognized abuse category and every party in the chain has a policy for it.
A cloned store or catalog. A site that sells what you sell, or pretends to, under your name and imagery. Payment providers, marketplaces and hosts all have rules for it, and your trademark is the key that opens them.
A fake support, recruitment or partner page. A page that tells people to contact "your company" by a channel you do not run. The harm lands on job seekers, suppliers and investors, which is where a warning on your own site matters most.
A site that trades on your name without pretending to be you. A complaint site, a "review" aggregator, a parody. These may be lawful speech, and treating them as impersonation is a common way to turn a small problem into a larger one.
The first hour: what to capture and what to leave alone
Capture before you report, because the first successful report often removes the page and your proof with it. Keep the evidence complete and dated, and never engage with the site.
- Record the address exactlyCopy the full web address and the domain name as text, not from memory or a screenshot alone. Note the date and the time with its time zone.
- Capture the page as a visitor sees itSave full-page screenshots and, where you can, a saved copy of the page. Capture the top, the contact details, the payment or login step as shown, and the footer.
- Look up the registration and hosting dataRun a public registration lookup for the domain and note the registrar, the creation date and any named abuse contact. Note which company hosts the site, or whether it sits behind a proxy service.
- Log how it reached peopleSave the ad, email, message or search result that sent someone to it, with the sender details and the date. Ask any customer who contacted you to forward, not delete, what they received.
- Do not enter real details or payNever type a real password or card number into the page to test it. Use a separate device or a security colleague if the page must be viewed again, and keep a written note of who viewed what and when.
- Store it where it cannot changeKeep the pack in a restricted folder with dated file names, untouched once saved.
Do not contact the operator, threaten or buy anything: a message tells them you have noticed.
Related readEcommerce reputation management: what to fix firstDecision table: which route fits which fake
Use the table to choose the first two actions. "Needs" is the evidence or right each route asks you to bring. The speeds are typical ranges from experience, not promises, and they vary by provider.
| Type of fake | Fastest routes, in order | What it needs | Where it stalls |
|---|---|---|---|
| Credential or payment trap | Host and registrar abuse report, browser and search warning reports, customer notice | Evidence of the harm, not a trademark argument | A host that ignores reports; the operator moving to a new address |
| Cloned store | Host and marketplace notice, payment provider report, then domain dispute | Your trademark and proof of your genuine goods | Operators in places that do not respond to notices |
| Fake support or recruitment page | Warning on your own site, host report, platform report for the channel used | The page and the contact channel it promotes | The channel is a messaging account that has no company contact |
| Lookalike address, parked | Domain dispute, or a lawyer's letter first | A trademark and a showing of bad faith | Weeks to resolve; some names are legitimately close to yours |
| Name used without pretending to be you | Usually none. Reply publicly, correct facts, or take legal advice on defamation | A false statement of fact, not just criticism | The route fails because the content is lawful |
Registrars and hosts: what they will act on and what they will not
A registrar sold the domain name; a host runs the servers that serve the page. A page can move between hosts in hours while the name stays with the registrar. Report to both, and expect different grounds.
ICANN's advisory on the registrar contract explains the ground registrars are held to. After the amendments of 5 April 2024, the registrar agreement requires a registrar that has actionable evidence a name is used for DNS abuse to "promptly take the appropriate mitigation action(s)". The advisory defines DNS abuse as malware, botnets, phishing, pharming and spam when it delivers one of those. It says the registrar weighs the cause and severity of the harm and the risk of collateral damage, and for a compromised legitimate site it may notify the operator or host rather than suspend the name. The ICANN advisory on DNS abuse obligations is the page to cite in a report. The advisory does not address trademark disputes, so a report that says only "this name infringes our mark" is not on that ground.
For a credential trap, state what the page does, attach the evidence and name the abuse category. For a parked lookalike, expect to be pointed to the domain dispute policy.
Hosts work from their own acceptable use or abuse policies, and the same logic applies: harm is easier to act on than infringement. A common complication is a proxy or security service that sits in front of the real server. Cloudflare's abuse approach page says that for sites it only proxies it does not host the content and cannot remove it; instead it forwards the complaint to the operator and to the hosting provider and gives the host the origin address so the content can be found. The same page says trademark complaints about content it does host follow a notice-and-takedown process. Other providers differ, so read the host's own policy before filing.
Related readFounder reputation affects company: separate or alignFile through the provider's own form and keep the reference number. Report every layer you can identify, because a provider that cannot remove a page may forward the report to one that can.
Browsers and search engines: warnings before removal
Getting a site flagged protects your customers faster than getting it removed.
Google's Search Central page on reporting spam, phishing or malware lists three separate forms: a spam report, a malware report to Safe Browsing and a phishing report to Safe Browsing. For spam it says reports may be used to take manual action against violations and tells reporters not to include personal information. For malware and phishing it does not describe what happens after a report. The Safe Browsing report page itself could not be read for this guide, so treat a report as one input, not a promise of a warning.
