Look-alike domains · Client received a look-alike email

A client got an email from a copy of our domain. What do we do?

Warn the client by phone, keep the email, and report the look-alike to its registrar and host.

Last read from the sources at the foot of this page.

Check my firm Read the steps
01

What has happened?

A doppelganger domain name is a legally registered domain name that has been created by threat actors because it appears to be almost identical to the legitimate domain name of a targeted organization.

The RCMP calls this a doppelganger domain: a legally registered domain name created because it looks almost identical to a targeted organization's real domain.

The email did not come from your systems, so changing passwords will not stop it. The domain belongs to someone else, and it has to be dealt with where it is registered and hosted.

02

What do we do first?

  1. Call the client at the number on file.Ask them not to pay or reply, and to send you the email as an attachment so its headers are kept.
  2. Ask whether any money or documents have already gone out.If money has, tell them to call their bank's fraud line at once.
  3. Check whether other clients received the same email.
03

Where do we report the look-alike?

register all internet domains that are slightly different than the actual company domain

The RCMP also advises registering the internet domains that differ slightly from your own, so fewer near copies are left for others to take.

  1. Report it to the registrar's abuse contact and to the company hosting any website on it.
  2. Report the fraud to the Canadian Anti-Fraud Centre, and to local police if money was lost.
04

How do we stop the next one working?

  1. Tell all clients, by a channel you already use with them, that your bank details do not change by email.
  2. Turn on look-alike protection in your own mail settings so staff are warned too.
Sources

Where does this come from?

Related
06 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy