A phishing domain is a website set up to impersonate a real brand, usually to trick visitors into entering login credentials, payment details or other personal information that the attacker then steals.

Why it matters

Because a phishing domain is built to look like the real thing, often down to cloning the actual login or checkout page, customers frequently can’t tell the difference until after they’ve handed over sensitive information. Every phishing domain running under a brand’s name is a direct attack on that brand’s customers, using the brand’s own trust against them.

How it works

Phishing domains are commonly registered as lookalikes or typosquats of a real domain (see typosquatting), then built to visually mirror the genuine site’s login, checkout or account-recovery pages. Some are distributed through phishing emails or fake ads that link directly to the fraudulent page rather than relying on a mistyped URL alone.

In practice

A phishing domain targeting a brand’s customers might clone the exact look of the real login page and be linked from an email claiming to be a security alert or account notice. A customer who clicks through and logs in has just handed their credentials to the attacker, believing they were on the brand’s real site the whole time. Continuous domain monitoring is what catches a domain like this while it’s newly registered, before it’s actively being used against customers.

How Truviss helps

Truviss’s Domain Scanner runs 24/7 surveillance for newly registered lookalike and phishing domains targeting a brand, verifies them against the brand’s real assets, and files takedown requests with registrars once confirmed as infringements.

Frequently asked questions