What Is Brand Impersonation?

Brand impersonation is a technique attackers use to borrow the trust of a real, well-known company. A fraudulent page or message reuses that company’s name, logo, color scheme, or a look-alike domain to convince the victim the destination is legitimate.

It rarely appears alone — it’s the trust mechanism layered on top of phishing, smishing, quishing, and BEC attacks to make the deception convincing enough to act on.

Attackers frequently place a trusted brand or product name inside a misleading subdomain, URL path, or query parameter (for example, a domain designed to look like it belongs to a bank or delivery company at a glance), or register a look-alike domain that differs from the real one by a single character or a swapped top-level domain.

Because these domains are usually created specifically for a single campaign, they are often brand-new and have no prior reputation — which is exactly where blacklist-based defenses struggle most.

Brand impersonation is an important signal within DefenceNet’s detection model. DefenceNet is designed to identify trusted-brand references placed in misleading subdomains, paths, query parameters, or look-alike domains, and to incorporate those brand-related signals into its overall threat assessment for a URL.

This runs alongside DefenceNet’s broader structural and zero-day detection capabilities, so a brand-impersonating destination can be flagged even if it has never been seen or reported before.