What is brand impersonation?

Where typosquatting borrows a name and cybersquatting borrows a trademark, impersonation borrows the whole identity. The domain may differ by a character or an extension, but what the visitor sees is designed to be indistinguishable: your logo, your layout, your sign-in form, on infrastructure you do not control. The FBI defines a spoofed website as one “designed to impersonate a legitimate website,” and in September 2025 it had to warn the public that criminals were running spoofed copies of IC3.gov itself, the very site victims use to report the crime.

MITRE ATT&CK catalogs the underlying technique as Impersonation (T1684.001): pretending to be a trusted person or organization to persuade a target into acting. Depending on which layer carries it, the same conduct gets called website impersonation, domain impersonation or brand spoofing. On the web that pretense has a concrete footprint: domains, sites, apps and mail. That is what this page covers. Impersonation on social media, fake accounts on platforms like X, Instagram or Discord, is a related problem with its own reporting channels; notolens monitors domains, trademark registers and app stores, not social handles.

Brand impersonation vs. typosquatting vs. cybersquatting

The three terms describe different layers of the same attack and are easy to conflate:

	Typosquatting	Cybersquatting	Brand impersonation
What it borrows	The spelling of your name	Your trademark in a registration	Your identity: logo, layout, sign-in page
Where it happens	In the domain name	At the registrar	On the page the visitor sees
Typical payoff	Mistyped traffic, ad revenue	Resale, a blocked name	Harvested credentials or payments
Caught by	Name matching	Registration records	Checking what the site shows and does

In practice the layers stack: a lookalike or combosquatted domain supplies the plausible address, and the impersonating site it hosts does the damage. Watching the registration stream catches the first layer; only visiting the site catches the second.

The shapes impersonation takes

Fake login pages

The most direct shape: a page that clones a sign-in screen and posts what the visitor types to the attacker, often to a different domain entirely or to a messaging bot. A 2014 Google study of real phishing pages (Bursztein et al., ACM IMC 2014) found that once visitors reached a fake page, 14% submitted their information on average and up to 45% did on the most convincing ones; when the researchers planted decoy credentials, criminals tried to access roughly a fifth of those accounts within 30 minutes. The payoff keeps the shape popular: Verizon’s 2026 Data Breach Investigations Report found credential abuse somewhere in the attack path of 39% of breaches, still the top vector on that measure, even though vulnerability exploitation (31%) has overtaken it as the most common first step and credential abuse now starts only 13%.

Spoofed websites

A broader costume than the login form alone: cloned storefronts that take orders never shipped, fake checkout and account portals, or a near-perfect copy of the brand’s whole site. The domain is the prop and the page is the costume, which is why the FBI’s advice after IC3.gov was spoofed was to type known addresses directly into the browser rather than trusting links or search results.

Copycat support portals

Fake help desks intercept customers at their most credulous: mid-problem, actively looking for official support. IC3 logged 47,794 tech support scam complaints in 2025 with $2.13 billion in reported losses, part of more than $2.9 billion lost to call-center scams overall. On the consumer side, people told the FTC they lost nearly $1 billion to business impersonators in 2025, with bank impersonators causing the highest reported losses.

Spoofed apps

The same costume worn as a store listing: your name and icon published under someone else’s developer account. Google prevented more than 1.75 million policy-violating apps from being published on Play in 2025. Apple’s 2025 transparency report counts 166,899 removed apps, including 90,608 taken down for fraud and 279 under its copycat rule. App store monitoring covers this surface in depth.

The domains behind email impersonation

Email impersonation splits into two techniques that look identical in an inbox.

The first forges your exact domain in the From field. That is what SPF, DKIM and DMARC exist to stop, and the bar rose in February 2024 when Google and Yahoo began requiring bulk senders to authenticate; Gmail says an earlier authentication requirement alone cut unauthenticated mail by 75%. An enforced DMARC policy on your real domain closes that door.

The second sends from a cousin domain: a lookalike registration carrying its own mail records. dmarc.org, which maintains the standard’s documentation, is explicit that DMARC “does not address cousin domain attacks” or display-name abuse, because a lookalike domain authenticates as itself. The FBI calls the same move spoofing on the sending side, an email address or URL altered by a single letter, symbol or number, and counts it among the key parts of business email compromise. IC3 counted $55 billion in exposed BEC losses between October 2013 and December 2023 and $3.05 billion in reported BEC losses in 2025 alone, and APWG measured an average of $61,732 requested in wire-transfer BEC attacks in the second quarter of 2026.

The tell lives in DNS, not spelling. A lookalike domain with MX records can receive mail, and one that sends with no DMARC enforcement of its own passes fewer checks while wearing your name. Both show up in DNS as soon as they are configured, which can be the day the domain registers or months later.

How impersonation gets caught

Name matching alone is not the test. A phishing domain earns that label from what it serves, not from how its name is spelled. Measurement research that crawled more than 50,000 live phishing sites (PhishInPatterns, ACM IMC 2022) found that modern phishing pages often impersonate a brand without closely cloning its design, so a pure visual comparison misses them. The checks that matter look at what the site does:

• Whether the domain resolves to a live site at all, or is parked or dormant.
• Whether the page carries a sign-in or password form, and where that form posts. A login form that submits to a different domain, a chat bot or a mail endpoint is harvesting credentials no matter how the page looks.
• How closely the rendered page resembles your real site: layout, logo, copy.
• Whether the domain can send and receive mail, and whether it enforces DMARC.
• For app listings, whether the name, developer identity and store details line up with the real publisher.

The scale of brand abuse is why this has to be systematic. APWG counted 3.8 million phishing attacks in 2025, and Palo Alto’s squatting detector was already finding roughly 450 lookalike registrations a day in December 2019, about a fifth of them already malicious. Nobody reviews that stream by hand; the workable pattern is to check each new registration against your brand, then check the site that answers.

What to do when someone impersonates your brand

The response runs on parallel tracks, and the right order is evidence first:

1. Capture the facts before anything changes. Timestamped captures of the site, the DNS answers, the registration record and any correspondence are what every later step consumes. The evidence package guide covers exactly what to collect.
2. Report the content. Registrar and hosting abuse reports can suspend an impersonating site in days at no cost, though they leave the domain in the impersonator’s hands. See reporting domain abuse and reporting hosting abuse.
3. Take the name. A UDRP complaint transfers or cancels the domain itself, typically within 45 to 60 days, and US courts under the ACPA can award damages on top.
4. Report the fraud. Consumer-facing impersonation can be reported to IC3 and the FTC. The FTC’s Impersonation Rule, in force since April 2024, lets the agency act against impersonators directly; it shut down 13 websites impersonating the FTC itself in the rule’s first year.