Brand protection and anti-phishing for B2B

Why does brand protection matter in B2B?

In B2B, your domain stands for an existing relationship. When a finance team receives an invoice from your company, they assume the sending domain is yours. Phishing operators exploit exactly that assumption, using your name to deceive your customers, partners and even your own staff. Brand protection looks beyond your own systems to find the lookalike domains and spoofed sites that borrow that trust.

The FBI has warned that criminals create spoofed domains with "slightly altered characteristics of legitimate domains", such as an alternate spelling or a different top-level domain, and use them to "gather valid usernames, passwords, and email addresses" and to spread malware.^[1]

How do lookalike domain attacks work?

B2B lookalike attacks are rarely random. They aim at relationships that already exist.

• The lookalike domain. Attackers register a domain that mirrors yours, sometimes using characters from another alphabet. Unicode's security standard gives the example of "paypal" written with a Cyrillic "a", which looks the same as the Latin letter on screen.^[2] To a busy reader the two addresses are identical; to a browser they are different domains.
• Payment diversion. A criminal registers a domain one letter off from yours, joins or copies an invoicing thread and asks for payment to a new bank account. The FBI describes business email compromise as using compromised or spoofed email to "conduct unauthorized transfers of funds".^[3] Our guide to executive impersonation covers how these requests are framed.
• The spoofed portal. A fake login page for your customer portal, hosted on a lookalike domain, collects credentials that can then be used against your customer.

Does email authentication stop lookalikes?

Only for the domains you own. DMARC lets a domain owner publish how receiving systems should handle mail that fails authentication, and so stops direct spoofing of your exact domain once it is enforced.^[4] The standard also states that it "does not address the use of visually similar domain names".^[4]

So enforce SPF, DKIM and DMARC on every domain you send from, as covered in our corporate DNS security guide, and treat lookalikes as a separate problem that needs monitoring.

How do you find lookalikes early?

Waiting for a customer to report a phishing email means the attack has already landed. Look for infringements while they are still being set up.

• Permutation monitoring. Generate the likely variants of your names, such as swapped letters, a zero for an "o", or your name with words like "services" or "support", and check which of them are registered and live.
• Certificate monitoring. Certificate Transparency logs record TLS server certificates "as they are issued or observed".^[5] A watch on those logs for your brand name can surface a lookalike site before it is used.
• Content and profile monitoring. Watch for copies of your pages and logos, and for fake company or employee profiles, as part of your trademark monitoring.

Which variants should you register?

A short list, not every possible typo. The number of combinations is open-ended, so registering everything is costly and still leaves gaps. Prioritize your main domain under the endings where you sell, one-letter misspellings of the domain customers type most, and combinations of your name with payment or login words. Monitor the rest. Our typosquatting and domain audit guide explains how to build that list from an inventory of what you already own.

What if a phishing site goes live?

Act on it quickly, with evidence. Capture the full URL and screenshots, then report the site to the registrar, the hosting provider and browser blocklists. For gTLD domains, ICANN's contracts require a registrar with actionable evidence of phishing to "promptly take the appropriate mitigation action(s)".^[6] Our domain takedown guide lists the routes and what to include.

When the domain itself infringes your trademark, legal routes exist. Under the UDRP, the remedies are limited to cancellation or transfer of the domain.^[7] Those complaints, and any court action, are handled by counsel or a specialist brand protection firm that you contract with directly. We do not file takedowns or legal actions.

How do you keep customer trust?

When spoofing succeeds, the damage is to the relationship as much as to any system. Plan the communication before you need it.

• Tell affected customers plainly. Send an advisory that lists the fraudulent domains, the subject lines used and what the messages asked for, so recipients can check their own inboxes.
• Point to trusted channels. Remind customers where genuine requests come from, such as your customer portal or a named account contact, and ask them to use those for anything sensitive.
• Publish a verification rule. State it simply: you will never change payment details by email alone, and any change must be confirmed by a call to a contact number already on file. The FBI advises using secondary channels or two-factor authentication to verify requests for changes in account information.^[3]

Where should you start?

Start with what you control: an inventory of your domains, DMARC at enforcement and a published payment verification rule. Then add lookalike and certificate monitoring, a short defensive registration list and a named route to counsel. Our brand protection service covers the monitoring and preparation as part of our digital asset security work.