Stop fake emails sent in your firm’s name
Criminals register lookalikes of your web address, such as yourfirm-law.com, to email your clients new bank details. We flag each one, and get it taken down if used against you.
Checks 150+ lookalikes in a couple of minutes. Work email needed, no card.
Already happening? Report a live attack
Example: a fake email sent during a property sale (a completion, or closing in the US) from a lookalike of yourfirm.com. Below it is what our alert tells you about the domain.
What a fake email costs a firm
- Client money sent to the wrong account
- Fake bank details arrive when the sums are largest, and clients rarely distinguish between the criminal and the firm. In our pharmaceuticals case, a client paid €150,000 to fake payment instructions. Read the pharmaceuticals case study
- Insurers and regulators asking questions
- A loss leads to claims, notifications and questions about what you knew and when, from the client, your insurer and your regulator.
The attacks firms like yours see
Law firms, accountants, consultancies and agencies are all targets. Each attack starts with a lookalike domain: a web address made to look like yours.
Changed bank details
A lookalike address joins the email thread at the right moment with new account details: a law firm’s completion statement, an accountant’s note about a client’s tax refund, or a consultancy’s fee invoice. The wording, signature and timing all look genuine.
Fake document‑sharing pages
A link to ‘view the signed documents’ that leads to a login page under your name, built to collect client and staff passwords.
Partners impersonated
Emails that appear to come from a senior partner, asking a colleague or client to make an urgent transfer or share confidential files.
What we do about it
Monitoring
We watch around 500 lookalikes of each domain, across 240+ domain endings, and re-check every one every hour. A lookalike that is registered or set up to send email is flagged; one that shows a login page or a copy of your site gets you an alert.
Takedown
One click sends the evidence to every place that can act on it, including:
- The registrar and host
- The email provider it sends through
- The blocklists spam filters use
Most takedowns take between 2 and 96 hours, depending on the registrar and host involved, and are unlimited on Pro and Enterprise.
Your own domains
Separately, we check your own domains every day and grade them A to F. The check covers the email records that tell other mail servers who may send email as you (SPF, DKIM and DMARC), plus DNS, certificates and website settings.
When you confirm an attack, we gather the evidence, send the report to up to 12 places, chase the ones that do not act and keep watching, with a check every hour until the fake is offline and an alert if it comes back. You do not need a security team: on Pro, someone on your side reads each alert and approves the takedown with one click; on Enterprise, our analysts check every alert and run the takedowns for you.
Looking after clients as an MSP or IT provider? See the partner programme
Common questions
Do we need a security team to use DefendDomain?
No. Each alert says what we found, why it matters and what to do, with the evidence attached. It goes by email, Slack, Microsoft Teams or SMS to whoever you choose, such as a finance lead, an office manager or your IT provider.
Will this help with our insurer or regulator?
It gives you a record to show them: a log of every alert, the evidence pack for each fake and a record of every takedown. You can export it for an insurance renewal, an audit or an incident review. How much weight it carries is for each insurer or regulator to decide.
Can you catch a cloned firm?
If the fake firm copies your website or uses a lookalike of your web address, yes. In our consultancy case, a full copy of the consultancy’s website sat on a free hosting platform with a working padlock and no lookalike domain to find. The certificate logs, a search for its wording and the website marker found it, and it was offline about 24 hours after it was confirmed. A fake firm on an address that looks nothing like yours, which uses your name but does not copy your site, may not be found.
We already warn clients about payment fraud. Is that not enough?
Warnings help, but they rely on a client noticing one wrong character under pressure. Monitoring gives you the exact address to warn the right clients about, within the hour of it being registered.
What does it cost?
The free scan costs nothing and needs no account or card. The Threat Report is $249 one-off for one domain, with every finding checked by an analyst. Pro and Enterprise are priced by how many domains you protect: Pro includes 5 domains, and both are annual plans with a 12-month minimum. We give you the price on a call.
Tell us how many domains you want protected.
Request a pricing callWe call you within one working day to talk it through.
Anything else? Contact us. We reply within one working day.
ISO 27001 certified (certificate 535732026, September 2026) and Cyber Essentials certified. Our main database is hosted in London (AWS eu-west-2), and some of the services we use are US companies. Read our security page
See which lookalikes of your domain already exist
The Threat Report checks lookalikes of your domain and public certificate records. An analyst reviews every finding, and you get a PDF for your board, finance team or insurer, plus a call to go through it.
We email a secure payment link within one working day. Takedowns are not included.
To have the lookalikes watched and taken down for you, book a demo. In 30 minutes we show you what an alert looks like and how a takedown runs, and give you a clear annual price for your domains.