Stop fake login pages and payment emails
We re-check lookalikes of your domain, like yourfirm-clients.com, every hour. We flag each one that can send email, alert you to fake login pages, and get them taken down.
Checks 150+ lookalikes in a couple of minutes. Work email needed, no card.
Already happening? Report a live attack
Example: a fake email from a lookalike of yourfirm.com. Below it is what our alert tells you about the domain.
What a fake login page or payment email costs you
- Money sent to the wrong account
- A client or member who types their details into a fake login page, or pays into a new account, may not get that money back, and will still expect you to explain what happened. In our pharmaceuticals case, a client paid €150,000 to fake payment instructions.
- Questions from your regulator, auditor or insurer
- After a loss, they may ask what you do about impersonation. The alert log, the evidence pack for each fake (screenshots, who registered it, where it is hosted) and the takedown records are your answer.
The attacks financial firms see
Criminals pose as banks, credit unions, insurers, brokers, payment firms, lenders and wealth managers because people trust them with money. Each attack uses a web address made to look like yours (a lookalike domain).
Fake online banking and client logins
A copy of your login page on a lookalike domain. A text or email tells members, policyholders or clients to ‘verify your account’, and the page asks for their password, card number, IBAN or routing and account number. These pages are often hidden from search engines, so the only way in is the link in the message.
New payment instructions
An email from a lookalike address tells clients, policyholders or the firms you deal with that the bank details for a loan repayment, a premium or a transfer have changed. There is no website to spot, just a working mailbox.
Copies of your website
Criminals put your branding, regulatory disclosures and images on a new web address. When one copy is removed, the same content can come back on another.
What we do about it
Monitoring
We watch around 500 lookalikes of each domain, across 240+ domain endings, and re-check every one every hour. New certificates for names like yours are matched as 100+ public logs record them. An alert for a login page carries a screenshot of it beside your real one.
Takedown
One click sends the evidence to every place that can act on it, including:
- The registrar and host
- The email provider it sends through
- Browser warnings and the blocklists spam filters use
Most takedowns take between 2 and 96 hours, depending on the registrar and host involved.
Your own domains
Separately, we check your own domains every day and grade them A to F. The check covers the email records that tell other mail servers who may send email as you (SPF, DKIM and DMARC), plus DNS, certificates and website settings.
When you confirm an attack, we gather the evidence, send the report to up to 12 places, chase the ones that do not act and keep watching, with a check every hour until the fake is offline and an alert if it comes back. You do not need a security team: on Pro, someone on your side reads each alert and approves the takedown with one click; on Enterprise, our analysts check every alert and run the takedowns for you.
Looking after clients as an MSP or IT provider? See the partner programme
Common questions
Do we need a security team to use DefendDomain?
No. Each alert says what we found, why it matters and what to do, with the evidence attached. It goes by email, Slack, Microsoft Teams or SMS to whoever you choose, such as a finance lead, an office manager or your IT provider.
How quickly will we hear about a new lookalike domain?
Within the hour, and sooner when a certificate is issued for the name. Attackers move fast. In our fake-invoice case, a replacement fake domain was registered and sending fraud emails 28 minutes later.
Can you protect more than one brand or trading name?
Yes. Each domain you add is watched on its own, so a group with several regulated firms or trading names can cover them all from one account. Enterprise covers unlimited domains and brands.
Do you touch the fake sites to investigate them?
No. We look at public registration, DNS and certificate records, and view published pages the way any visitor would. We never log in to, test or probe anything.
What does it cost?
The free scan costs nothing and needs no account or card. The Threat Report is $249 one-off for one domain, with every finding checked by an analyst. Pro and Enterprise are priced by how many domains you protect: Pro includes 5 domains, and both are annual plans with a 12-month minimum. We give you the price on a call.
Tell us how many domains you want protected.
Request a pricing callWe call you within one working day to talk it through.
Anything else? Contact us. We reply within one working day.
ISO 27001 certified (certificate 535732026, September 2026) and Cyber Essentials certified. Our main database is hosted in London (AWS eu-west-2), and some of the services we use are US companies. Read our security page
See which lookalikes of your domain already exist
The Threat Report checks lookalikes of your domain and public certificate records. An analyst reviews every finding, and you get a PDF for your board, finance team or insurer, plus a call to go through it.
We email a secure payment link within one working day. Takedowns are not included.
To have the lookalikes watched and taken down for you, book a demo. In 30 minutes we show you what an alert looks like and how a takedown runs, and give you a clear annual price for your domains.