Skip to main content
DefendDomain
Under attack?
Domain Threat Report

See which lookalikes of your domain are a threat

We check around 500 web addresses made to look like yours, and an analyst reviews every finding. You learn which are live, which can send email as you, which are yours, and what to do first. You get a PDF and a call to walk you through it.

Order the Threat Report, $249Run a free scan

One-off payment, no subscription. We email a secure payment link within one working day. Takedowns are not included.

Already have a fake site or fake emails going out? Report a live attack

Domain Threat Reportyourcompany.com

Summary

What we found

We found 46 registered lookalikes of your domain. Three of the five below are live today, and the first was set up to send email as you.

  • yourcompanyfinance.comSet up to send email as you, no websiteOn hold
  • yourcompany-client.comClient login page, can send emailLive
  • yourcompanyglobal.comFull copy of your websiteLive
  • clients-yourcompany.comLogin page in FrenchLive
  • yourcompany.co.comWeb hosting login and webmailSuspended
Most urgent
A login page asking for bank details
Most persistent
A clone rebuilt after removal
A page from a recent report, with the client's details replaced.

What one report found

A lookalike domain costs little to register and can sit unused for months before it is switched on. The report lists the ones already registered against you, which are being used now and which need watching.

From a recent report for a payments company:

  • 46

    lookalikes registered

  • 9

    look set up to attack the company

  • 5

    live sites impersonating the company

  • 7

    set up to send email, with no website

The bars show each figure against the 46. The last three are counted from the 46, so one domain can appear in more than one.

Two of the live sites were fake client login pages asking customers for their bank details. Another was a full copy of the company's website, rebuilt on a new domain two weeks after the first copy was removed.

What the report tells you

Some lookalikes are already in use against you. Others are registered and waiting, and can be switched on at any time. The report sorts one from the other and tells you what each finding means for your business.

  1. Summary

    What we found and what matters most, written so your board can read it.

  2. Lookalike domains set up to attack you

    Each one, what it is doing, when it was registered, and whether it is live, suspended or on hold.

  3. Live fake sites

    What the fake page asks your customers for, where their details are sent, and how we know who is behind it.

  4. Lookalike domains that send email but have no website

    Domains set up to send email as you, with nothing to see in a browser. This is how most fake invoices and bank-detail changes are sent.

  5. Lookalike domains you registered yourself

    Some companies register lookalikes of their own name to protect it. We find yours and leave them out, so they do not look like threats.

  6. What your own domains show

    Gaps anyone can see on your own domains, such as email settings that make you easier to fake, or internal system names like vpn.yourcompany.com listed in public certificate records.

  7. Timeline

    When each lookalike was registered, so you can see whether registrations against you are speeding up.

  8. Recommended actions

    What can be taken down now, what to keep watching, and what to fix on your side, in priority order.

What happens after you order

  1. Step 1

    Tell us your domain

    Fill in the form below. We do not need access to any of your systems.

  2. Step 2

    Pay

    We check the domain and email you a secure $249 payment link within one working day.

  3. Step 3

    We investigate

    We check around 500 lookalikes of your domain and public certificate records, and an analyst reviews each finding.

  4. Step 4

    You get the report

    A PDF you can forward to your board, your finance team or your insurer, and a call to walk you through it.

We do not access, test or probe anything. Every finding comes from public registration, DNS and certificate records and from published web pages, and we handle your details under our ISO 27001 certified security management system.

Free scan, Threat Report or Pro

Pick any two to compare them side by side.

$249 one-off

Priced by number of domains

Lookalike domains checked
Threat Report: Around 500Pro: Around 500 per domain
Which lookalikes can send email as you
Threat Report: Pro:
Fake sites and copies of your website found
Threat Report: Pro:
Findings checked by an analyst
Threat Report: Pro: No, sorted automatically (yes on Enterprise)
Lookalikes you registered yourself left out
Threat Report: Pro:
Actions in priority order
Threat Report: Pro:
Every lookalike re-checked every hour
Threat Report: Pro:
Takedowns
Threat Report: Not includedPro: Unlimited, you approve them
Order the Threat ReportRequest a pricing call
Run a free scan firstCompare all plans

Order the Threat Report

$249one-off, per domain
  • Around 500 lookalikes of your domain checked
  • Finds live fake sites and lookalikes set up to send email
  • Every finding checked by an analyst
  • Actions in priority order: what to take down, watch or fix
  • A PDF for your board, finance team or insurer, and a call to walk you through it

Takedowns are not included. They are part of Pro and Enterprise.

Common questions

Anything else, ask us directly. We reply within one working day.

Contact us

A fake already live? Report a live attack

Will you take the fake sites down?

Not as part of the report. It finds them and tells you which can be acted on now. Pro and Enterprise include unlimited takedowns, and they watch every lookalike that is not in use yet, so one that is switched on later is caught then. If a fake site or fake emails are being used against you now, use the Report a live attack form instead: reporting is free and needs no account.

When will I get the report?

We give you a delivery date when we send the payment link, within one working day of your request. If you need it by a certain date, for a board meeting or your insurer, say so in the form and we will tell you whether we can meet it.

Do I pay $249 for each domain?

Yes. The price is per domain: each web address, such as yourcompany.com or yourcompany.co.uk. Put your main domain in the form and list the others under “Anything we should know?”. We confirm the total before you pay.

How is this different from the free scan?

The free scan is automatic. It checks 150+ lookalikes of your domain and tells you which are registered and which can send email. For the Threat Report we check around 500 lookalikes plus public certificate records, look at what each live site is doing, leave out the lookalikes you registered yourself, and an analyst checks every finding before it reaches you.

What do you need from us?

Just the domain and someone to send the report to. We do not need access to any of your systems.

Do you touch the suspicious sites?

No. We read public registration, DNS and certificate records and load published pages the way any visitor would.

What if you do not find anything?

Then you have evidence that your domain is not being impersonated today, which is worth showing to your board or insurer. You will also know which lookalikes to keep an eye on.

Is it a subscription?

No. It is a single $249 payment per domain.