A couple of years ago, someone searching for our company found a website that looked like ours, used a version of our name, and sold proxies we had nothing to do with.
The impersonators were already operating before we rebranded from Smartproxy to Decodo in April 2025.
They registered smartproxy.org and smartproxy.cn to catch the traffic searching for the original domain name, and the rebrand gave them an even larger pool of people who had not heard about the change.
In 2025, the World Intellectual Property Organization handled 6,282 domain name disputes, a record for the organization. Cybersquatting cases have risen 68% since 2020.
Digital squatting now moves money, steals login credentials, and pulls customers toward infrastructure tied to cybercrime. Here are five things we did, and five things any business can do, when someone copies your brand.
What digital squatting is, and why cases keep climbing
Digital squatting means registering or using a domain name in bad faith to profit from someone else’s trademark. A bad actor registers a domain close to an established brand, then uses it to intercept traffic, collect payments for services they never deliver, harvest login credentials, or push malware. Most victims find out only after their money disappears.
Squatting comes in a few common forms:
1. Typosquatting registers misspellings of popular domains, such as gooogle.com instead of google.com;
2. Combosquatting adds a keyword to a real brand name, producing domains like brand-login.com or brand-deals.com;
3. TLD squatting takes the same brand name across .org, .net, .io, and .ai;
4. Homograph attacks swap in visually identical characters from other alphabets, like a Cyrillic “а” for a Latin “a”.
When it happened to us
We met digital squatting as the target, not the observer. We operated as Smartproxy for seven years, and over that time, the name picked up enough recognition for impersonators to want it. They registered .org and .cn, domains with no connection to our company, our infrastructure, or our team. The site copies a version of our former name and sells proxies we have nothing to do with, catching traffic from people who searched for Smartproxy.
The squatting also shaped how we could operate in China. The obvious domains were already taken, so before the rebrand, we had to run our China presence under a separate name, smartdaili.cn. A customer in that market searching for the brand could land on an impostor site first.
The rebrand to Decodo did not end the problem. It added a fresh group of people who knew the old name and never heard about the change, which is exactly who the lookalike domains target. The harm reached real customers, and we saw it in their complaints to us.
Trustpilot reviews describe people who paid the lookalike sites, sent irreversible cryptocurrency payments, received poor support, and got low-quality service under a name they trusted.
What the Proxyway research found
The case changed shape when researchers tested the impersonator’s product directly. The independent researchers have purchased a standard weekly unlimited residential plan on smartproxy.org, the same product any retail buyer can get, and measured where its traffic actually exited. The method is one any paying customer could repeat, which is part of why the result carries weight.
Proxyway sent roughly 6.96 million HTTP requests through the plan across one week, with each request landing on an endpoint that logged the exit IP address. After removing duplicates, the pool showed 2,023,029 unique IPs, of which 2,019,488 were IPv4, and 3,541 were IPv6. The success rate sat at 90.25%, in line with what the service advertised.
To find where those IPs came from, Proxyway compared the pool against a reference dataset of 16,192,293 verified IPIDEA exit nodes, observed over the 30 days ending January 29, 2026. Antoine Vastel, VP of Research at DataDome, built that dataset by routing traffic through IPIDEA endpoints himself and confirming each address as a working exit node, rather than relying on marketing claims. IPIDEA is the residential proxy network that Google’s Threat Intelligence Group disrupted back in January.
The comparison surfaced 773,087 IPs present in both pools. That figure equals 38.21% of the smartproxy.org pool and 4.77% of the IPIDEA dataset. The numbers sit in the table below:
|
Metric |
Value |
Row 0 – Cell 2 |
|
Smartproxy.org unique IPs (test pool) |
2,023,029 |
Row 1 – Cell 2 |
|
IPIDEA dataset unique IPs (Vastel) |
16,192,293 |
Row 2 – Cell 2 |
|
IPs present in both pools |
773,087 |
Row 3 – Cell 2 |
|
Overlap as a share of smartproxy.org |
38.21% |
Row 4 – Cell 2 |
|
Overlap as a share of IPIDEA |
4.77% |
Row 5 – Cell 2 |
Why a 38% overlap points to shared sourcing
Residential pools rotate, so some overlap between any two services is normal. IPinfo estimates monthly IPv4 retention in residential pools at around 40%, meaning roughly four in ten addresses visible this month remain next month, while the rest cycle out. Two pools drawing from genuinely separate apps, SDKs, and device populations should not share anything close to 38% of their IPs across a few-week window.
