01 The challenge
A SaaS brand found dozens of registered typosquats and homoglyph domains: some parked, some redirecting to competitors, and a handful staging phishing pages aimed at its customers. Left alone, the parked and redirecting domains were a standing risk that could be weaponised at any time.
02 The approach
Triage by active risk
Domains were sorted into active phishing, redirecting, and parked. Active phishing was filed first as a priority; the rest were queued so nothing was missed.
Pursue removal at the registrar layer
Where domains were clearly abusive, we pursued suspension through registrar abuse channels rather than only chasing the hosted content.
Hand back a monitored watchlist
The remaining lookalikes were placed on a watchlist so newly weaponised domains are caught and filed early.
03 The outcome
37 domains were actioned with a median time-to-removal of 28 hours for the active phishing set. Since the engagement, the customer has reported zero new domain-based scams reaching its users.
Service used
Scam domain removal