Monitoring fake websites and phishing under the brand name
According to data from 2024 year, 80% of homoglyph domains, resembling brands from the Global 2000 list, are registered by third parties, and 42% of them have MX records configured — that is, the domain is technically ready to send mail on behalf of the company, including phishing emails to partners and customers. This is not a potential threat, but a ready-made attack infrastructure that is simply waiting to be activated.
Four types of domain threats — and why they cannot be treated with a single protocol
A security service that responds to all suspicious domains equally wastes time where there is none. Domain parking can wait a week. A copy of the authorization page cannot wait even a day.
| Domain Type | Threat Mechanism | Response Priority |
|---|---|---|
| Typosquatting (typos in brand name) | Capturing random traffic, redirecting to competitors or ads | Medium |
| Homoglyphs (visually identical characters, Cyrillic instead of Latin) | Exact domain imitation, credential theft, ready MX records for mailing | Critical |
| Combosquatting (brand + word: bank-support, brand-shop) | Expanding the legend, counterfeit stores, SEO parasitism | High |
| Masking words (login, verify, secure, account) | Direct imitation of the login or payment form — maximum fraud conversion | Critical |
The statistics for the first half of 2026 year shift the focus to where it is usually not looked for: from 45 321 registered incident 45,73% was due to SEO pollution — parasitic pages that capture traffic through search results, not through direct URL entry in the browser. Counterfeit sites accounted for 29,56%. Monitoring one domain registry does not cover these figures — separate control of search results and separate control of marketplaces are needed, as these are different channels with different blocking tools.
A trademark is not a paper for reporting, but the only key to blocking
Without a registered trademark, there is nothing to ground a request for domain blocking: neither the UDRP panel, nor the court, nor Roskomnadzor will accept a claim built solely on the brand's reputation. A registrar and hosting provider respond not because the company is 'well-known,' but because there is a protected right that the specific domain infringes upon. Without such a right, any claim is merely a request that can be legally ignored.
Companies that delay registering a trademark until phishing has already caused damage lose months proving the existence of the right itself—instead of immediately proving infringement. The UDRP panel and courts first compare the trademark registration date with the disputed domain's registration date: if the trademark was registered after the domain, the case becomes significantly more complicated, and sometimes becomes hopeless.
Case: a fourth-level subdomain that collected banking card data for three months
This scheme repeats consistently across different financial brands in a disturbingly stable manner. The attacker registers a third-level domain that looks legitimate and places a phishing page on a fourth- or fifth-level subdomain of the form secure-login.brandname-support.example.com. Monitoring systems configured to track only root domains and direct variations of the brand name systematically miss — a significant number of such phishing sites remain outside the scope of standard checks, especially on deep-level subdomains. The turning point comes not through a client's complaint, but through monitoring Certificate Transparency: as soon as an SSL certificate is issued for a subdomain, the record of this appears in the public log before the active attack begins. The team monitoring the logs in real time gets a window of several hours or days to respond before a mass phishing campaign starts. With a modular approach — automatic detection, manual analysis by a lawyer, immediate action through the registrar or hosting provider — 87% of such resources are blocked in less than 24 hours. Without this module, the same subdomain lives for months, because it formally does not match any template in the list of monitored domains.
Legal pathway: from cheap to expensive, without skipping steps
The order of actions of the rights holder is built in ascending order of time and money costs. Skipping an obligatory step is almost always punished at the next stage.
- Pre-trial claim to the registrar and hosting provider. Removes domain parking and obvious phishing within a few days without formal procedure — provided that evidence of violation and a copy of the trademark certificate are attached.
- UDRP (international zones) or the procedure of the CS (.ru/.рф). Timelines and costs differ radically — comparison below.
- Court lawsuit. Required if UDRP/CS did not yield results or if damages need to be recovered. In the USA, under ACPA one can receive $1 000–100 000 compensation for one domain — UDRP does not provide this at all.
- Appeal to Roskomnadzor (art. 15.1 of the law on information). Rapid blocking of access to a phishing resource within the Russian Federation, but not a substitute for a court decision — to annul a domain in .ru/.рф zones, a court is still required.
| Parameter | UDRP (international zones) | CS procedure (.ru/.рф) |
|---|---|---|
| Review period | 45–60 days | 30–45 days |
| Cost | $1 500–3 000 | $20 000–60 000 |
| Success rate in direct cases of cyber squatting | more than 80% | requires additional judicial confirmation |
Mixing steps is a bad idea: a court lawsuit without a pre-litigation claim is often dismissed by courts as non-compliance with the mandatory procedure. And filing a complaint with Roskomnadzor without parallel work on domain rights temporarily blocks access, leaving the resource alive for a restart under a new IP as early as next week.
