Website Impersonation

Help
1

How are websites handled that impersonate legit businesses? What is process of revoking their cert? For instance nootropicsdepots.com is impersonating the real business nootropicsdepot.com?

2

Read this blog post: The CA's Role in Fighting Phishing and Malware - Let's Encrypt

3

Let's Encrypt's job (like other public CAs) is just to ensure that the browser is connecting to the site that controls the domain name, not whether those controllers are "good" or "legit".

Revoking wouldn't actually do much to protect people, anyway. The best way to protect people is to report them to Google and Microsoft since many browsers check those more reliably than they'd check revocation information. (And of course, you can report them to their ISP or Registrar to try to get the site actually taken down.)

4

Let's Encrypt only checks that whoever requests the cert controls the domain. A lookalike name passing that check isn't misissuance, so they generally won't revoke over it. Even if they did, the site wouldn't go down. The owner would just get a new cert from any other free CA within minutes.

The places that can actually take it offline:

  • Registrar. nootropicsdepots.com was registered in March 2026 through PDR Ltd (PublicDomainRegistry). Their abuse contact is abuse-contact@publicdomainregistry.com. Send screenshots of the copied branding and checkout. Registrars do suspend domains used for fraud.
  • Cloudflare. The site sits behind Cloudflare, so file a phishing or trademark report at abuse.cloudflare.com. They forward it to the real host and can put a phishing interstitial in front of the site.
  • Browsers. Report it to Google Safe Browsing and Microsoft SmartScreen. A red warning in Chrome and Edge usually stops visitors faster than anything else.

If you are the brand owner, a UDRP complaint can get the domain transferred to you, but that takes weeks, so start with the reports above.