Stop criminals logging in as your customers
Criminals put copies of your login page on lookalike domains like yourapp-login.com, or send fake job offers in your name. We find them, alert you, and get them taken down.
Free scan in a couple of minutes, no card. Reporting an attack is free.
Example: a fake sign-in warning from a lookalike of yourapp.com. Below it is what our alert tells you about the domain.
What a fake login page costs you
- Account takeovers you get blamed for
- When a customer types their password into a fake page, the break-in happens on your platform. They will see it as your security failure.
- Support load and churn
- Locked accounts, reset requests and nervous customers take time to handle, and some of them do not renew.
- Harder security reviews
- Enterprise buyers ask how you protect their users from phishing in your name. It helps to have a clear answer and records to back it up.
The attacks on your brand
Lookalike login pages
Near-identical copies of your sign-in page on addresses like yourapp-login.com, reached from a fake security email or text like the example above. Only the address gives it away.
Fake job offers in your name
Fake recruiters contact job seekers by email, text, WhatsApp or LinkedIn, send them to a fake careers site built from your pages, then ask for personal details or a ‘training fee’. In our recruitment-scam case, new fake sites appeared every week.
Copies of your website
Your website copied onto a new address to sell fake subscriptions or collect payment details, sometimes with no lookalike domain at all. In our consultancy case, a full copy sat on a free hosting platform with a working padlock, and was offline about 24 hours after it was confirmed. Read the consultancy case study
What we do about it
Monitoring
We re-check around 500 lookalikes of each domain every hour and watch 100+ public certificate logs for names like yours. We also search the web for copies of your wording, and the optional website marker shows when a copy of your page loads elsewhere.
Takedown
One click sends the evidence to every place that can act on it, including:
- The registrar and host
- Browser warning lists
- Blocklists and search engines
Most takedowns take between 2 and 96 hours, depending on the registrar and host involved.
Your own domains
Separately, we check your own domains and subdomains every day and grade them A to F. That includes old DNS records pointing at services you no longer use, which someone could take over, and the records that say who may send email as you.
When you confirm an attack, we gather the evidence, send the report to up to 12 places, chase the ones that do not act and keep watching, with a check every hour until the fake is offline and an alert if it comes back. You do not need a security team: on Pro, someone on your side reads each alert and approves the takedown with one click; on Enterprise, our analysts check every alert and run the takedowns for you.
Looking after clients as an MSP or IT provider? See the partner programme
Common questions
Can you catch fake job offers?
Partly. We find the fake careers sites and the lookalike domains fake recruiters email from, and get them taken down. In our recruitment-scam case, each new lookalike is flagged as it is registered and we run the takedowns the company’s own staff used to do. We cannot remove LinkedIn posts, texts or WhatsApp messages themselves. Tell candidates on your careers page that you never charge a fee, and that real emails only come from your own domain.
Our customers use single sign-on. Are we still exposed?
Yes. Criminals copy whichever login page your customers expect to see, including single sign-on screens. Some pass what the user types to the real site, so one-time codes are captured too.
Can we show this to enterprise customers during security reviews?
Yes. You get a record of every alert, the evidence for each fake and every takedown, which you can export and share with a customer’s security team.
Do we need a security team to use DefendDomain?
No. Each alert says what we found, why it matters and what to do, with the evidence attached. It goes by email, Slack, Microsoft Teams or SMS to whoever you choose, such as a finance lead, an office manager or your IT provider.
What does it cost?
The free scan costs nothing and needs no account or card. The Threat Report is $249 one-off for one domain, with every finding checked by an analyst. Pro and Enterprise are priced by how many domains you protect: Pro includes 5 domains, and both are annual plans with a 12-month minimum. We give you the price on a call.
Tell us how many domains you want protected.
Request a pricing callWe call you within one working day to talk it through.
Anything else? Contact us. We reply within one working day.
ISO 27001 certified (certificate 535732026, September 2026) and Cyber Essentials certified. Our main database is hosted in London (AWS eu-west-2), and some of the services we use are US companies. Read our security page
See which lookalikes of your domain already exist
The Threat Report checks lookalikes of your domain and public certificate records. An analyst reviews every finding, and you get a PDF for your board, finance team or insurer, plus a call to go through it.
We email a secure payment link within one working day. Takedowns are not included.
To have the lookalikes watched and taken down for you, book a demo. In 30 minutes we show you what an alert looks like and how a takedown runs, and give you a clear annual price for your domains.