Cloned website taken down

This case used ten places. We can now report to up to 12, depending on the attack.

Background

In early 2026, a European software and AI services group was targeted by an attacker based in Asia. The group is backed by a private equity firm and grows by buying other companies across the UK and EU. One of its acquisitions had just been announced in the trade press.

Within weeks of that announcement, the attacker registered the group's exact name on a different domain ending and put up a near-identical copy of its live website.

Why it was dangerous

The attacker did not bother with misspellings. They registered the group's exact name with a different ending, for example brandname.com → brandname.io. The copy had the group's marketing pages, product screenshots, customer logos and contact forms, and it was hosted in the attacker's own region.

The group was part-way through buying and merging companies, so many people were still getting used to its name: customers of the companies it had bought, new staff and prospects. A convincing copy on a different ending would have been very hard for them to tell apart from the real site.

A copy like this is often used to collect customer logins, redirect invoice payments, run fake job offers or spread malware through a fake download. Because this one was taken down before it was used, what the attacker planned is not known.

How it was found and taken down

The group already used DefendDomain for its main brand and for each company it had bought.

• Lookalike monitoring flagged the new domain as a close match for the protected brand after it was registered.
• A security certificate for the domain was matched in the public certificate logs within seconds of being logged. That showed the attacker meant to put a site on it.
• When the copy went live, our monitoring confirmed it was showing copied content, marked it as a live attack and alerted the group's security team.
• One click sent the evidence (screenshots, who registered the domain, DNS records, hosting details and an AI comparison with the real site) to ten places at once, including the companies hosting it, browser warning lists and search engines.

The copy was offline before any customer, prospect or employee of the acquired companies was known to have used it. We kept watching in case it came back, and would have followed up with the host if it had not acted. That was not needed.