A real brand impersonation audit, start to finish
This is a full worked example using PayPal— one of the world's most-impersonated brands, with extensively documented lookalike and typosquat activity. Every audit follows this exact shape, researched against your brand and domain.
Brand impersonation audit
We identified 8 lookalike and copycat domains impersonating this brand, 4 of them high-risk. The impersonators use homoglyph swaps, keyword combosquats, and alternate TLDs — patterns repeatedly documented in credential-phishing and account-verification scams. The highest-risk domains below should be prioritised for takedown.
Lookalike & copycat domains (8)
paypa1.com
HIGH RISKReplaces the lowercase 'l' with the digit '1' — nearly indistinguishable in most fonts. One of the most-cited PayPal lookalikes in public phishing research, repeatedly used to host fake login pages that harvest credentials.
paypai.com
HIGH RISKAppends an 'i' to the brand name. The subject of a landmark cybersquatting case (PayPal, Inc. v. paypai) — the textbook example of a brand-confusing typosquat and still a live impersonation pattern.
secure-paypal-login.com
HIGH RISKWraps the brand in reassurance keywords ('secure', 'login') to look like an official security page. This exact combosquat shape is a staple of PayPal phishing kits and password-harvesting campaigns.
paypal-secure.com
HIGH RISKAppends '-secure' to the exact brand name — a documented PayPal phishing pattern (e.g. 'paypa1-secure' variants seen in the wild). Designed to make a fake 'confirm your account' page feel legitimate.
paypall.com
MEDIUM RISKDoubles the final 'l' — a common fat-finger variant. Frequently registered to catch mistyped traffic and redirect it to ads, surveys, or affiliate-scam landing pages.
paypaI.com
MEDIUM RISKUses a capital 'I' in place of the lowercase 'l' — visually identical in many sans-serif fonts. A classic homoglyph technique used to slip past a quick visual check of the address bar.
paypal.net
MEDIUM RISKThe exact brand name on a non-official '.net' TLD. Alternate-TLD registrations are routinely used to lend false legitimacy to phishing emails and fake support pages.
paypal-support.co
LOW RISKCombines the brand with 'support' on a '.co' TLD to mimic a help desk. This shape commonly appears in fake 'account limited — verify now' emails and refund scams.
This is exactly what you get, from $99.
Enter your own company name and domain and we'll research the lookalikes, typosquats, and copycat sites impersonating your brand — with evidence, risk ratings, and this takedown template. One-time, delivered instantly, no subscription.
Get your own audit — from $99Recommended next steps
- 1Prioritise takedowns of the HIGH-risk domains first — send the template below to each registrar's abuse team.
- 2Register the closest defensive variants you don't already own (common typos, key alternate TLDs).
- 3Warn customers that you'll never ask them to log in via a link, and to check the address bar for paypal.com exactly.
- 4Re-run a check periodically — new lookalikes are registered constantly, and this is a one-time snapshot, not monitoring.
Takedown-request template
A ready-to-send email you can fire off to a registrar or host's abuse team — just fill in the bracketed details. Included with every audit.
To: abuse@[registrar-or-host]
Subject: Trademark & phishing abuse report — [infringing-domain]
Hello,
We are the owner of the "PayPal" brand and the official domain
paypal.com. It has come to our attention that the domain
[infringing-domain], registered through your service, is
impersonating our brand.
The domain reproduces our name and/or branding and is being used
(or is positioned) to deceive our customers into believing it is
an official PayPal property. This creates a clear risk of
consumer phishing, credential theft, and payment fraud, and
infringes our registered trademark.
We respectfully request that you:
1. Suspend or disable [infringing-domain] under your abuse and
acceptable-use policy; and
2. Preserve any registration and access records associated with
it for potential further action.
Please confirm receipt of this report and the action taken. You
can reach us at [your-contact-email] / [your-phone].
Thank you for your prompt attention.
[Your name]
[Your title], [Your company]
[Date]
— This is a reusable template to save you time, not legal advice.
For enforcement action, consult a qualified attorney.This is exactly what you get, from $99.
Enter your own company name and domain and we'll research the lookalikes, typosquats, and copycat sites impersonating your brand — with evidence, risk ratings, and this takedown template. One-time, delivered instantly, no subscription.
Get your own audit — from $99This page is a public sample audit. PayPal is used only as an illustrative worked example of a well-known, heavily-impersonated brand; the domains shown reflect real, publicly-documented impersonation techniquesand their history of abuse, not a live claim about any single domain's current ownership. Scam Detective is not affiliated with PayPal. Every audit is a one-time intelligence assessment to help you act — not legal advice, monitoring, or a takedown service; we don't execute takedowns on your behalf.
Questions? [email protected]