Brand impersonation is one of the fastest growing threats facing organizations today. Bad actors create fake websites using an organization’s name, logos, and visual identity to exploit brand trust and steal a customer, partner, or employee’s credentials, money, or sensitive data.
The FTC received 3 million fraud reports from consumers in 2025. Imposter scams were the most frequently reported fraud and has been since 2020.
More than half of consumers (54%) say they trust a brand less after encountering a scam associated with it, even if the company was not directly responsible, according to a recent Clutch report.
Ninety two percent believe the companies they engage with are responsible for protecting their digital privacy, according to a TeleSign report.
Scammers are using AI and kits to make sure today’s phishing websites are pixel-perfect replicas that can fool even the most cautious users.
They impersonate brands by registering domains closely resembling an organization’s legitimate URLs using:
- Typosquatting. Registering websites with common misspellings, permutations, or keyboard errors (“gogle.com” instead of “google.com”) to redirect website traffic to malicious phishing, malware installation, or ad revenue generation sites.
- Homoglyph characters. Swapping real characters with those from Cyrillic, Greek and Latin characters to present victims with visually indistinguishable hyperlinks.
- Creative subdomain structures. Using brand names to make lookalike URLs, taking over abandoned or forgotten subdomains, or using random strings of characters that look like legitimate websites.
Attackers harvest more credentials every second a phishing site is live. Security teams are in a race against time to eliminate malicious sites, but takedown requests can get rejected because something’s missing, costing time, money, and efficiency.
Here’s a four-step process for taking down an impersonation website, so you know exactly what to do, and in what order, when you identify one.
Step 1: Confirm the site is impersonating your brand
Start by documenting what makes the site misleading or unauthorized. This usually includes:
- Brand names, logos, or product references used without permission
- Lookalike domains designed to appear official
- Content that could confuse or mislead customers
- Forms, login pages, payment prompts, or download links
What you’ll need:
- Screenshots of the site URLs and timestamps
- A simple document or spreadsheet to keep everything together
- Screenshot tools (built in browser tools or tools like GoFullPage)
- Save URLs and timestamps in a simple doc or spreadsheet
If helpful, review general phishing indicators: https://consumer.ftc.gov/articles/how-recognizeand-avoid-phishing-scams
Tip: Capturing this information early is important, since host providers require it later.
Step 2: Identify where the site is hosted
To request removal, you’ll need to know who controls the infrastructure behind the site.
Most teams:
- Run a WHOIS lookup to identify the domain registrar Identify the hosting provider
- Look for abuse or trust & safety contact information
- Note any intermediaries like CDNs or proxy services
What you’ll need:
- Domain name IP address (in some cases) Registrar and hosting details
Helpful Resources:
Step 3: Submit a takedown request
Each provider has its own policies and submission takedown process.
In most cases, you’ll have to provide:
- A clear explanation of how the site violates policy
- Supporting evidence (URLs, screenshots, timestamps)
What you’ll need:
- Prepared documentation from Step 1 and 2
- The correct abuse or reporting channel for each provider
Common takedown entry points:
- Google Safe Browsing (for phishing and deceptive sites):
- Hosting provider abuse contacts (varies by provider)
- Registrar abuse contacts (listed in WHOIS records)
Tip: Some providers respond quickly. Others may ask for clarification or additional documentation.
Step 4: Once a request is submitted
- Confirm the site is actually offline
What you’ll need:
- A way to track submitted requests
Helpful Checks:
- Revisit the original URL directly
- Check search engine results for caches or mirrored versions
Tip: It’s also a good idea to check back periodically, as similar sites sometimes reappear under new domains.
Malicious brand impersonation websites are like viruses. The longer they stay alive, the more damage they inflict. Security teams need to take them down quickly the first time. Use this four-step process to avoid having your takedown requests rejected so you can neutralize threats as soon as possible.
About the Author
Rod Schultz is the CEO of Bolster AI. He is a seasoned technology executive and cybersecurity leader with more than 25 years of experience driving product innovation, secure technology development, and executive leadership at companies including Cisco, Apple, Adobe, and Zoom. Now as CEO of Bolster AI, he applies that deep expertise to protecting brands, customers, and digital identities at scale: leading the company’s mission to detect and disrupt phishing, impersonation, and other digital-threat actors with a mindset grounded in innovation, trust, and speed.
Rod can reached online at https://www.linkedin.com/in/rodschultz/ and at our company website https://bolster.ai/.
