How attackers abuse brand domains to borrow trust
Would you notice the difference between ‘microsoft[.]com’ and ‘rnicrosoft[.]com’?
Probably not if you were moving quickly. And that is exactly why typosquatting or brand impersonation domains work. An attacker registers a domain that looks almost like the official one and waits for someone to miss the difference.
The domain uses “rn” where Microsoft uses “m,” making the two look similar at a glance. It was registered years ago, made a comeback recently, and was still convincing enough to fool people.
Typosquatting or using a different TLD is just one form of domain impersonation. A deceptive journey can also begin with a paid result that displays a familiar brand name. It can move through a page on a trusted hosting service, pass through a legitimate redirect, and eventually reach a domain the brand does not control.
Recent captures by ImpersonAlly, including cases involving Google Analytics and Exness, show how these different forms of domain mismatch can play out in practice. Sometimes, the mismatch points to actual abuse. Sometimes, it does not. Knowing the difference matters because investigating the full user journey can help teams distinguish genuine threats from legitimate domains and avoid wasting resources on false positives.
What brand domain abuse looks like
Brand domain abuse, sometimes described as brand spoofing, happens when attackers use a domain, subdomain, hostname, or hosted page to make a user think they are dealing with a company.
It can take several forms:
- Lookalike registration: A misspelling, added word, hyphen, or alternate top-level domain resembles the official address.
- Deceptive subdomain: A trusted brand name appears on the left or right of a domain controlled elsewhere, such as brand.example.com.
- Hosted page abuse: A page builder or cloud service supplies a familiar hostname while the page itself copies another company.
- Redirect chain abuse: The first landing page looks low risk, but its button forwards visitors to a different registered domain.
- Cloned interface: A page reproduces a login panel, logo, product copy, or other visual elements to make the destination look legitimate.
Are lookalike domains always a hint of fraud?
A lookalike domain can be part of a brand spoofing campaign, but it is not proof of fraud by itself. Companies use regional domains, campaign sites, partner domains, and third-party services for legitimate reasons too.
For proper investigation, one must check who controls the domain in question, where it sends visitors, what the page contains, and whether it copies the brand. A stronger case emerges when several signals point in the same direction.
Investigating Suspicious Domains in Practice
Domain impersonation techniques can look very different in a real user journey. The following cases, captured by ImpersonAlly, show what that looks like in practice, from the first search result to the pages and domains a visitor encounters along the way.
Case Study 1: Google Analytics
Earlier this year, ImpersonAlly detected a search for google anzeigen.
A sponsored result titled Google Analytics appeared above other results and displayed business[.]google[.]com.
On the surface, it looked like a direct route to a familiar Google product.
The ad looked official
The result used the headline “Google Analytics” and the description “Google Analytics Login…” which looked genuine. However, brand impersonation in paid search cannot be assessed from the headline alone. It took more than that.
The ad referred searchers to a free Google Business Profile, another Google product.
The advertiser field listed MaxReturn Advisory, not Google.
Again, an advertiser name alone does not establish who controlled every later page. But the mismatch, the mixed product copy, and the language change after the click were reasons to continue investigating.
A trusted host became the bridge
The click resolved to sites.google.com/view/ads-analyti/google, following a familiar pattern in website cloning and brand impersonation.
The Portuguese page used the Google Analytics logo, orange product graphics, a structured product layout, and blue Login and Google Analytics buttons. It also offered paths for beginners, marketers, and developers.
The page was hosted on Google Sites, but that did not make it an official Google Analytics page. This fake site gave the first destination a familiar Google hostname while impersonating Google and copying its branding. This is one way brand spoofing can borrow trust from legitimate infrastructure without controlling the brand’s actual domain.
The redirect exposed the registered domain
Selecting Login opened a google.com/url forwarding page. The notice said the browser was redirecting to google[.]analyticsis[.]pro with a token in the query string.
The forwarding page was legitimate Google infrastructure, but the destination was not a Google domain. The registered domain was analyticsis[.]pro; Google appeared only as a subdomain. A quick glance at the left side of the address could therefore make the destination look more familiar than it was.
The page drew a Google URL inside itself
The final page loaded at google[.]analyticsis[.]pro/login/. It reproduced an Analytics header, product copy, an illustration, and a centered panel asking for an email address or phone number.
At the top of that panel, a green padlock appeared beside security.google.com/synchronize. That address was a visual part of the webpage, not the browser’s actual address bar. The browser remained on the off-domain location.