A warning in a browser or a removal from results does not remove the site: the address still works for anyone who has it, which is why customer communication cannot wait for a report to succeed. If the fake outranks your real site for your own name, treat it as two jobs: report it on the abuse routes, and make your own pages complete enough to rank for your name. The second job is the durable one.
Domain disputes: when the UDRP is worth filing
The Uniform Domain-Name Dispute-Resolution Policy is the standard route for taking a name from someone who registered it to trade on yours. ICANN's UDRP page says registrars are obligated to observe the policy, that most trademark-based domain disputes must otherwise be settled by agreement, court action or arbitration before a registrar will cancel, suspend or transfer a name, and that the holder of trademark rights can start an expedited administrative proceeding for abusive registrations such as cybersquatting by filing a complaint with an approved provider. The provider's own guide, such as the WIPO Arbitration and Mediation Center guide to the UDRP, holds the procedure, but it could not be re-read for this guide.
Related readLayoffs and employer brand reputation: what stays publicThe complainant has to show three things, in the usual statement of the test: the name is identical or confusingly similar to a mark in which they have rights; the registrant has no rights or legitimate interests in it; and it was registered and is being used in bad faith. All three. Whether an unregistered mark can support a complaint, and how, is a point for counsel and the provider's guide. For country-code domains the registry must have adopted the policy or its own version, so check that before assuming the route exists.
The process has the same stages in every case: a complaint, a response from the registrant, a panel of one or three, a decision, and implementation by the registrar after a short waiting period during which the registrant can go to court. The exact periods, the panel fees and the case length are set out in the provider's guide and fee schedule, which could not be re-read for this guide, so take every figure from the provider's current page before you budget or plan around it. As a rule of thumb from practice, a case runs for weeks to a couple of months, far slower than an abuse report.
The limits matter as much as the speed. The remedies in this procedure are about the name itself: a transfer, a cancellation, or a denial of the complaint. Treat it as a route that does not pay damages or legal costs. A panel can also find that a complaint was brought in bad faith, which is a public finding against the brand, so file only where the facts support all three elements.
Related readLegal Dispute and Brand Reputation: A Company PlaybookSome providers and registries also run a faster, cheaper procedure for the most clear-cut cases. Its rules could not be read for this guide, so confirm which top-level domains it covers and what it can order before you consider it.
| Situation | Domain dispute worth filing? | Reason |
|---|---|---|
| Name is your mark plus a small change, used for a clone | Yes | All three elements are usually easy to show with the evidence pack |
| Operator will take the page down but will keep the name | Yes, if the name is dangerous to leave with them | Only a transfer or cancellation stops reuse of the name |
| Name is descriptive and you have no mark in it | No | Element one is missing; the case would likely be denied |
| Registrant is a genuine business with a similar name | No | Element two and three are unlikely, and a failed case can end in a bad-faith finding |
| Page is a criticism site using your name | Rarely | Free-speech arguments make it a weak case |
Trademark and legal routes: the United States, the UK and the EU
Trademark rights open most of the slower routes, so settle early whether you have one. A registered mark in the territories where you trade is the strongest position; if you only have the name in use, take advice before building a plan around it.
United States. The Federal Trade Commission's Impersonation Rule took effect on April 1, 2024. The final rule text in the Federal Register notice makes it a violation to materially and falsely pose as a business or one of its officers, directly or by implication, and to misrepresent affiliation with a business, including endorsement or sponsorship. The preamble's illustrative examples include lookalike websites or domains, spoofed business email and ads that impersonate a business. The notice describes enforcement by the Commission, including civil penalties and consumer redress, and does not say the rule creates a private right of action. For a brand owner, the practical use is as a complaint to the authorities and as a reference in a letter, not as a form you can file to get a site removed.
United Kingdom. The usual building blocks are a registered UK trademark, the law of passing off for an unrelated business that trades on your goodwill, and the dispute service run by the .uk registry for .uk names. We could not read the UK government's IP infringement guidance or the registry's dispute pages for this guide, so check the current rules and fees on the registry's own site and with a UK solicitor before you file.
Related readNew company online reputation with no reviewsEuropean Union. An EU trade mark registered with the EU Intellectual Property Office is enforceable in the member states through national courts designated to hear it, and the .eu registry has its own alternative dispute resolution service for .eu names. We could not read the EUIPO or the .eu registry pages for this guide, so the same advice applies: confirm the current rules and the forum before spending money.
A cease-and-desist letter works against a reachable business and does little against an anonymous operator, who may read it as a signal to move. A court order can reach more than a domain dispute, but it costs more and takes longer, so it is kept for a persistent operation.
