Four outcomes — Domain Abuse & Impersonation

Every suspicious domain resolves into one of four categories. Naming which one you are looking at is the decision the whole analysis exists to support, because the response to each is entirely different.

The four

Category	Typical evidence	Response
Live phishing	Cloned content, a login form, an MX record, a recent certificate, registered recently	Evidence capture, then takedown. Urgent.
Parked or monetised	Advertising page, parking nameservers, no MX, often registered long ago	Log it. Consider acquisition if it is genuinely confusing. No takedown route.
Defensive registration by somebody else	Resolves to nothing or to an unrelated business, no mail, no content, held for years	Nothing. Somebody else registered it for their own reasons.
Genuinely unrelated	A real business with a similar name, a real site, real history	Nothing. This is a coincidence, and acting on it is the expensive mistake.

The evidence that decides

Does it serve content resembling yours?
   yes -> live phishing. Stop, capture evidence.
   no  -> continue

Does it have an MX?
   yes -> treat as live phishing in preparation
   no  -> continue

Does it serve advertising, or parking nameservers?
   yes -> parked. Log it.
   no  -> continue

Does it serve a real, unrelated business?
   yes -> unrelated. Close it.
   no  -> defensive or dormant. Watchlist, revisit
          if anything changes.

The order matters: content and mail capability are the two questions that can escalate, and they come first. Everything after them is a route to closing the finding.

The hard cases

Situation	How to resolve it
A real business with a genuinely similar name	Check whether it predates you and whether its content is its own. Coincidence is common, especially with short or generic brand names.
Parked now, was phishing last month	Passive DNS or your own snapshots. A burned domain often parks itself afterwards.
Registered defensively by a competitor	It resolves to nothing and has done for years. Annoying, not actionable.
Dormant with an MX	Treat as preparation. The MX is the deliberate part.

Do not classify on the name alone

A domain being one character from yours establishes only that it is worth looking at. The classification comes from what it does — content, mail, infrastructure, history. A report that reasons entirely from the string will eventually name a real business, which is the subject of a later lesson and the most expensive mistake in this work.

Knowledge check

A domain one character from yours serves an advertising page, has no MX, and was registered eight years ago. Which category?

Parked or monetised — log it, and there is no takedown route because nothing abusive is happening.
Live phishing, since the name is confusable and it is serving content.
Genuinely unrelated, since it belongs to an advertising business.
Defensive registration, since it has been held for years without being used.

Correct — Parked or monetised — log it, and there is no takedown route because nothing abusive is happening. Advertising content, no mail capability and long-standing registration is the parking profile. It may still be worth acquiring if it genuinely confuses customers, and an abuse report would go nowhere.

Not this — Live phishing, since the name is confusable and it is serving content. The content has to resemble yours. Generic advertising is not impersonation.

Not this — Genuinely unrelated, since it belongs to an advertising business. Parking pages are automated monetisation of a domain, not a business operating under that name.

Not this — Defensive registration, since it has been held for years without being used. Defensive registrations typically resolve to nothing. Serving advertising is active monetisation.