THE EMPORIUM
Threat Intel

How Brand-Spoofing and Impersonation Attacks Work

Editorial··2 min read

Impersonation is one of the highest-return attacks in the criminal toolkit: cheap to run, hard for victims to spot, and effective precisely because it borrows your credibility to fool your customers. Understanding the mechanics — defensively — is the first step to shutting it down.

Look-alike domains

The foundation of most impersonation is a domain that reads like yours at a glance.

  • Typosquatting — a plausible misspelling: emporum.net, theemporiumm.net.
  • Combosquatting — your brand plus a word: emporium-support.net, secure-emporium.net.
  • Homoglyphs — characters that look identical: a Cyrillic “а” standing in for the Latin “a”, invisible in most fonts.
  • Alternate TLDs — your name on a different ending: .co, .io, .support.

These host fake login pages, send invoices, or lend a phishing email just enough legitimacy to get a click.

Email spoofing

If your domain doesn’t publish the right records, attackers can forge mail that appears to come from you. Three DNS-based controls close that gap:

  • SPF declares which servers may send mail for your domain.
  • DKIM cryptographically signs your outbound mail so tampering is detectable.
  • DMARC ties the two together and tells receiving servers what to do with mail that fails — and, crucially, sends you reports of who’s sending as you.

The single highest-value move here: publish a DMARC record and read the reports. It’s the difference between discovering an impersonation campaign yourself and hearing about it from an angry customer.

A DMARC policy starting at p=none (monitor only) lets you see spoofing without risking legitimate mail, then tighten to quarantine and reject once you’ve confirmed your legitimate senders pass.

Fake profiles and social impersonation

Beyond domains and email, attackers clone social profiles, executive accounts, and support channels. The playbook: copy your branding, contact your customers “from support,” and harvest credentials or payments. These cost nothing to create and rely on speed — they profit before the platform takes them down.

Detecting it early

You can’t stop someone from registering a look-alike, but you can find out fast:

  • Watch Certificate Transparency logs for certificates issued to domains containing your brand — attackers usually get TLS for a convincing fake. Free CT-monitoring services will alert you.
  • Monitor new domain registrations that match your brand patterns.
  • Set alerts for your brand name across search and social so clones surface quickly.
  • Read your DMARC reports — they reveal spoofing attempts you’d otherwise never see.

Responding

When you find impersonation:

  1. Preserve evidence — screenshots, URLs, headers, timestamps — before anything gets taken down.
  2. Report to the host, registrar, and platform. Most have abuse channels; brand-based takedowns are usually straightforward with evidence.
  3. Warn the people affected. A short, factual “we will never ask for X by email” note to customers blunts the campaign immediately.

The defensive baseline

Publish SPF, DKIM, and DMARC. Monitor CT logs and new registrations for your brand. Have a takedown contact list ready before you need it. None of this stops registration — it makes impersonation harder to pull off and far faster to catch, which is usually enough to make an opportunistic attacker move on. For the wider set of habits this fits into, see OPSEC Basics.