Get lookalike domains and fake sites taken offline
One click sends the evidence to up to 12 places that can act on it, all at once. If they do not act, we chase them on a set schedule and tell you when it is offline, or if it stalls.
Already happening?
Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.
- Up to 12 places sent the evidence at once, from the registrar to browser warning lists
- 2–96 h for most takedowns, depending on the registrar and host involved
- Hourly checks that the site is still online, until it is gone
- Unlimited takedowns on Pro and Enterprise
Where the evidence goes: up to 12 places at once
Which places apply depends on the attack. Every one of them gets the same evidence pack.
The companies that can switch it off
The registrar (the company that sold the domain), the host (the company whose servers run the site) and the email provider it sends through. An abuse-report network also passes the report to the abuse desk of the network the attacker uses.
Blocklists and threat feeds
The spam and abuse blocklists that email filters and security tools check, and phishing and malware feeds when the attack involves them.
Browser warning lists
The services behind the red warning screens in web browsers. Only when there is a website.
Search engines
Asked to drop the fake site from their results, when there is a website.
A copy of your website, fake invoices by email and a malware download
Can switch it off
Blocklists and threat feeds
Browser warnings and search
Can switch it off
- RegistrarSent
- Hosting providerSent
- Email providerSent
- Abuse-report networkSent
Blocklists and threat feeds
- Spam blocklistSent
- Abuse databaseSent
- Phishing feedSent
- Malware feedSent
Browser warnings and search
- Browser warning lists (2)Sent
- Search engines (2)Sent
All 12 places used. If nothing happens, we chase at 48 and 96 hours.
The example uses all 12: a lookalike of your company name with a copy of your website, fake invoices sent by email and a malware download. A lookalike that only sends email has no page for a browser to warn about or a search engine to drop, so those are skipped for it.
We do not remove social media accounts, ads, app-store or marketplace listings. If one of them links to a fake site on a lookalike of your domain, or to a copy of your website, we can report that site.
A takedown in five stages
The follow-up matters as much as the first report, and it runs automatically.
Stage 1 of 5
Confirm it is a live attack
On Pro, someone on your side checks the alert and its evidence, then types the domain to approve the takedown. On Enterprise, our analysts do this for you. Nothing is sent until then. Reports go out from DefendDomain with the evidence attached.
Stage 2 of 5
Browser warnings and blocklists
The blocklists get the report at the same time as everyone else, and so do the browser warning lists when there is a website. Once a site is listed, visitors see a red warning screen while removal is still in progress.
Stage 3 of 5
Ask the companies that run it to switch it off
The registrar, the host and the email provider all get the same evidence pack: screenshots, who registered the domain, where it is hosted and who handles its email, each with the time it was captured. When there is a website, search engines are asked to drop it from their results.
Stage 4 of 5
Chase them on a set schedule
We check every hour whether it is still online and tell you when it goes down. If they have not acted, we chase the host and registrar again at 48 and 96 hours, then go to the registry (the organisation that runs the domain ending, such as .com) at 120 and 168 hours. If nothing has moved after 30 days, we tell you, with the options left.
Stage 5 of 5
Watch for it coming back
We keep watching after it goes offline and alert you if it comes back. When you confirm an attack, we record what the attacker used, such as the registrar, name servers and email set-up, and compare your other lookalikes with it.
How long it takes
Most takedowns take between 2 and 96 hours, depending on the registrar and host involved.
- Reports sent
- At once, to every place that applies
- Typical takedown
- 2 to 96 hours
- If nobody acts
- Chased at 48 and 96 hours
We report to whichever registrar, host or email provider the attacker uses, wherever it is, and chase them automatically until it is down.
What happened in real cases
- In one case, the fake domain was on anti-phishing blocklists the same day, which cut delivery of its emails.
- In another, a copy of a client's website on a free hosting platform was offline about 24 hours after it was confirmed.
- In a third, the certificate for a copied website was matched within seconds of being logged, and the site was taken down before any customer was known to have used it.
Unlimited takedowns on Pro and Enterprise
You do not pay per takedown. If an attacker registers twenty lookalikes in one campaign, each gets its own takedown at no extra cost. Pro and Enterprise are annual plans, priced by the number of domains you protect.
See pricingOne campaign, twenty domains
Each with its own takedown
- yourcompany-login.com
- yourcompany-invoices.com
- yourcompany-payments.com
- yourcompany-portal.net
and 16 more
Who presses the button
Pro: you approve, we send the reports and chase them
Someone on your side reads each alert, confirms it is a live attack and approves the takedown with one click. The reports, follow-ups and hourly checks run without you.
- No forms to fill in or evidence to gather
- The status of each report, as it changes
- Unlimited takedowns
Enterprise: our analysts run it
Our analysts check every alert and run the takedowns and escalations for you. You get quarterly reporting for your board.
- Every alert checked by an analyst
- Quarterly board reporting
- Unlimited domains and brands
Not a customer and under attack now? Report a live attack. Reporting is free and needs no account. On the call we tell you what we have found and what we can do about it.
Running takedowns for your clients? See the partner programme.
See it on a real attack
Free scan. No account, no card details.
See which lookalikes of your domain already exist
The free scan checks 150+ lookalikes of your domain and shows which are registered and which can send email as you. Takedowns are part of Pro and Enterprise.
- Typos, other endings and added words, such as yourcompany-invoices.com
- Which ones are registered, and which are set up to send email as you
- The report in your inbox, usually in a couple of minutes. No account, no card details, no sales call.
Under attack now? Report a live attack. Otherwise, book a demo or see monitoring.