Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Monitor two things: the status and security of the domains your organization owns, and suspicious domains that may be impersonating your brand. When you find a lookalike, treat it as a lead—not proof of abuse. Record the evidence, assess what the site is doing, and report suspected phishing or other DNS abuse to the domain’s registrar of record. ICANN’s registrar-first process applies to in-scope gTLD abuse; it is not a universal takedown route for every domain or trademark dispute.
What domain monitoring should cover
Domain fraud monitoring has two related but distinct jobs. First, protect your legitimate domains from loss of control, unauthorized changes, or missed renewals. Second, look for domains that could be used to deceive customers or staff. Checking your own registrar account helps with the first job; it does not by itself find external lookalikes.
- Your domain inventory: official domain names, registrar of record, account owner, renewal dates, status, and relevant contacts.
- Potential impersonation: suspicious domain names, websites, messages, or links that appear to misuse your brand.
- Response readiness: a way to preserve evidence, contact the registrar, and track any follow-up or escalation.
ICANN defines DNS abuse to include botnets, malware, pharming, phishing, and spam when spam is used to deliver those forms of abuse. A domain that merely resembles a brand—or raises a trademark concern—does not automatically establish one of these abuse types. See ICANN’s DNS Abuse Mitigation Program for its definitions and mitigation context.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build a monitoring routine
1. Record the domains you control
Maintain a current inventory of your organization’s official domains and their registrar details. Include the registrar of record, account owner, renewal and status information, and the people responsible for account access and incident response. Review domain status routinely, not just when a renewal notice arrives.
#1 Best Overall
ICANN SSAC Recommendation 6 advises registrars to encourage routine monitoring of domain status and timely, accurate maintenance of contact and authentication information. That recommendation appears in SAC 007, dated 7 December 2005; it is useful domain-hygiene guidance, not a current specification for any particular registrar.
2. Review suspected lookalikes
When a suspicious name or link comes to your attention, record the full domain exactly as shown and when you observed it. Preserve the URL, relevant email or message, and screenshots of the page. Capture enough context to show what a visitor would see and what action the page requested. Then assess whether the content is actually deceptive or harmful before making an abuse allegation.
A screenshot can preserve visible page content, but it cannot establish who operates a domain or prove intent on its own. Keep the original message or link and other relevant context alongside any image. If browser setup is part of your evidence workflow, ScreenshotNeo is a website screenshot API and MCP server; use it only as a capture tool, not as a domain monitoring or attribution service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Keep an incident record
For each suspected incident, maintain a concise record containing the domain, observation time, relevant URL or message, evidence collected, why the behavior appears harmful, and any report reference or response. Preserve the report you send and when you sent it; that information is useful if you later need to follow up with the registrar or raise a complaint with ICANN Contractual Compliance.
Report suspected abuse to the registrar
- Identify the registrar of record. Use the domain’s registration information to determine which registrar handles it.
- Submit an abuse complaint to that registrar. Describe the suspected conduct and provide the exact domain, relevant URLs, observation times, and supporting evidence. Distinguish observed phishing or malware behavior from a name that simply resembles your brand.
- Save your submission and track the response. Keep a copy of the complaint and any reply so you can show what was reported and when.
- Consider ICANN escalation only when applicable. If a reasonable time passes and you believe the registrar has not met its obligations, ICANN says you may file a complaint with Contractual Compliance.
ICANN’s DNS Security Threat Mitigation guidance describes this registrar-first route and possible escalation. It concerns abuse involving generic top-level domains (gTLDs); it should not be read as a promise that ICANN can resolve every country-code TLD case, trademark dispute, or request to remove content. ICANN’s process is not a universal takedown service.
Secure the registrar account for your own domains
Protecting your own registrar account reduces the risk that an attacker could take control of a legitimate domain or change its settings. ICANN SSAC has cautioned that identity verification used in some registrar business processes may not be enough by itself to detect or prevent fraud, misrepresentation, and impersonation.
Rank #3
- Use multifactor authentication (MFA) on registrar accounts.
- Prefer phishing-resistant MFA where available, as recommended by CISA’s MFA guidance.
- A physical FIDO/WebAuthn security key may be an option, but confirm that your registrar supports the method before purchasing or enrolling one. CISA also discusses hardware-based PKI or FIDO authentication in its Enhanced Visibility and Hardening Guidance.
- Maintain accurate account contact and authentication information, and keep an appropriate recovery method available.
- Continue checking domain status and renewal information; MFA does not replace domain monitoring.
Use screenshots carefully when preserving evidence
A browser screenshot can document the visible state of a suspicious page at a particular time. It is one part of an evidence record, not proof of domain ownership, intent, or the full behavior of a site. Save the original URL and message as well, and avoid altering the only copy of the evidence.
For a direct capture, ScreenshotNeo accepts a URL and returns an image or PDF. Its API can capture a page, but it does not discover suspicious domains or determine whether a page is fraudulent. The code examples and API options are documented at ScreenshotNeo’s API documentation.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webp
Python
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)
Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
Recommended Free Tools
Replace YOUR_API_KEY with your API key and the example URL with the page you need to document. Keep captured files with the incident record and note when the capture was made.
Best Value
Or skip the browser setup
ScreenshotNeo can remove cookie banners, popups, and chat widgets before the shot. Bot checks, blank pages, and failed loads are never billed. Its MCP server lets AI agents take screenshots, and the free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000.
Sign up for ScreenshotNeo’s free plan.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Interpret abuse figures cautiously
ICANN complaint and enforcement reports describe cases handled under a defined contractual process, not every instance of brand impersonation on the internet. For example, ICANN’s June 2026 Contractual Compliance report recorded 10 registrar phishing-abuse cases as resolved in June 2026 by domain suspension or deactivation. That is a monthly enforcement-handling figure, not a measure of total phishing domains or all brand abuse.
ICANN’s rolling report also notes that one complaint can concern multiple domains and multiple abuse types, so abuse-type totals should not be mistaken for a count of distinct complaints or reported domains. The available official figures do not establish a defensible global total for brand-impersonation domains.
Troubleshooting a report or monitoring gap
- The domain only looks similar. Similarity alone does not show phishing or another DNS abuse type. Preserve what you observed and assess the page’s conduct before reporting it as abuse.
- You do not know where to report. Identify the registrar of record and submit the abuse complaint there first for an in-scope gTLD case.
- The registrar has not responded or acted. Keep the original complaint and timeline. If a reasonable time has passed and you believe the registrar failed to meet its obligations, review ICANN’s Contractual Compliance route; it is limited to applicable gTLD obligations.
- A screenshot does not show the page clearly. Preserve the URL and message regardless, and record the capture time. A capture is supporting evidence, not a substitute for the original context.
- You cannot use a security key with your registrar. Confirm supported MFA options with the registrar, use an available MFA method, and maintain a recovery method. Do not assume a particular key model or protocol is supported.
Frequently Asked Questions
Does a lookalike domain automatically violate ICANN’s DNS abuse rules?
No. A similar name by itself is not proof of phishing, malware, or another defined form of DNS abuse. The site’s behavior and evidence matter.
Can ICANN directly remove any domain that imitates a brand?
No. The described process is for applicable gTLD abuse complaints and contractual obligations; ICANN is not a universal domain takedown service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
