Lookalike Domain Response Checklist: A Practical Checklist

How to use this checklist

Print this now and put a copy with your bank's fraud desk number written at the top. On the day you need it, your email may not be trustworthy and your shared drive may be the last thing anyone thinks to open.

Phase 0 is done in advance. If you have just found a lookalike domain, start at Phase 1, and hand Phases 2, 3, and 6 to different people, since they run at the same time. Phase 2 outranks everything else when money has moved. Times are targets drawn from experience with how fast funds and evidence disappear. Unless a note says otherwise, they are not legal deadlines.

The reasoning is in Lookalike Domains and Typosquatting: Phishing, Invoice Fraud, and the Legal Tools That Take Them Down. The narrative walkthrough is Taking Down a Lookalike Domain in Days: A Practical Guide. Fill-in templates for the letters mentioned below are in the Lookalike Domain Toolkit: Abuse Reports, Registrar Demands, and UDRP and URS Outlines.

Phase 0: Prepare before anything happens

• Write down the bank fraud contacts. Record the after-hours wire room and fraud numbers for each operating account. Source: the 2025 IC3 Annual Report says time is of the essence and that banks' recall policies vary. Note: Ask the bank what it will need for a recall and whether it will give you the beneficiary bank's fraud contact. Who signs an indemnity at 6 p.m. on a Friday?
• Adopt a call-back rule for payment changes. Verify by phone at a number from the contract or master file. Authority: Thomas v. Corbyn Restaurant Development Corp., No. D083655 (Cal. Ct. App. May 27, 2025); Yangtze Railroad Fasteners International USA Inc. v. Ohio Valley Trackwork Inc., 2026-Ohio-1518. Note: Thomas found that a call to a number from the fraudulent thread did not help the payor. The source of the number decides whether a call counts.
• Accept the bank's security options, including dual control. Authority: Choice Escrow & Land Title, LLC v. BancorpSouth Bank, 754 F.3d 611 (8th Cir. 2014); UCC §§ 4A-201 to 4A-203. Note: In Choice Escrow, the customer's signed waiver of dual control figured in the bank's win.
• Read your wire agreement for the name-and-number notice. Authority: UCC § 4A-207(c); 218 Broadway, LLC v. J.P. Morgan Chase Bank, N.A. (S.D.N.Y. Aug. 14, 2026).
• Review crime and cyber policies for fraudulent-instruction or social engineering coverage. Note sublimits, call-back conditions, and notice terms. Authority: Principle Solutions Group, LLC v. Ironshore Indemnity, Inc., 944 F.3d 886 (11th Cir. 2019); Apache Corp. v. Great American Insurance Co., 662 F. App'x 252 (5th Cir. 2016).
• Add payment-change and notice clauses to key contracts. Authority: best-position cases above treat the allocation as open where the contract is silent.
• Register the mark. Most tools past the abuse desk need trademark rights. Authority: 15 U.S.C. § 1125(d)(1)(A); URS Procedure § 1.2.6.1.
• Harden mail. Require phishing-resistant MFA, alert on forwarding rules, and set DMARC to enforcement on your own domains. Note: DMARC protects your exact domain. It won't stop mail from a domain the fraudster owns.
• Stand up monitoring. Watch newly registered names, Certificate Transparency logs, and permutations of your marks. Lock your real domains with registry lock. See Domain Name Security and Recovery Checklist: A Practical Checklist.
• Register obvious variants through a company-owned account: hyphen forms, common TLDs, and words like billing, invoice, pay, and remit.

Phase 1: Five-minute triage

• Decide whether money has moved or is about to. If pending, stop it. If gone, begin Phase 2 at once.
• Identify the pattern. Inbound (someone imitates a vendor or colleague to take your money) or outbound (someone imitates you to deceive customers). Note: The trademark remedies belong to the mark owner. In an inbound case you will need the imitated company's cooperation or authorization.
• Identify the registrable domain. In name.brand.com.remit-portal-secure.net, the domain is remit-portal-secure.net.
• Sort malicious from compromised. Authority: ICANN's February 2024 DNS abuse advisory. Note: A hacked small-business site should be fixed, not suspended. Report it accordingly.
• Assume a mailbox compromise until ruled out. Ask how the fraudster knew the invoice details and thread.
• Name owners for money, systems, domain, communications, and legal. Move the team to phones and a clean channel.