A worked scenario: a fake payment page for a small manufacturer
This is an invented scenario with generic parties, built to show the order of operations. Assume a small manufacturer with a registered trademark in its home country and an online order form. A customer emails to say an "invoice reminder" sent a link to a payment page that looks like the company's.
| When | Action | Who | Result to expect |
|---|---|---|---|
| Hour 0 to 2 | Evidence pack: address, captures, registration lookup, forwarded message | Owner and one colleague | A dated pack that survives a takedown |
| Hour 2 to 6 | Notice on the real site and in the mail footer naming the genuine payment address; ask customers to forward, not click | Owner | Customers stop paying the wrong place |
| Hour 6 to 24 | Reports to the host, the registrar (phishing ground) and the browser and search engine phishing forms | Owner or counsel | Reference numbers; possibly a quick suspension |
| Day 2 to 7 | Follow up on each reference; report the sending account or ad; tell the bank or payment provider if money moved | Owner and finance | Page down, or the host answers with a reason |
| Week 2 to 8 | If the name is a close variant of the mark: domain dispute for transfer, so it cannot be reused | Counsel | A decision in weeks to a couple of months, by provider |
The owner did not contact the operator, did not test the form with real details, and did not start with the domain dispute. The abuse reports came first because they act on harm. The dispute came after, to take the name out of the operator's hands.
What fails and what makes it worse
These are the failure modes we see most often as practitioners.
Reporting on the wrong ground. A trademark complaint sent to a registrar's abuse desk, or a phishing report with no evidence of phishing, is closed. Match the ground to the party using the table above.
Related readPartner and supplier due diligence on your companyContacting the operator. It warns them, and a threat can be screenshotted and published. If a letter is needed, a lawyer sends it, and only after the evidence pack exists.
Buying the domain back. It pays someone who registered the name to trade on yours and signals that your name has a price. Counsel should decide this, not an urgent inbox.
Overreach. A domain case where you have no mark, or against a legitimate business with a similar name, can end in a public finding that the complaint was abusive.
Treating one fake as the whole problem. A cloned site often has siblings: a social profile, a marketplace listing, an ad account. Look for them, or the traffic moves.
Staying silent. The people most harmed are the ones who do not know. A short, factual notice on your own pages does not depend on any third party.
After the incident: keep your genuine pages the clearest answer
The long-term defense is that a visitor who searches for you finds the real site first and can verify it. That is built before an incident, from ordinary parts.
- Make the official address obvious. State it on your site, in invoices and in email signatures, with the exact payment page address and the channels you do and do not use.
- Publish your contact policy. Say that you never ask for passwords by message and what a genuine invoice looks like.
- Register the obvious variants. A handful of close names is a modest cost. You cannot register every variant, so the aim is to close the cheapest options.
- Keep your trademarks current. A mark you can show is the key to the domain and the host routes. Lapsed or missing registrations in a territory you trade in are the usual gap.
- Set up watches. Alerts on new registrations that resemble your name, on your brand in ads and on your name in search results shorten the time between a fake appearing and your first report. Ongoing reputation monitoring covers search results and AI answers as well as the web.
This guide stays on the company's own name and sites; impersonation of an individual leader is a different problem. After a takedown, also ask two or three AI assistants about your company: if a wrong address or phone number persists, trace it to the page it came from and correct that source.
Your next step: one evidence pack and one classification
Build the evidence pack before any report, and classify the fake with the five types above. Everything else follows from those two decisions.
If customers are being asked for money or details today, put a notice on your genuine site first, then file the host and registrar reports with the evidence attached. Reputation Partners can review what a stranger finds for your company name, including the fake and the real results beside it, in a private audit: start with the audit.
Questions people ask
Can I report a fake website to the police or a regulator?
Yes, and for a payment or login trap you should, alongside the technical reports. National consumer-fraud and cybercrime bodies take reports about impersonation, and a record helps if the matter reaches a bank or a court. The specific body depends on the country, so check your own government's consumer protection or cybercrime reporting page for the current form.
Do I need a registered trademark to act?
Not for every route. Abuse reports about phishing rest on harm, not on a mark. A domain dispute needs rights in a mark, and whether an unregistered name is enough depends on the forum and the facts. Courts and platforms vary, so take advice on the strength of an unregistered name before relying on it.
How long does a takedown take?
It depends on the route and the provider. A clear phishing report can lead to action within hours or days with some providers and none with others. A domain case usually takes weeks to a couple of months, and the provider's page states its own periods. A court route takes longer. Treat any single number as typical, not promised, and plan communication around the slowest.
Will the domain be mine after a successful case?
The panel can order the name transferred to you or cancelled. Transfer is implemented by the registrar after a waiting period, which gives the registrant time to go to court. If the name is cancelled, it can later be registered by someone else, which is why many owners ask for transfer where the name is dangerous to leave free.
