---
title: "Sweeping typosquat domains away from a SaaS brand"
description: "Dozens of lookalike domains were redirecting traffic and staging phishing. Fraudox cleared the active set and set up ongoing monitoring."
date: "2025-12-09"
industry: "Software & SaaS"
category: "Scam domain"
region: "Global"
client: "B2B SaaS company (anonymised)"
canonical: "https://fraudox.com/case-studies/typosquat-domain-sweep"
publisher: "Fraudox"
publisher_url: "https://fraudox.com"
license: "Free to quote with attribution to the canonical URL."
---

# Sweeping typosquat domains away from a SaaS brand

> Dozens of lookalike domains were redirecting traffic and staging phishing. Fraudox cleared the active set and set up ongoing monitoring.

**Sector:** Software & SaaS | **Threat:** Scam domain | **Region:** Global | **Client:** B2B SaaS company (anonymised)

## Outcome at a glance

| Measure | Result |
| --- | --- |
| Domains actioned | 37 |
| Median time to removal | 28h |
| Customer-reported scams since | 0 |

## The challenge

A SaaS brand found dozens of registered typosquats and homoglyph domains: some parked, some redirecting to competitors, and a handful staging phishing pages aimed at its customers. Left alone, the parked and redirecting domains were a standing risk that could be weaponised at any time.

## How it was handled

### 1. Triage by active risk

Domains were sorted into active phishing, redirecting, and parked. Active phishing was filed first as a priority; the rest were queued so nothing was missed.

### 2. Pursue removal at the registrar layer

Where domains were clearly abusive, we pursued suspension through registrar abuse channels rather than only chasing the hosted content.

### 3. Hand back a monitored watchlist

The remaining lookalikes were placed on a watchlist so newly weaponised domains are caught and filed early.

## Outcome

37 domains were actioned with a median time-to-removal of 28 hours for the active phishing set. Since the engagement, the customer has reported zero new domain-based scams reaching its users.

## The service behind this

[Scam domain removal](https://fraudox.com/scam-domain-takedown): Lookalike and typosquatted domains registered against you, including ones parked before they are used. Handled at the registrar, and escalated to UDRP where suspension is refused.

*Figures are illustrative of the Fraudox takedown workflow, and client-identifying details are anonymised unless the client has approved their use. Canonical version: https://fraudox.com/case-studies/typosquat-domain-sweep.*

---

Published by Fraudox (https://fraudox.com), a brand protection takedown service that
removes phishing sites, impersonating pages, fake social accounts, counterfeit apps,
scam domains and stolen content, and bills only for confirmed removals.