Red flag: Do not coordinate the response over the mailbox that may be compromised. The fraudster may read your plan, and in Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., 759 F. App'x 348 (6th Cir. 2018), rules silently diverted the very messages that would have exposed the scheme.

Phase 2: The money (first hour)

• Call the bank's wire room and fraud department; request a recall. Source: FBI's Domestic FFKC summary; UCC § 4A-211. Note: After acceptance by the beneficiary's bank, a recall depends on that bank's agreement or a system rule. It's a request, so make it fast and make it a phone call.
• Have the details ready. Account, amount, date and time, beneficiary name and number, beneficiary bank, routing or SWIFT code, and IMAD/OMAD or UETR reference.
• Get a case number and name; confirm in writing from a clean address.
• Authorize a hold harmless or indemnity letter if the bank asks. Source: FBI summary above; UCC § 4A-211(f).
• File at ic3.gov with full banking details. Source: 2025 IC3 Annual Report (file regardless of amount; supply any second-hop information).
• Contact the FBI field office for a large or cross-border wire. Source: 2025 IC3 Annual Report (international requests run through FinCEN's Rapid Response Team and FBI legal attachés).
• Send written notice of fraud to the beneficiary bank. Authority: Studco Building Systems US, LLC v. 1st Advantage Federal Credit Union, 133 F.4th 264 (4th Cir. 2025); Approved Mortgage Corp. v. Truist Bank, 106 F.4th 582 (7th Cir. 2024). Note: Studco requires actual knowledge of a mismatch, and Approved Mortgage leaves room for claims about post-credit conduct. Facts and only facts in this letter.
• Freeze vendor master changes for 72 hours.
• Review 90 days of payments for other changed accounts. Call those vendors at known numbers.
• Determine whether the wire was sent by your employee or by an intruder. Authority: UCC §§ 4A-202 to 4A-204; Patco Construction Co. v. People's United Bank, 684 F.3d 197 (1st Cir. 2012). Note: An order sent by an intruder raises an authorization question and calls for a different letter to the bank. An order your own employee sent is likely authorized.

Red flag: Taking down the domain first. A wire freeze depends on hours, and a domain report can usually wait until the bank has been called.

Phase 3: Evidence (before reporting the domain)

• Open an evidence folder and capture log. Record who, what, when, tool, and hash. Authority: Fed. R. Evid. 901; Fed. R. Evid. 902(13) and (14).
• Export original emails as .eml or .msg. Do not rely on forwards or screenshots. Note: Capture Authentication-Results, DKIM d=, Return-Path, Reply-To, and all Received lines.
• Save lookups. RDAP/WHOIS through ICANN Lookup, plus NS, A, MX, TXT, and _dmarc records.
• Record both Unicode and xn-- forms for any IDN.
• Search Certificate Transparency logs for sibling names.
• Capture any site from an isolated machine. Get a full-page image showing URL and time, saved HTML, and redirects. Never enter real credentials.
• Collect payment records. Invoice, approvals, master-file log, bank confirmation, call logs, and verification notes.
• Have the employee write a factual account to counsel. Keep it prompt and privileged where possible.
• Issue a litigation hold; suspend log and mailbox deletion. Authority: Fed. R. Civ. P. 37(e). Note: Some mail and sign-in logs have short default retention. Export them today.
• Have counsel engage any forensic vendor. See Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege. Note: Engagement through counsel helps but doesn't guarantee privilege. A report shared widely for business purposes is at risk.
• Prepare certifications for later admission. See Authenticating Website Evidence: A Practical Checklist and Hearsay and Business Records Checklist: A Practical Checklist.

Red flag: A successful report may erase the page and DNS records you needed as evidence. Reverse the natural order, and capture first.

Phase 4: Containment

• Block the domain and siblings at the mail gateway and DNS filter.
• Search mail logs for prior traffic. Preserve messages before purging.
• Review sign-ins, forwarding and inbox rules, delegates, and OAuth grants. Authority: Beau Townsend facts; 18 U.S.C. § 2701 and 18 U.S.C. § 1030 if access occurred.
• Revoke sessions, then reset passwords, then strengthen MFA. Note: A password reset alone can leave a stolen session token active.
• Assess notification duties if personal data was in the mailbox. See Data Breach and Incident Response Toolkit: From Detection to Notification.

