Stop fake invoices sent in your name
We re-check lookalikes of your domain and company name, like yourcompany-inc.com, every hour. We flag each one that can send email, and get it taken down if used against you.
Checks 150+ lookalikes in a couple of minutes. Work email needed, no card.
Already happening? Report a live attack
Example: a fake ‘new bank details’ email from a lookalike built from your company name. Below it is what our alert tells you about the domain.
What one fake invoice costs you
- Your customer pays the criminal
- Then they chase you for the goods, or refuse to pay twice. Either way, you are left sorting out a loss you did not cause. In our pharmaceuticals case, a client paid €150,000 to fake payment instructions.
- Customers start to doubt your invoices
- After one fake invoice, customers may phone to confirm every bank detail, or hold payments until they are sure. Your cash comes in later.
- They come back with a new domain
- Blocking one lookalike does not stop the people behind it. In our fake-invoice case, a replacement fake domain was registered and sending fraud emails 28 minutes later.
The attacks behind invoice fraud
They are aimed at any business whose customers pay invoices by bank transfer: manufacturers, distributors, wholesalers and logistics firms. Most of these domains never have a website at all.
Your legal name, slightly changed
Domains built from your registered company name, like yourcompany-inc.com or yourcompanyltd.com, look more official on an invoice than your real domain does.
Domains that only send email
A lookalike that can send email but has no website. There is nothing for a host to remove, and most tools ignore it. For invoice fraud, a working mailbox is all the criminal needs.
Your suppliers, impersonated
The same trick works in reverse: a fake supplier asks your accounts team to update their bank details before the next payment run.
What we do about it
Monitoring
We watch around 500 lookalikes of each domain, across 240+ domain endings, and re-check every one every hour. Each is flagged when it is registered, and again when its public email records show it can send email.
Takedown
One click sends the evidence to every place that can act on it, including:
- The registrar and host
- The email provider it sends through
- The blocklists spam filters use
For a domain with no website, the blocklists are what cut delivery of its emails.
Your own domains
Separately, we check your own domains every day and grade them A to F. The check covers the email records that tell other mail servers who may send email as you (SPF, DKIM and DMARC), plus DNS, certificates and website settings.
When you confirm an attack, we gather the evidence, send the report to up to 12 places, chase the ones that do not act and keep watching, with a check every hour until the fake is offline and an alert if it comes back. You do not need a security team: on Pro, someone on your side reads each alert and approves the takedown with one click; on Enterprise, our analysts check every alert and run the takedowns for you.
Looking after clients as an MSP or IT provider? See the partner programme
Common questions
Do we need a security team to use DefendDomain?
No. Each alert says what we found, why it matters and what to do, with the evidence attached. It goes by email, Slack, Microsoft Teams or SMS to whoever you choose, such as a finance lead, an office manager or your IT provider.
Can you watch for our registered company name as well as our domain?
Yes. We build lookalikes from the name on your company register as well as from your domain, adding the words criminals add (inc, ltd, llc, group, holdings) and words from your industry, such as a product line, and watch them in the same way.
Can we protect our key suppliers too?
Yes. Add the domains of the suppliers you pay most often, and we watch their lookalikes in the same way, so your accounts team can be warned about a fake supplier’s address. Each supplier domain counts as one domain on your plan, like your own.
What happens to lookalikes that are not in use yet?
We watch them every hour, because any of them can be switched on at any time: a mail server added, a copy of your website published. Registrars and hosts act on evidence of use, so that is when we act too: a mail server puts the domain on your watch list, and a copy of your site or a login page gets you an alert with the evidence already gathered, ready for one click to send the takedown.
What does it cost?
The free scan costs nothing and needs no account or card. The Threat Report is $249 one-off for one domain, with every finding checked by an analyst. Pro and Enterprise are priced by how many domains you protect: Pro includes 5 domains, and both are annual plans with a 12-month minimum. We give you the price on a call.
Tell us how many domains you want protected.
Request a pricing callWe call you within one working day to talk it through.
Anything else? Contact us. We reply within one working day.
ISO 27001 certified (certificate 535732026, September 2026) and Cyber Essentials certified. Our main database is hosted in London (AWS eu-west-2), and some of the services we use are US companies. Read our security page
See which lookalikes of your domain already exist
The Threat Report checks lookalikes of your domain and public certificate records. An analyst reviews every finding, and you get a PDF for your board, finance team or insurer, plus a call to go through it.
We email a secure payment link within one working day. Takedowns are not included.
To have the lookalikes watched and taken down for you, book a demo. In 30 minutes we show you what an alert looks like and how a takedown runs, and give you a clear annual price for your domains.