Domain Brand Monitoring

Domain brand impersonation happens when someone registers a domain name that looks like your official brand assets, effectively imitating your company’s identity. Threat actors use these domains to deceive your customers, employees, or partners by hosting fake login pages or sending fraudulent emails that appear to come from your company. They also use social media channels to promote these malicious sites.

Discovering and taking down such domains is an important part of a brand protection strategy for organizations of all sizes. Read more about digital brand protection here.

A classic example is rnicrosoft[.]com imitating microsoft[.]com — you can barely see the difference at a glance, but the letter “m” is replaced with the letters “r” and “n”. Aside from character swapping, attackers also use typosquatting or misspelled versions, such as e.g., gooogle[.]com.

They may also use different top-level domains (TLDs), such as example[.]top or country code top-level domains (ccTLDs), like example[.]ae. There are also cases in which threat actors register domains containing the names of company executives.

When you find look-alike domain names during domain monitoring, here are a few things you can do:

• Analyze the intent. Use Attaxion to check for live websites, DNS records, and mail server (MX) records. If an impersonating domain has an active MX record, it is likely being used for BEC or phishing attacks.
• Block the domain. Block it at your email gateway or web filter to protect your employees from accidentally interacting with the potentially malicious domain.
• Monitor for weaponization. Not every suspicious domain is active right away. Track the “last seen” and reachability status in Attaxion to see if a parked domain suddenly goes live.
• Gather evidence. Use the automated screenshots and WHOIS data as proof of impersonation. This documentation is essential for reporting the domain to authorities or hosting providers.
• Alert your stakeholders. If the malicious domain is active, notify your customers or partners through your official channels. Early warning can prevent them from falling for a scam or giving away their credentials.

You can start the takedown process of any look-alike domain by contacting the registrar or the hosting provider. Use the domain registration data and screenshots from Attaxion as evidence of the trademark infringement or phishing activity. Many providers have abuse departments that will suspend malicious domain names once they review your proof.

Attaxion checks newly registered domains for your keywords on a regular schedule, so you see lookalikes soon after they are registered. When you add a keyword, the first check covers roughly the past two weeks of registrations.

The “With Typos” toggle of Attaxion’s domain brand monitoring enables fuzzy matching. It automatically finds domains that use character replacement or common misspellings of your keywords. This is the best way to catch sophisticated lookalike domains used in BEC and phishing attacks.

Yes, for most security teams. Attaxion embeds brand monitoring capabilities directly into your attack surface management workflow. This eliminates the need for a separate tool and gives you a single place to manage all your external risks.
It’s worth noting that Attaxion only looks for domains. If you want to monitor brand mentions on social media, you’ll need a social listening tool. Attaxion does not provide such a feature.