Skip to main content
DefendDomain
Under attack?
Fake invoicesMid-2026

Fake invoice domain taken offline

A lookalike of a products company's domain emailed its customers about new bank details. The fake domain had no website; it existed only to send email. It was blocklisted the same day, and the registrar later took it offline.

Someone emailing your customers from a lookalike of your domain right now? Report a live attack. Free to report, no account needed.

The fake addressOffline
Real
brandname.com
Fake
brandname-products.com
The pattern from the case. Names changed.

The case in brief

Who
An established e-commerce and wholesale products company that sells to trade customers and online.
When
Mid-2026.
What happened
Someone registered the brand name with a product word added (for example, brandname-products.com) and set it up only to send email. Posing as a named salesperson, they told customers that payments had moved to a “factoring” company and asked them to reply for the new bank details.
What happened
Offline
  1. Lookalike set up to send email, no website
  2. Same dayOn anti-phishing blocklists, which cut delivery of its emails
  3. Same dayReports to ten places: the email platforms, the reply mailbox, the registrar, the DNS provider and blocklists
  4. LaterThe attacker added another email platform. We reported that too.
  5. The registrar took the domain offline

From the case. Names changed.

This case used ten places. We can now report to up to 12, depending on the attack.

Check your own domain

See which lookalikes of your web address are already registered, and which can send email.

Run a free scan

Checks 150+ lookalikes of your domain in a couple of minutes and emails the report to your work address. No account, no card.

How the scam worked

The fake address was a lookalike domain: the brand name with a product word added, such as brandname-products.com next to the real brandname.com. To a busy accounts clerk it looks like the real company. This is how the first email read.

FromSam Taylors.taylor@brandname-products.com
SubjectUpdated payment instructions

Hello,

Please note that we now use a factoring company to collect our invoice payments. The payment instructions on our earlier invoices no longer apply.

Please reply to this email and I will send you our updated, verified bank details.

Kind regards,
Sam Taylor
Sales team, Brandname

  1. The domain. The brand name with a product word added. It had no website: it was set up only to send and receive email, so there was no fake page for anyone to notice or report.
  2. The ask. No bank details, so the first email had nothing for a filter to catch. Replies went to a separate mailbox, and the fraudsters sent their own account number in the conversation that followed.
  3. The person. A named member of the company's sales team. The emails went to the company's customers, not to the company.

Reconstruction. Names changed.

A factoring company is a firm that collects invoice payments for another. The emails went out through several email platforms at once, under the names of made-up "factoring" and "receivables" companies, so that blocking one platform would not stop the rest.

Why email filters and DMARC did not stop it

The emails went to the customers' inboxes, not the company's, so the company's own email filters never saw them.

DMARC on the company's real domain stops other people sending email that claims to come from that domain. It does nothing about a different domain the attacker owns, which can pass its own email checks. That is why stopping supplier invoice fraud means watching for the lookalike domain itself.

What we did

Customer payments were at risk, so the first aim was to make the fake domain useless quickly, rather than wait for one takedown request to be handled. Getting it onto major anti-phishing blocklists the same day cut delivery of its emails on every platform it sent through.

With no website to point to, the evidence came from the domain's email set-up: its DNS, its sending records and the mailbox receiving replies. It went to the email platforms, the reply mailbox, the registrar (the company that sold the domain), the DNS provider and blocklists that spam filters and security tools use. When the attackers added another email platform, we saw the change in the domain's email settings and reported that platform too.

The registrar then took the domain offline, which stopped both the outgoing emails and the replies. We kept watching for a replacement domain, and worked with the company so its customers knew to confirm any change of bank details by phone, on a number they already had.

More on this: protecting an e-commerce business from impersonation.

Happening to you now?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.

More cases

All case studies