The capture shows a page designed to solicit Google credentials. It does not establish that anyone submitted a password, or that credentials were exfiltrated.
The same pattern moved across Google products
A related sponsored result used the headline Ads Essentials and displayed play.google.com. Its click resolved to sites.google.com/view/preloadads/googleads.
The hosted page copied Google Marketing Platform branding and navigation, including Overview, For small businesses, For enterprises, and Resources, which most of the people can easily relate to. It also showed Contact sales and Sign in to Analytics buttons alongside a pre-filled reporting dashboard.
In essence, the same hosted-page technique could be rethemed around various Google products.
The evidence does not establish that Google authorized or permitted the impersonation. It does show that trusted advertising, hosting, and redirect surfaces can be combined before a policy or brand team sees the full path.
Case Study 2: Exness
In reality, a brand impersonation attempt does not require a globally recognized brand. It can also target a specialist brand whose customers are searching with a clear intent to open an account or reach a trading platform.
In the supplied captures, an official Exness result displayed ‘exness.com’. A separate sponsored result, marked as sponsored in Thai, used the Exness name and logo but displayed exness.market.
That difference in top-level domain is a reason to investigate.
After creating an account on exness[.]market, logging out, and then logging back in through Exness’ original domain, the account still existed. This indicates that, though it appears like brand abuse, the [.]market domain was connected to the legitimate Exness account system.
These cases also show why a domain mismatch is a starting point for investigation, not a conclusion. Knowing whether a domain is actually being used for abuse helps teams focus their time and response efforts where they are needed. So, brands must look beyond the domain itself and examine the full user journey.
Why companies of every size are exposed
Large brands have scale and recognition, while smaller brands can be harder for customers to distinguish from lookalikes. Both create opportunities for attackers to borrow trust.
For large brands, searchers know their product names, expect familiar sign-in screens and may move quickly because the service feels routine. That familiarity can make them less likely to stop and check the domain before clicking.
For smaller and specialist brands, customers may recognize the name but know less about the company’s official domain. That can make them easier to capture when they are opening an account, downloading software, or entering a new market. A convincing result can use that familiarity to appear legitimate.
How to detect fake domains impersonating your brand
Effective domain monitoring for brand protection connects discovery with journey analysis. A list of known fake domains is useful, but it can miss hosted pages, deceptive subdomains, and domains that appear only after a visitor clicks a button.
To detect brand spoofing and fake domains, businesses can:
- Monitor the brand beyond typos: Track the exact brand name, spelling variants, added words, and appearances across unexpected top-level domains.
- Parse the registered domain: Separate the registered domain from any brand name placed in a subdomain or page path. Read hostnames from right to left.
- Keep each URL field separate: Record the advertiser, displayed address, resolved landing page, redirect sequence, and interactive destination as distinct evidence.
- Reproduce the real search context: Scan the countries, languages, and devices that matter to the brand. Ads and destinations can vary by context.
- Test interactions safely: Follow buttons and forms in a controlled environment. The first page may simply be the bridge.
- Compare browser chrome with page content: Trust the browser’s address bar, not a URL or padlock drawn inside the webpage.
- Preserve evidence early: Save screenshots, timestamps, advertiser details, and redirect paths before reporting. Campaigns and pages can disappear quickly.
How brands should respond to domain abuse
Google’s Misrepresentation policy prohibits impersonating brands and cloaking, but enforcement still depends on detecting the complete ad-to-destination journey.
Detected a domain brand abuse?
First verify whether the domain belongs to the company, an affiliate, a regional business, or an authorized partner. Then preserve the complete path and report each layer to the service that controls it: the advertising platform, the hosted-page provider, the registrar or hosting provider, and the destination service.
Legal teams can assess whether the use may amount to domain name trademark infringement.
Security and brand teams, on the other hand, should not wait for that legal conclusion to preserve evidence, block confirmed threats, and warn affected users.
For a broader operating model, use our step-by-step brand impersonation prevention guide.
See what your brand looks like from the outside
Domain brand abuse does not always start with a fake website. It can begin with a search result, a familiar hostname, a trusted redirect, or a domain that looks right at first glance. So, knowing how to detect lookalike domains might not be enough.
Want to know what your own branded searches resolve to?
Run an exposure check for your brand and identify unfamiliar domains, sponsored results, redirects, and hosted pages that could be borrowing your brand’s trust.
Subscribe to the newsletter
Your Brand Protection Ally
Are your Ads being Impersonated by others?
Author
