Online Business Impersonation: How to Shut It Down

A website using your company’s name, your team’s photographs and a domain one letter away from your own is not a nuisance. It is a fraud operation running under your brand.

Dilendorf Law Firm helps businesses and individuals shut these sites down.

Who gets targeted

Any brand that people trust with money or sensitive information is a target. Finance remains the most impersonated sector in the social-media threats tracked by the Anti-Phishing Working Group, at roughly 27 percent in the second quarter of 2026, with federal government and hospitality close behind [1].

In our practice, the businesses most often cloned are:

• Law firms
• CPA and accounting firms
• Banks and payment platforms
• Cryptocurrency exchanges and recovery services
• Real-estate and title companies
• Insurance agencies

What an impersonation site looks like

The pattern is consistent. A domain is registered that adds, drops or doubles a letter in a real name, or tacks on a word such as “group.”

The site copies the genuine business’s layout, service descriptions and sometimes staff biographies. It lists an address and phone number that belong to no one. It almost always has an intake form.

That form is the point. People who think they are reaching a real firm submit their names, financial details and the facts of their problem. Some are then asked to pay a retainer or “release fee.” Others have their information reused in a second scam.

Why they are hard to remove

Businesses that try to handle this themselves run into the same obstacles. Registrant data is privacy-protected. The registrar says it cannot judge website content. The host is a reseller of a reseller in another country. The site hides behind a bot-verification screen so security scanners never see it. Reports to a generic abuse address get a template reply.

None of this is accidental. The operators pick infrastructure that slows down complaints. Getting through it means knowing who controls each layer, what each party must act on, and how to present the case so it produces a suspension rather than a form letter.

If they ask you to pay, do not

Some impersonators contact the business they are copying and offer to take the site down for a fee, usually in cryptocurrency. Do not pay, and do not negotiate. Paying a criminal rarely ends the problem, and there is a legal risk on top of it.

Many of these operations are run from, or route funds through, people and jurisdictions subject to U.S. sanctions.

The Treasury Department’s Office of Foreign Assets Control has warned that payments to sanctioned persons can be penalized on a strict-liability basis, meaning you can be held liable even if you did not know who was on the other end of the wallet [2]. You do not want to learn after the fact that you paid someone on the sanctions list. Preserve the demand and hand it to counsel.

“OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if such person did not know or have reason to know that it was engaging in a transaction that was prohibited under sanctions laws and regulations administered by OFAC.”

U.S. Treasury, Office of Foreign Assets Control, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sept. 21, 2021) [2]

How we approach a takedown

We identify every provider behind the fraudulent domain and report to all of them at once, so a suspension holds even if the operator moves hosting. We involve law enforcement and provide an evidence package prepared the way investigators expect to receive it.

Where providers do not act, we escalate: registrant-identity disclosure, domain-dispute proceedings to transfer the domain to its rightful owner [3], anti-cybersquatting claims [4], and emergency injunctive relief in court when a site is collecting information from the public under a stolen name.

1. Multi-provider reporting. Registrar, host, CDN, DNS and form or payment providers are reported at the same time, so a suspension holds if the operator moves hosting.
2. Law-enforcement referral. An evidence package prepared the way investigators expect to receive it.
3. Registrant-identity disclosure. Requests to the registrar and the privacy service for the data behind the proxy.
4. Domain-dispute proceeding. A filing under the Uniform Domain-Name Dispute-Resolution Policy to transfer the domain to its rightful owner [3].
5. Anti-cybersquatting claim. A federal claim under 15 U.S.C. § 1125(d) against a bad-faith registrant [4].
6. Emergency injunctive relief. A court order when a site is collecting information from the public under a stolen name.

Our cybercrime experience

We actively litigate, arbitrate and investigate cases involving account takeovers, SIM-swap attacks, stolen cryptocurrency, business-email compromise and wire fraud, and we pursue recovery against the platforms, carriers and intermediaries whose failures made those losses possible.

We coordinate regularly with federal and state law enforcement, and our team includes retired cybercrime enforcement agents who help us investigate the people behind these schemes.

We bring the same approach to impersonation matters: identify the infrastructure, identify the people, and use every available channel to shut the operation down.

What to do in the first 24 hours

Preserve evidence before anything changes: full-page screenshots with visible URLs and timestamps, and the address and phone number the site displays. Do not contact the impostor through the fake site. Tell your staff so calls from confused members of the public are logged. Then call counsel.

First 24 hours

• Full-page screenshots of every page, with the URL and timestamp visible
• The address, phone number and email the site displays, and the domain’s registration date
• No contact with the impostor through the fake site or any channel it offers
• Staff briefed, so calls and emails from confused members of the public are logged
• Any payment demand preserved in full and handed to counsel

This article is for informational purposes only and does not constitute legal advice or create an attorney-client relationship. Results depend on the facts of each matter and are not guaranteed. Attorney advertising.