Phase 5: Communications

• Send a short internal notice. Facts, the domain, what not to do, and who to tell.
• Tell the impersonated company today, at a known number. Authority: Bile v. RREMC, LLC, 2016 WL 4487864 (E.D. Va. Aug. 24, 2016), as discussed in Beau Townsend. Note: In Bile, silence after learning of an attempted diversion moved the loss to the silent side.
• Ask the other company for a named contact and written authorization to report. Source: ICANN complaint guide.
• Warn customers in an outbound attack. Give the real domain, the defanged fake, the request being made, and a number to call. Post on the website.
• Keep fault out of writing. Route analysis through counsel.

Red flag: A staff email calling the clerk careless, or a customer notice calling a named business the culprit, can become Exhibit A in a later dispute or a defamation claim.

Phase 6: Same-day abuse reports

• Registrar abuse report. Authority: RAA § 3.18.1 and § 3.18.2 as amended 5 April 2024. Note: Say what the name does, and show it. Include full headers or a URL screenshot, creation date, character difference, harm, and the action requested. Ask for a review of other names on the account and preservation of records.
• Log the confirmation of receipt. Authority: RAA § 3.18.1.
• Choose words that fit the definition. Phishing is within DNS Abuse. General fraud is treated differently in ICANN's complaint guide. Note: For a pure payment fraud, state plainly that the mail impersonates a named company and solicits financial information. Cite § 3.18.1's general duty and the registrar's terms.
• Mail provider abuse report. MX lookup identifies it. Send raw headers.
• Host abuse report. A record lookup identifies it, unless proxied. Authority: Louis Vuitton Malletier, S.A. v. Akanoc Solutions, Inc., 658 F.3d 936 (9th Cir. 2011) (hosts and notice).
• DMCA notice if content was copied. Authority: 17 U.S.C. § 512(c)(3); Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016). See Filing a DMCA Takedown Notice: A Practical Checklist.
• CDN abuse report. Ask for forwarding of the report and the identity of the origin host.
• Browser and vendor blocklists. Google Safe Browsing, Microsoft's reporting tool, and your email security vendor.
• FTC report. ReportFraud.ftc.gov; 16 C.F.R. Part 461.
• Separate ccTLD route if relevant. Find the manager through the IANA root database. ICANN's contracts don't apply.
• Check every statement of fact before sending. Authority: 15 U.S.C. § 1114(2)(D)(iv); 17 U.S.C. § 512(f).

Red flag: Before sending a report about a site that mocks or criticizes you, read Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005). A misspelled domain carrying real criticism is not phishing.

Phase 7: Escalation, hours 24 to 72 and beyond

• Follow up with the registrar at 24 hours and add new evidence. Note: ICANN's advisory fixes no number of hours for "promptly" and looks at timing case by case. The schedule here is a practice suggestion.
• Report to the registry operator. Authority: Base Registry Agreement, Specification 6, Section 4, as amended (referral to the registrar or direct action).
• File with ICANN Contractual Compliance after a reasonable time. Attach the domain list, explanation, evidence, proof of prior report, and why the response fell short. Source: ICANN complaint guide. Note: gTLDs only. A registrar's promises run to ICANN, and Register.com, Inc. v. Verio, Inc., 356 F.3d 393 (2d Cir. 2004), points aggrieved third parties to ICANN's process, not court.
• Ask the law enforcement contact to use the registrar's 24/7 channel. Authority: RAA § 3.18.3.
• Request registrant data. Ask the registrar directly or through the Registration Data Request Service. Note: RDRS participation is voluntary, and disclosure isn't guaranteed. Expect false data, itself a bad-faith factor under 15 U.S.C. § 1125(d)(1)(B)(i)(VII).
• Recheck the domain and search for the second wave. Mail and name server changes, new certificates, new TLDs.

