Protecting Your Brand with Domain Watchlists

Every recognisable brand attracts imitators. Some register a near-identical domain hoping to sell it back; others use it to send phishing emails, host a fake shop or capture customers who mistype your address. The earlier you notice such a registration, the more options you have. A domain watchlist is the practical tool for that: a structured list of names you care about, checked regularly for new registrations and changes. This guide explains what to monitor, how to prioritise and what to do when you find a problem.

Why lookalike domains are a real business risk

Cybersquatting is the registration of a domain that matches or imitates someone else’s trademark in bad faith. The classic motive was resale, but today the bigger risks are operational:

• Phishing and invoice fraud: a domain one letter away from yours can send emails that look like they come from your finance team.
• Counterfeit shops: lookalike sites sell fake products and damage trust when customers complain to you.
• Traffic diversion: typo domains often show pay-per-click ads, sometimes for your competitors.
• Credential harvesting: fake login pages on convincing domains target your customers and staff.

Customers rarely distinguish between you and a convincing impersonator. When something goes wrong, the reputational damage lands on your brand.

The variant types you should watch

Attackers generate lookalikes systematically, so your watchlist should too. The table below shows the main variant types using a fictional brand, examplebank.com.

Homoglyph domains deserve special attention. Internationalised domain names (IDNs) let people register names in many scripts, which is valuable for non-Latin languages but also allows visually identical lookalikes. Modern browsers display punycode instead of the Unicode form in many suspicious cases, but email clients and messaging apps do not always do the same.

Building your watchlist step by step

1. List your assets. Include every brand name, product name and important campaign term, plus the domains you already own.
2. Generate variants. Apply the variant types above to each term. Open-source tools such as dnstwist can generate many permutations automatically.
3. Add risky keywords. Combine your brand with words attackers like: login, secure, support, account, pay, verify, and words specific to your sector.
4. Choose extensions. Cover .com, your main country-code domains and the extensions popular in your industry.
5. Prioritise. Mark the variants most likely to be abused, such as single-character typos of your main domain and combinations with login or pay, for the most frequent checks.

Keep the list realistic. Thousands of unprioritised variants create noise that nobody reviews. A smaller list that someone actually checks is more valuable than an exhaustive one that is ignored.

What to monitor once the list exists

New registrations

The key moment is when a variant changes from available to registered. Registries publish zone files for many generic TLDs through ICANN’s Centralized Zone Data Service, and commercial services track newly registered domains daily. For your highest-priority names, a direct check of registration status is often enough.

Changes to registered variants

A registered lookalike that sits idle is lower risk than one that suddenly gets DNS records. Watch for new nameservers, A records pointing to a live server, and especially MX records, which mean the domain can send and receive email. A fresh TLS certificate for the name, visible in public Certificate Transparency logs, is another strong signal that a site is about to go live.

Expiry of names you want

Some lookalikes are held by squatters who eventually stop renewing. If you monitor their expiry dates, you can try to register them when they become available again.

With TLDix you can add priority variants to your domain list and check any suspicious name with the WHOIS and RDAP lookup to see its registrar, creation date, status and nameservers in one place.

Responding to an infringing domain

Finding a lookalike does not always mean it is malicious. Many are parked or registered by people with a legitimate reason. Respond in proportion to the risk:

1. Document everything. Save screenshots, registration data, DNS records and email headers with timestamps. Evidence can disappear quickly.
2. Report active abuse. For phishing or malware, report to the registrar’s abuse contact, the hosting provider and browser safe-browsing services. Registrars are required to have an abuse contact and act on credible reports.
3. Consider legal routes. If the domain infringes your trademark, consult a lawyer about a cease-and-desist letter or a formal dispute.

UDRP, URS and the Trademark Clearinghouse

The Uniform Domain-Name Dispute-Resolution Policy (UDRP) applies to all ICANN-accredited generic TLDs and many country-code TLDs that have adopted it. To win, a complainant must show that the domain is identical or confusingly similar to its trademark, that the registrant has no rights or legitimate interests in it, and that it was registered and is being used in bad faith. The usual remedy is transfer or cancellation, and cases are decided by providers such as WIPO.

The Uniform Rapid Suspension System (URS) is a faster, cheaper procedure for new generic TLDs. It requires clear and convincing evidence and only suspends the domain for the rest of its registration period rather than transferring it. It suits obvious abuse where you just want the site stopped.

The Trademark Clearinghouse (TMCH) is a database where trademark holders can record their marks. Recorded marks gain access to sunrise periods, letting you register matching names before general availability in new gTLDs, and to claims notices, which warn registrants and notify you when someone registers an exact match. Note that claims notices cover exact matches, not typos, so they complement rather than replace a watchlist.

Many country-code registries run their own dispute procedures, so check the rules for each relevant ccTLD.

Prevention: defensive registration and your own domains

You cannot register every variant, but registering the most dangerous ones is often cheaper than one dispute. Focus on your brand in key extensions and the most obvious typos of your main domain, then redirect them to your site. Use domain search to see which are still free.

Do not forget your own domains. When a company lets a domain expire by mistake, someone else can register it and receive email intended for you. Turn on registrar lock, keep contact details current, enable auto-renewal and track expiry dates centrally. Publishing SPF, DKIM and a DMARC policy also makes it harder for attackers to spoof your exact domain, which pushes them towards lookalikes your watchlist can catch.

Who should own brand monitoring

Brand protection often fails because it sits between departments. Marketing knows the brand names, legal knows the trademarks, and IT or security sees the phishing emails, but nobody owns the whole picture. Agree who maintains the watchlist, who reviews alerts and who decides on escalation. In a small company this can be one person with a short checklist; in a larger organisation it is usually shared between security and legal, with marketing informing them before every product launch or rebrand. Whatever the structure, make sure customer support knows how to forward reports of suspicious sites and emails, because customers are often the first to notice an impersonation.

Making monitoring a routine

Brand protection works best as a simple, repeated process: review high-priority alerts weekly, review the full list quarterly, and update it whenever you launch a new product or enter a new market. Assign a clear owner, agree in advance when to escalate to legal or security, and keep a log of every finding and action. Over time, that log shows which variants attackers prefer and where to strengthen defensive registrations.