A fake website impersonating your business is taken down by reporting it to the companies that keep it online: the hosting provider serving the content, the domain registrar that sold the domain, and the browser and email blocklists that warn users. The fastest takedowns pair clear evidence of fraud (phishing, payment theft, malware, or trademark infringement) with a report sent to the right abuse contact. When the domain itself is the problem, a legal dispute process can transfer it to you.
This guide covers each route, what to put in a report, and how to catch the next impersonation site before it reaches your customers.
What Counts as a Fake Website Impersonating Your Business
Providers act faster when you can name the specific abuse. Most impersonation sites fall into one of these patterns:
- Phishing clones copy your login page to harvest credentials. They are often hosted on lookalike domains such as examp1e.com or example-login.net.
- Fake storefronts use your logo and product photos to take payments for goods that never ship.
- Typosquatted domains catch mistyped traffic. Common tricks include character swaps, extra letters, homoglyphs (a Cyrillic "а" in place of a Latin "a"), TLD swaps (example.net instead of example.com), and combosquatting (example-support.com).
- Parked domains with live MX records show no website but can send and receive email as your brand. They are a common setup for invoice fraud.
"They're using our name" is a weak report. Phishing, fraud, and malware break almost every provider's acceptable use policy, and an abuse desk can act on those violations the same day. Pure trademark disputes usually need more paperwork and take longer.
How to Take Down a Fake Website: Step by Step
- Preserve evidence before you report anything. Take full-page screenshots, save the page source, and record the exact URLs with timestamps. Keep any phishing emails with full headers and any customer complaints. Sites often vanish or change once the operator notices attention, and you need proof for follow-up reports or legal action.
- Identify who controls the infrastructure. You need the registrar, the hosting provider or CDN, the IP address, any mail servers, and the TLS certificate details. A scan at dokyma.com pulls the WHOIS/registration data, DNS records, MX records, and certificate information for a suspicious domain in one place, so you know exactly where to send each report.
- Report to the hosting provider. This is usually the fastest route because the host can remove the content directly. Send your report to the provider's published abuse contact. If the site sits behind a CDN or reverse proxy, report to the CDN as well. Many CDNs will pass the complaint to the origin host or reveal it to you.
- Report to the domain registrar. Registrars accredited for generic TLDs must publish an abuse contact and investigate reports. For clear phishing or malware, many registrars will suspend the domain. Suspension is stronger than a hosting takedown because it disables the website and email on that domain at once, wherever it is hosted.
- Report to browser blocklists and email providers. The major browsers use safe-browsing blocklists that show full-page warnings on known phishing and malware sites. Reporting the URL there protects users even while the site stays up. If the domain is sending phishing email, report it to the large mailbox providers' abuse channels as well.
- Send a copyright or trademark notice if content is copied. If the site uses your copyrighted text, images, or design, a copyright takedown notice (a DMCA notice in the US) to the host carries legal weight. Copied logos and brand names support a trademark complaint.
- Use a domain dispute process to get the domain back. Suspension leaves the domain registered, and it can come back later. The UDRP (Uniform Domain-Name Dispute-Resolution Policy) covers generic TLDs and can transfer the domain to you if you can show three things: the domain is identical or confusingly similar to your trademark, the registrant has no rights or legitimate interests in it, and it was registered and is being used in bad faith. Many new generic TLDs also support the Uniform Rapid Suspension (URS) system, a faster and cheaper process that suspends a clearly abusive domain but does not transfer it. Country-code TLDs run their own dispute policies, so check the rules for that registry before you file.
What to Include in an Abuse Report
Abuse desks handle large volumes of complaints, and vague reports wait in the queue. Make yours easy to act on:
- The exact URLs and the domain, written in plain text
- The specific violation (phishing, fraud, malware, or copyright infringement) and the policy it breaks
- Screenshots and timestamps showing the impersonation
- Proof that you own the brand, such as a trademark registration or your official domain
- A clear request: remove the content, suspend the domain, or both
Keep a log of every report, ticket number, and reply. If a provider doesn't act, a documented history supports escalation to the registry operator, a legal demand letter, or a dispute filing.
Protect Customers While the Takedown Is Pending
Takedowns can take hours or weeks, so cut the damage in the meantime. Warn customers through your site, email, and social channels, and tell them which domain is your only official one. Publish SPF, DKIM, and DMARC records with an enforcing policy so attackers can't send email from your real domain. Register the most obvious variants of your own domain, such as common typos and key TLDs, so attackers can't use them.
Catch the Next Fake Site Earlier
Impersonation usually starts before a single phishing email goes out. Attackers register a lookalike domain, set up MX records, and request a TLS certificate. Each of those steps leaves a trace in registration data, DNS, and certificate transparency logs. If you spot a domain at that stage, you can report it before it costs you money or customers.
Your next step: run a free brand scan at dokyma.com. Dokyma generates the typosquat, homoglyph, TLD-swap, and combosquat variants of your domain. It checks which ones are already registered, flags any with live mail servers or newly issued certificates, and gives you the registrar and hosting details you need to start a takedown today.