{
  "id": "WEB-084",
  "slug": "web-084",
  "title": "A lookalike domain is treated as a phishing signal",
  "statement": "A domain that imitates a better-known brand through misspelling, homoglyphs or an added word is screened as a phishing indicator.",
  "rationale": "Impersonation domains are the standard vehicle for credential phishing over SMS, so screening the name itself is cheap and catches attacks before any content exists to judge. Legitimate businesses collide with it innocently — a reseller whose domain contains the manufacturer's name, a regional franchise — and the rejection reads as an accusation rather than a score.",
  "layer": "WEBSITE",
  "layerSlug": "website",
  "object": "brand.website domain string",
  "severity": "HIGH",
  "detectability": [
    "EXTERNAL_DATA"
  ],
  "failureClass": "TERMINAL_EXTERNAL",
  "authorities": [
    "Twilio"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30960",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Where the domain contains another company's brand, be able to show the relationship — an authorised-reseller page, a franchise agreement named on the site. Where it does not, expect a slower vet and make the brand record and the site agree on the business name exactly.",
  "notes": "The catalog flags this as unverified: no primary source names homoglyph domains as a rule, and the nearest hooks are Twilio's obfuscated-URL language and codes 30960/30961. Recorded as a heuristic, not as a quoted requirement. We run no similarity screen, so the user should judge their own domain against the brands it resembles.",
  "phase": "approval",
  "automated": false,
  "attestation": {
    "question": "Does this domain contain, or closely resemble, another company's brand name?",
    "howToCheck": [
      "Read the domain as a stranger would and name the brand it resembles — misspellings, homoglyphs and an added word all count.",
      "Where the resemblance is a real relationship, publish it: an authorised-reseller page or a franchise agreement named on the site.",
      "Where it is coincidence, expect a slower vet and make the brand record and the site agree on the business name exactly."
    ],
    "failureLooksLike": "A reseller whose domain carries the manufacturer's name is screened as a phishing indicator, and the rejection reads as an accusation rather than as a score."
  },
  "url": "https://ekas.io/rules/10dlc/website/web-084/",
  "markdown": "https://ekas.io/rules/10dlc/website/web-084.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}