Phase 8: Insurer and counterparty

• Notify the broker and every potentially responsive insurer within 72 hours. Authority: your policies' notice conditions. See Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice.
• Calendar proof of loss and suit-limitation dates.
• Map the facts to the policy words. Authority: American Tooling Center, Inc. v. Travelers Casualty & Surety Co., 895 F.3d 455 (6th Cir. 2018); Ernst & Haas Management Co. v. Hiscox, Inc., 23 F.4th 1195 (9th Cir. 2022); Medidata Solutions Inc. v. Federal Insurance Co., 729 F. App'x 117 (2d Cir. 2018); Apache. Note: Medidata involved spoofing that altered how the insured's own system showed the sender. A message from the fraudster's own lookalike domain may draw a different argument, so identify which you have.
• Get insurer consent before settling or splitting the loss with a counterparty. Check subrogation terms.
• Apply the best-position factors to your facts. Authority: Beau Townsend; Thomas; Yangtze; Erie Insurance Co. v. WAWGD, Inc. (D. Md. Apr. 29, 2024). Note: Courts look at changed bank, state, beneficiary, or method; conflict with the contract; domain and phone anomalies; who knew of a compromise; who warned whom.
• Propose a tolling and standstill agreement and an evidence exchange. Consider early mediation.
• Assess claims against banks realistically. Authority: Studco; 218 Broadway; GN Pro Group, LLC v. Well Done ASAP, LLC (N.D. Ill. Jan. 29, 2025).
• Calendar Article 4A notice limits for any unauthorized order. Authority: UCC §§ 4A-204, 4A-505.

Phase 9: Choose the forum

• Confirm whose mark it is and whether it was distinctive when the name was registered. Authority: § 1125(d)(1)(A)(ii); DaimlerChrysler v. The Net Inc., 388 F.3d 201 (6th Cir. 2004).
• Decide whether stopping the abuse is enough. A one-off, suspended name may need only monitoring and an expiry-date watch.
• Check the TLD against URS coverage. Available for new gTLDs and adopting legacy TLDs. Not available for .com or .net.
• Compare time, burden, remedy, and cost. See Domain Name Dispute Forum Selection Checklist: A Practical Checklist and Choosing the Right Domain Name Dispute Procedure: A Practical Guide.
• Use court where there's a continuing campaign, a stalling registrar, serious ongoing harm, a findable defendant, or a need for discovery.

Phase 10: URS and UDRP filing tasks

• URS: confirm a qualifying word mark in current use. Authority: URS Procedure § 1.2.6.1.
• URS: meet the clear and convincing standard with no genuine issue of material fact. Authority: URS Procedure §§ 8.2, 8.3.
• URS: confirm the lock, and keep abuse reports running. Authority: URS Procedure § 4.1 (lock within 24 hours; the name keeps resolving).
• URS: calendar the 14-day response and default, and extend the registration if wanted. Authority: URS Procedure §§ 5.1, 10.3.
• UDRP: prove the three elements. Authority: UDRP Policy ¶ 4(a); WIPO Overview 3.1 §§ 1.7 to 1.9, 1.11, 3.1.4, 3.4, 3.6. Note: Section 3.4 is the one to cite when the name has no website but sent the fraudulent mail.
• UDRP: expect the lock and data disclosure within two business days, and be ready to amend. Authority: UDRP Rules ¶ 4(b).
• UDRP: calendar 20 days for response and 14 for decision, plus the 10-business-day wait. Authority: UDRP Rules ¶¶ 5(a), 15(b); Policy ¶ 4(k).
• UDRP: request transfer, and plan for mail arriving at the name after transfer. See Filing a UDRP Domain Name Complaint: A Practical Checklist.
• Avoid an abuse-of-process finding. Authority: UDRP Rules ¶ 15(e).