Evidence base: what to collect before filing a UDRP or lawsuit
The UDRP panel and court decide the case based on documents, not the applicant's reputation. The minimum set:
- Screenshots of the phishing page with the date and time of fixation — through notarization or an automated fixation service; a regular screenshot without metadata may not be accepted by the court as evidence.
- WHOIS data of the domain at the time of discovery, including the registration history.
- Proof of trademark registration with a priority date preceding the disputed domain registration.
- Technical analysis of MX records and SSL certificate — shows the domain's readiness for active phishing campaigns, not passive parking.
- Examples of actual user deception: customer complaints, support correspondence, cases of fraudulent transactions.
77% of phishing domains are registered by cybercriminals specifically for a particular attack, not transferred from previously legitimate resources, and 37% go through mass registration services. These figures should be noted separately — they reinforce the argument about the bad faith registration, which is a key criterion for success in UDRP.
Continuous monitoring: why scheduled checks — an outdated model
Waiting for a client's complaint means responding to damage that has already occurred. Phishing attacks have increased by 182% since 2021 and reached 1,96 million attacks per year; at this rate, periodic manual checks physically cannot keep up.
The working system is built on three parallel streams:
- monitoring Certificate Transparency logs for mentions of the brand in certificate names;
- automatic scanning of domain variations (typos, homoglyphs, combos) through registrar APIs;
- separate control of deep-level subdomains that regular scanners ignore.
It is precisely the third stream that closes those 8 000 annual phishing sites on 4–5 level subdomains that remain outside the scope of basic tools. The value of such a system is not in the number of domains found, but in the speed of transition from detection to blocking. The modular chain «detection → legal analysis → immediate action via a ready-made complaint template» delivers those very 87% blockings per day. Without a pre-prepared legal base — a registered mark, complaint templates, an established channel with registrars — even instant detection of phishing turns into weeks of bureaucracy while the attack continues to collect user data.
According to data from 2024 year, 80% of homoglyph domains, resembling brands from the Global 2000 list, are registered by third parties, and 42% of them have MX records configured — that is, the domain is technically ready to send mail on behalf of the company, including phishing emails to partners and customers. This is not a potential threat, but a ready-made attack infrastructure that is simply waiting to be activated.
Four types of domain threats — and why they cannot be treated with a single protocol
A security service that responds to all suspicious domains equally wastes time where there is none. Domain parking can wait a week. A copy of the authorization page cannot wait even a day.
| Domain Type | Threat Mechanism | Response Priority |
|---|---|---|
| Typosquatting (typos in brand name) | Capturing random traffic, redirecting to competitors or ads | Medium |
| Homoglyphs (visually identical characters, Cyrillic instead of Latin) | Exact domain imitation, credential theft, ready MX records for mailing | Critical |
| Combosquatting (brand + word: bank-support, brand-shop) | Expanding the legend, counterfeit stores, SEO parasitism | High |
| Masking words (login, verify, secure, account) | Direct imitation of the login or payment form — maximum fraud conversion | Critical |
The statistics for the first half of 2026 year shift the focus to where it is usually not looked for: from 45 321 registered incident 45,73% was due to SEO pollution — parasitic pages that capture traffic through search results, not through direct URL entry in the browser. Counterfeit sites accounted for 29,56%. Monitoring one domain registry does not cover these figures — separate control of search results and separate control of marketplaces are needed, as these are different channels with different blocking tools.
A trademark is not a paper for reporting, but the only key to blocking
Without a registered trademark, there is nothing to ground a request for domain blocking: neither the UDRP panel, nor the court, nor Roskomnadzor will accept a claim built solely on the brand's reputation. A registrar and hosting provider respond not because the company is 'well-known,' but because there is a protected right that the specific domain infringes upon. Without such a right, any claim is merely a request that can be legally ignored.
Companies that delay registering a trademark until phishing has already caused damage lose months proving the existence of the right itself—instead of immediately proving infringement. The UDRP panel and courts first compare the trademark registration date with the disputed domain's registration date: if the trademark was registered after the domain, the case becomes significantly more complicated, and sometimes becomes hopeless.
