# WEB-084 — A lookalike domain is treated as a phishing signal

> A domain that imitates a better-known brand through misspelling, homoglyphs or an added word is screened as a phishing indicator.

- **Rule ID:** WEB-084
- **Layer:** Website (`WEBSITE`)
- **Checks:** `brand.website domain string`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** External record we cannot query — reported as a warning to verify
- **Fix type:** Wait on an external system or a required interval
- **Required by:** Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/website/web-084/

## Why this rule exists

Impersonation domains are the standard vehicle for credential phishing over SMS, so screening the name itself is cheap and catches attacks before any content exists to judge. Legitimate businesses collide with it innocently — a reseller whose domain contains the manufacturer's name, a regional franchise — and the rejection reads as an accusation rather than a score.

## How to fix it

Where the domain contains another company's brand, be able to show the relationship — an authorised-reseller page, a franchise agreement named on the site. Where it does not, expect a slower vet and make the brand record and the site agree on the business name exactly.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Twilio (gen2) | `30960` | yes |

## Check this yourself

**Does this domain contain, or closely resemble, another company's brand name?**

1. Read the domain as a stranger would and name the brand it resembles — misspellings, homoglyphs and an added word all count.
2. Where the resemblance is a real relationship, publish it: an authorised-reseller page or a franchise agreement named on the site.
3. Where it is coincidence, expect a slower vet and make the brand record and the site agree on the business name exactly.

*What wrong looks like:* A reseller whose domain carries the manufacturer's name is screened as a phishing indicator, and the rejection reads as an accusation rather than as a score.

## Notes

The catalog flags this as unverified: no primary source names homoglyph domains as a rule, and the nearest hooks are Twilio's obfuscated-URL language and codes 30960/30961. Recorded as a heuristic, not as a quoted requirement. We run no similarity screen, so the user should judge their own domain against the brands it resembles.