In brief
Preserve the exact domain and any related messages, check legitimate ownership, and establish what is happening. Escalate evidence of impersonation promptly. Report specific abuse to the appropriate provider; similarity alone is not proof of wrongdoing.
- Keep the original evidence before a page or message disappears.
- Separate a suspicious name from evidence of deception.
- If credentials or money are involved, start the incident process immediately.
First, decide whether this is an active incident
A domain alert and a customer’s report of a fraudulent invoice are not the same starting point. If someone has already entered a password, sent money or shared sensitive information, involve your incident-response owner straight away. Do not wait for a domain takedown before addressing the exposure.
If all you have is a similar name, begin with a review. Your company may own it, an agency may have registered it for a campaign, or it may belong to an unrelated business.
| What you know | First action |
|---|---|
| Only a similar name or DNS observation | Check known ownership and record the finding for review. |
| A page copies your brand or asks for account details | Preserve available evidence and escalate to the security owner. |
| A message asks for new payment details | Verify with finance through a known channel and preserve the original email. |
| Someone may have shared credentials or paid | Activate incident response and contact the relevant account or financial provider promptly. |
References: [1]
Write down the exact domain before doing anything else
Copy the hostname into your case notes. Compare the spelling with the real domain and identify the actual registered name. A familiar brand at the start of a longer URL may only be a subdomain of somebody else’s domain.
Check your own domain inventory and ask the team that manages brands, agencies and campaigns. This short step can prevent a mistaken abuse report against an authorized service.
Record what you know separately from what you suspect. “Customer received a payment-change message from this domain” is an observation. “The same attacker owns every domain on this IP address” is a conclusion that needs additional evidence.
Save evidence that another person can actually use
Think about the person who will receive the case next. They need to see the domain, what it did, when you observed it and why it appears to impersonate your business. A cropped screenshot with no address or timestamp leaves important questions unanswered.
Keep original email files and full headers when available. Save relevant screenshots, exact URLs, observation times with time zones and the report that brought the issue to your attention. Retain an unedited copy of the evidence and use a redacted copy when sharing more widely.
Do not log in, download a file or make a payment to test the suspicious site. If live inspection is needed, use your security team’s established analysis process.
Protect the people already in the conversation
For confirmed abuse, coordinate appropriate email, web or DNS blocks with the team responsible for those controls. Check the scope first: a broad block aimed at shared infrastructure can affect unrelated services.
If a customer has received a fake invoice, tell the responsible account and finance teams what happened. Verify the correct payment instructions through a known channel. A public warning may be useful in some incidents, but it is not a substitute for reaching an affected person directly.
Where credentials may have been exposed, follow the organization’s account-recovery and incident process. Where money may have moved, involve the relevant financial provider promptly. Domain removal alone does not reverse either kind of exposure.
Send the report to the party that can act
The registrar manages the domain registration. The hosting provider operates the service behind the site. An email provider may be relevant to messages sent through its infrastructure. They can be different organizations, so describe the issue to the appropriate recipient.
For DNS abuse, ICANN’s reporting guide recommends contacting the relevant registrar or registry first. Registration lookup data can help identify the registrar and its official abuse contact. For a compromised legitimate website, the host or site owner may be better placed to fix the content.
Explain the specific abusive behavior. Include the exact domain or URLs, relevant evidence, your connection to the affected business and a contact for follow-up. Keep the ticket reference and the time you submitted it.
If the abuse persists, use the provider’s escalation process. ICANN’s contractual complaint process has a defined scope and is not a general takedown service for every deceptive page. A trademark or ownership dispute may require a different process and qualified advice.
Abuse report draft
Subject: Suspected impersonation involving [domain] I represent [organization], whose legitimate domain is [domain]. We observed the following activity involving [exact domain / URL] on [date, time and time zone]: [Describe the specific message, page or request. Separate confirmed facts from suspicions.] Why this appears to impersonate our organization: [Explain the copied identity, misleading claim or deceptive request.] Supporting evidence: - [Original message / relevant headers] - [Screenshot with URL and observation time] - [Other relevant evidence, with unrelated personal data redacted] Known impact: [State what is known. Do not include unnecessary sensitive information.] Please investigate under your applicable abuse policies and provide a case reference. I can supply additional evidence through an appropriate secure channel. Contact: [Name, role and business contact details]
References: [2]
Keep one case record as the situation changes
A case often passes between support, IT, finance and a provider’s abuse team. Keep the evidence and decisions together so people do not have to reconstruct the incident from scattered messages.
Use this worksheet for your internal record. It is a starting point, not a requirement to collect every field before taking urgent action.
Incident worksheet
Case reference: Case owner and backup: Legitimate organization and domain: Observed domain and URLs: First observed (time zone): How it was reported: Confirmed facts: Unverified assumptions: People, accounts or payments potentially affected: Evidence location: Containment actions and owners: Provider reports and ticket references: Communications sent: Outstanding questions: Next review time: Closure decision and reason:
An inactive page is a change, not necessarily closure
If the website disappears, record when you checked and what changed. That does not establish that every related message stopped, an exposed account is secure or a payment issue has been resolved.
Close the case against the problems you actually identified. Keep unresolved questions visible, retain the evidence according to your policy and review whether your alert routing or verification process needs improvement.
Then consider related names. A baseline check can help identify other variations for review; ongoing monitoring can bring future changes back to your team.
A few common questions
Should I contact the operator of the suspicious domain?
Do not assume that is the safest or most effective first step. Preserve evidence, check legitimate ownership and use your response process and official provider channels. Avoid revealing sensitive case details to an unverified party.
Does DNSTwister guarantee a takedown?
No. Finding and monitoring a domain is different from removing it. Providers assess reports under their own policies, and some disputes require other processes.
References
- UK National Cyber Security Centre — Phishing scams: reporting routes and actions after sharing sensitive information.
- ICANN — Submitting DNS Abuse Complaints, step-by-step guide, November 2025: appropriate recipients, evidence and escalation scope.
Product details were checked against the available documentation on . Fictional examples are labelled in the guide.
