Skip to main content
DefendDomain
Under attack?

Under attack? We'll help you get it shut down.

Report it here if someone is emailing your customers or donors fake invoices or new bank details from an address like yours, even one with no website.

Do this first:Call any customer who has been asked to pay, on a number you already have, and tell them not to. Anyone who has already paid should call their bank or card issuer now. What else to do today

Report a live attack

What happens next

  1. 1One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.
  2. 2On the call we tell you what we have found and what we can do about it.
  3. 3If you go ahead, we build the evidence pack, send it to every place that can act on it, and chase them automatically.

While you wait

What is happening?

If fake emails have already reached your customers, do these today.

  1. 1Call the customer who was emailed, on a number you already have, and tell them not to pay.
  2. 2If money has gone, their bank needs to ask for a recall now. The first 24 to 72 hours matter most.
  3. 3Report it to Report Fraud (UK), the FBI's IC3 (US) or the police in your country.
  4. 4Keep the original emails as well as any screenshots. The originals show where they really came from.

We cannot get money back. We can get the fake domain reported and blocklisted, so its next emails are less likely to arrive.

Step-by-step guides: someone is sending emails as my company and someone copied my website.

What we do if you go ahead

After the call, if you want us to act, this is what happens.

  1. Step 1

    We build the evidence pack

    Screenshots, who registered the domain, where it is hosted and who handles its email, each with the time it was captured. You do not fill in any abuse forms. You also get the evidence as a PDF, to give to your bank, your lawyer, your insurer or the police.

  2. Step 2

    We send it to every place that can act

    All at once, to up to 12 places, depending on the attack. The list is below.

  3. Step 3

    We chase anyone who has not acted

    If they have not acted, we chase the host and registrar again at 48 and 96 hours, then go to the registry (the organisation that runs the domain ending, such as .com) at 120 and 168 hours. If nothing has moved after 30 days, we tell you, with the options left.

  4. Step 4

    We tell you when it is offline

    We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

Where the report goes

Up to 12 places, depending on the attack. For a copied website it looks like this.

yourcompany-login.com
Evidence sentExample

Can switch it off

Registrar · Hosting provider · Email provider · Abuse-report networkSent

Blocklists and threat feeds

Spam blocklist · Abuse database · Phishing feedSent
Malware feedSkipped: no malware

Browser warnings and search

Browser warning lists (2) · Search engines (2)Sent

11 of the 12 places applied. If nothing happens, we chase at 48 and 96 hours.

What each place does
The registrar, the host and the email provider
The company that sold the domain, the company whose servers run the site, and the service it sends email through. These are the companies that can switch it off.
An abuse-report network
Passes the report to the abuse team of the network the attacker uses.
Blocklists
The spam and abuse blocklists that email filters and security tools check, plus phishing and malware feeds when the attack involves them.
Browser warning lists
The services behind the red warning screen that browsers show visitors.
Search engines
Asked to drop the fake site from their results. Only when there is a website.

How long it takes

Most take between 2 and 96 hours, depending on the companies involved. For a domain that only sends email, the blocklists are what cut delivery of its emails.

In the fake-invoice case, the fake domain was on anti-phishing blocklists the same day, which cut delivery of its emails. In the copied-website case, a copy of a client's website on a free hosting platform was offline about 24 hours after it was confirmed.

Follow-up, while it is still online

Example

  1. Day 0Reports sent to every place that applies

  2. 48 hHost and registrar chased

  3. 96 hHost and registrar chased again

  4. 120 hRegistry contacted

  5. 168 hRegistry chased again

  6. 30 daysStalled notice to you, with the options left

Checked every hour. When it goes offline, you are told and the chasing stops.

What we can and cannot do

We find and report

Lookalikes of your domain, including ones set up only to send email. New certificates for names like yours. Copies of your website and your wording, including on free hosting sites.

We do not

Recover money that has already been paid. Remove social media accounts, ads, app-store or marketplace listings, or SMS and WhatsApp numbers. Protect a real mailbox that has been hacked. If an ad or a post points to a fake site on a lookalike of your domain or a copy of your website, we can go after that site.

Not sure it counts?

For example, a fake site on an address that looks nothing like yours, or a page on a hosting or fundraising platform. Report it anyway, and we will tell you on the call whether we can act on it.

Where we work

We work with customers in the US, UK, EU and Asia-Pacific. We watch 240+ domain endings, including country endings, and we report to whichever registrar, host or email provider the attacker uses, wherever it is, and chase them automatically until the fake is down.

DefendDomain Ltd, company number 16727523. ISO 27001 and Cyber Essentials certified. Read about our security.

Tell us what is happening

Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.

Read what to do in the next hour