Phase 11: Federal court tasks

• Plead the claims that fit. § 1125(d) and § 1125(a), with Shields v. Zuccarini, 254 F.3d 476 (3d Cir. 2001) on misspellings and Coca-Cola Co. v. Purdy, 382 F.3d 774 (8th Cir. 2004) on profit.
• Walk through the nine bad-faith factors expressly. Authority: § 1125(d)(1)(B)(i); Harrods Ltd. v. Sixty Internet Domain Names, 302 F.3d 214 (4th Cir. 2002) (preponderance standard).
• Add computer-crime or RICO counts only if earned; rely on them when you have no mark but a real intrusion. Authority: § 1030(g); Van Buren v. United States, 593 U.S. 374 (2021); 18 U.S.C. § 1964(c); Fed. R. Civ. P. 9(b). See Computer Fraud and Abuse Act Claim Checklist: A Practical Checklist.
• For in rem: confirm eligibility and venue. Authority: § 1125(d)(2)(A); Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002).
• For in rem: send notice to postal and email addresses, and publish as directed. Authority: § 1125(d)(2)(A)(ii)(II).
• For in rem: time the filing against any pending suspension. Authority: § 1125(d)(2)(D)(i)(II).
• For a TRO: gather specific facts by declaration and counsel's certification. Authority: Fed. R. Civ. P. 65(b)(1); Granny Goose Foods, Inc. v. Brotherhood of Teamsters, 415 U.S. 423 (1974).
• Invoke the presumption of irreparable harm. Authority: 15 U.S.C. § 1116(a). See Trademark Preliminary Injunction Checklist: A Practical Checklist.
• Draft the order for intermediaries by name, and serve them immediately. Authority: Rule 65(d)(2)(C); Arista Records, LLC v. Tkach, 122 F. Supp. 3d 32 (S.D.N.Y. 2015); Blockowicz v. Williams, 630 F.3d 563 (7th Cir. 2010).
• Include limited early discovery, alternative service, and a bond proposal. Authority: Rule 26(d)(1); Rule 4(f)(3); Rio Properties, Inc. v. Rio International Interlink, 284 F.3d 1007 (9th Cir. 2002); Rule 65(c).
• Limit subpoenas to non-content records. Authority: Rule 45; 18 U.S.C. § 2702; Columbia Insurance Co. v. seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999).
• For a freeze of funds, plead a traceable equitable claim. Authority: Grupo Mexicano de Desarrollo, S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308 (1999); Rule 64.
• Calendar the 14-day TRO expiry and preliminary injunction hearing. Authority: Rule 65(b)(2).
• Plan for default and statutory damages. Authority: 15 U.S.C. § 1117(d). See Default Judgment Checklist: A Practical Checklist.

Red flag: A demand letter to a suspected fraudster before seeking ex parte relief undercuts the certification that notice would let the fraudster move the infrastructure.

Phase 12: If your domain is the one reported

• Respond to your registrar or host within its deadline. Provide proof of identity, use, and legitimate history.
• Preserve your own records and any complaint received.
• Check whether the complaint rests on a knowing and material misrepresentation. Authority: § 1114(2)(D)(iv).
• Consider a declaratory action for reactivation. Authority: § 1114(2)(D)(v).
• Answer a UDRP within 20 days, and ask for a reverse domain name hijacking finding where warranted. Authority: UDRP Rules ¶¶ 5(a), 15(e).
• File suit within 10 business days to stay a UDRP transfer. Authority: Policy ¶ 4(k); Barcelona.com, Inc. v. Excelentisimo Ayuntamiento de Barcelona, 330 F.3d 617 (4th Cir. 2003).

Phase 13: Close out and improve

• Keep a timeline. Discovery, every call, every report, every response.
• Confirm the status of each domain, and calendar its expiry. Suspended names can come back.
• Follow up with the FBI or AUSA about restitution and victim rights. Authority: 18 U.S.C. § 3663A; 18 U.S.C. § 3771.
• Write the lessons down under privilege where appropriate. Fix procedures, then train without blame.
• Add new variants to monitoring and defensive registrations.
• Run a tabletop within six months. Check whether anyone can still find this page.

Because this list is general information and your contracts, policies, and forum will change what's required, have counsel adapt it to your situation before relying on it.

Related Documents

Related Articles

• Lookalike Domains and Typosquatting: Phishing, Invoice Fraud, and the Legal Tools That Take Them Down: why each task is here.
• Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking: background on Phases 9 to 11.

Related Guides

• Taking Down a Lookalike Domain in Days: A Practical Guide: the same sequence in narrative form, with worked examples.
• Recovering a Hijacked Domain Name: A Practical Guide: for when your real domain has been taken.

Related Checklists

• Domain Name Dispute Checklist: A Practical Checklist: the general checklist for non-fraud disputes.
• Preliminary Injunction and TRO Application Checklist: A Practical Checklist: full motion mechanics.
• Federal Deadline Calendaring and Recovery Checklist: A Practical Checklist: for tracking the court dates this checklist creates.

Related Toolkits

• Lookalike Domain Toolkit: Abuse Reports, Registrar Demands, and UDRP and URS Outlines: the letters and outlines that these tasks call for.
• Fraud Response Toolkit: Freeze Requests, Dispute Letters, Reports, and Recovery Steps: related forms for individual fraud victims.