The IPv4 address space spans more than 4 billion addresses, so an overlap at this scale would be a statistical anomaly if the sources were independent. The pool sizes point the same way. The smartproxy.org pool of about 2 million IPs is roughly an eighth of the 16.2 million IPIDEA dataset, the proportion you would expect when one provider draws from part of a larger upstream pool. Shared sourcing explains the data cleanly.
5 things you can do to combat digital squatting
Each step below works on its own. Together, they cover monitoring, prevention, legal action, search, and customer communication.
1. Monitor for lookalike domains before they reach your customers
Catching a fake domain after a customer reports it means the damage has already happened. Monitoring closes that gap.
Set up these alerts:
i) Domain registration alerts for your brand name across common TLDs and misspellings;
ii) Brand-mention monitoring across search results and social platforms;
iii) Certificate transparency logs, which flag new SSL certificates issued for domains containing your brand name.
We learned the full extent of our case through third-party research and customer complaints, later than we wanted. Monitoring would have surfaced the registrations sooner. A weekly check across the main extensions and the three or four most likely misspellings of your name catches most attempts while they’re still new.
2. Register your own domain variations first
A squatter can’t register a domain you own. Defensive registration removes the easiest targets before anyone reaches for them.
Claim the obvious variations:
i) Major TLDs such as .org, .net, .io, and .ai
ii) Common misspellings of your brand name country-code domains for markets you operate in, such as .co.uk, .de, and .cn.
Turn on registrar lock, use a reputable domain registrar, and keep your registration details current. We hit this wall directly when the obvious domains in China were already taken. Claim your namespace early, because the cost of registering domains is far lower than reclaiming them later.
3. Use your legal routes, and know their limits
Trademark law gives you specific tools against squatters. The tools work, though they move slowly, so start them early. The following is general information, not legal advice.
Your main options:
i) Register your trademark, which is the foundation for every other action;
ii) Send a cease-and-desist letter to the registrant
iii) Report abuse directly to the registrar hosting the domain.
4. Own your brand in search results
When someone searches your brand, the page they click decides whether they reach you or a copy. Ranking above the impersonator removes most of their traffic.
Make the real you easy to find:
i) Publish content that states your official domains in plain language;
ii) Keep rebranding and company information current across your site and profiles;
iii) Use structured data and verified social media profiles so search engines confirm your identity.
We published direct, on-record clarifications so anyone searching the old brand finds the truth quickly. We say it plainly: we operate at decodo.com globally and decodo.cn in China. Everything else using the old name isn’t us
5. Tell your customers, and keep telling them
Customers can’t avoid a fake site that they don’t know exists. Telling them turns your audience into a filter against the impersonator.
Reach them through every channel you have:
i) Email warnings to your existing customer list;
ii) A banner or notice on your website;
iii) A help-center article that customers find when they search for the problem;
iv) Posts on the social accounts your customers already follow.
Treat impersonation as a security problem
Brand impersonation now sits next to the infrastructure-trust problem the IPIDEA takedown exposed. A fake domain can route customers into compromised device pools, which makes this a question for security and legal teams, not just marketing. Give it a cross-functional owner who watches domains, files complaints, and updates customers on a schedule.
Google’s action against IPIDEA reduced the available device pool for proxy operators by millions and, in Google’s words, may carry downstream impact across affiliated resellers. Squatting that depends on that kind of infrastructure carries the same exposure. Demand transparency from any provider you buy from, and apply the same standard to your own supply chain.
We feature the best proxy sites.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