Case: a fourth-level subdomain that collected banking card data for three months
This scheme repeats consistently across different financial brands in a disturbingly stable manner. The attacker registers a third-level domain that looks legitimate and places a phishing page on a fourth- or fifth-level subdomain of the form secure-login.brandname-support.example.com. Monitoring systems configured to track only root domains and direct variations of the brand name systematically miss — a significant number of such phishing sites remain outside the scope of standard checks, especially on deep-level subdomains. The turning point comes not through a client's complaint, but through monitoring Certificate Transparency: as soon as an SSL certificate is issued for a subdomain, the record of this appears in the public log before the active attack begins. The team monitoring the logs in real time gets a window of several hours or days to respond before a mass phishing campaign starts. With a modular approach — automatic detection, manual analysis by a lawyer, immediate action through the registrar or hosting provider — 87% of such resources are blocked in less than 24 hours. Without this module, the same subdomain lives for months, because it formally does not match any template in the list of monitored domains.
Legal pathway: from cheap to expensive, without skipping steps
The order of actions of the rights holder is built in ascending order of time and money costs. Skipping an obligatory step is almost always punished at the next stage.
- Pre-trial claim to the registrar and hosting provider. Removes domain parking and obvious phishing within a few days without formal procedure — provided that evidence of violation and a copy of the trademark certificate are attached.
- UDRP (international zones) or the procedure of the CS (.ru/.рф). Timelines and costs differ radically — comparison below.
- Court lawsuit. Required if UDRP/CS did not yield results or if damages need to be recovered. In the USA, under ACPA one can receive $1 000–100 000 compensation for one domain — UDRP does not provide this at all.
- Appeal to Roskomnadzor (art. 15.1 of the law on information). Rapid blocking of access to a phishing resource within the Russian Federation, but not a substitute for a court decision — to annul a domain in .ru/.рф zones, a court is still required.
| Parameter | UDRP (international zones) | CS procedure (.ru/.рф) |
|---|---|---|
| Review period | 45–60 days | 30–45 days |
| Cost | $1 500–3 000 | $20 000–60 000 |
| Success rate in direct cases of cyber squatting | more than 80% | requires additional judicial confirmation |
Mixing steps is a bad idea: a court lawsuit without a pre-litigation claim is often dismissed by courts as non-compliance with the mandatory procedure. And filing a complaint with Roskomnadzor without parallel work on domain rights temporarily blocks access, leaving the resource alive for a restart under a new IP as early as next week.
Evidence base: what to collect before filing a UDRP or lawsuit
The UDRP panel and court decide the case based on documents, not the applicant's reputation. The minimum set:
- Screenshots of the phishing page with the date and time of fixation — through notarization or an automated fixation service; a regular screenshot without metadata may not be accepted by the court as evidence.
- WHOIS data of the domain at the time of discovery, including the registration history.
- Proof of trademark registration with a priority date preceding the disputed domain registration.
- Technical analysis of MX records and SSL certificate — shows the domain's readiness for active phishing campaigns, not passive parking.
- Examples of actual user deception: customer complaints, support correspondence, cases of fraudulent transactions.
77% of phishing domains are registered by cybercriminals specifically for a particular attack, not transferred from previously legitimate resources, and 37% go through mass registration services. These figures should be noted separately — they reinforce the argument about the bad faith registration, which is a key criterion for success in UDRP.
Continuous monitoring: why scheduled checks — an outdated model
Waiting for a client's complaint means responding to damage that has already occurred. Phishing attacks have increased by 182% since 2021 and reached 1,96 million attacks per year; at this rate, periodic manual checks physically cannot keep up.
The working system is built on three parallel streams:
- monitoring Certificate Transparency logs for mentions of the brand in certificate names;
- automatic scanning of domain variations (typos, homoglyphs, combos) through registrar APIs;
- separate control of deep-level subdomains that regular scanners ignore.
It is precisely the third stream that closes those 8 000 annual phishing sites on 4–5 level subdomains that remain outside the scope of basic tools. The value of such a system is not in the number of domains found, but in the speed of transition from detection to blocking. The modular chain «detection → legal analysis → immediate action via a ready-made complaint template» delivers those very 87% blockings per day. Without a pre-prepared legal base — a registered mark, complaint templates, an established channel with registrars — even instant detection of phishing turns into weeks of bureaucracy while the attack continues to collect user data.
Recent articles
MegaFon, BMW, VTB and more 240+ companies. See how it looks in the showcase reel:
Our branding agency is approached to order:
Branding agency services
