Find and take down fakes of your clients' domains
Criminals register lookalike domains, such as yourclient-invoices.com, and use them to email your clients' customers new bank details (business email compromise, or BEC). DefendDomain shows your team each one that is set up to send email, and gets it taken down if it is used in an attack.
Our partnerships team replies with the programme terms.
What MSPs get
- The partner console: all your clients in one login, with your logo on it
- Each client's lookalike domains re-checked every hour
- Prospects' domains scanned every week, so you have something to show them
- Alerts go to your staff as well as to the client
- Unlimited takedowns on Pro and Enterprise
- Commission or margin, set by your partner tier
How it works for your team
What your service desk does, and what we do, for clients you manage in the partner console.
Step 1 · Your team
Add a client by domain
Add the client in the partner console with their domain. We list around 500 lookalikes of it and check each one every hour. There is nothing to install. The website marker is optional.
Step 2 · DefendDomain
Alerts reach your service desk
Your staff and the client's own users get each alert by email. Alerts can also go to Slack, Microsoft Teams, SMS, a webhook, Splunk, Microsoft Sentinel or Wazuh.
Step 3 · Your team or the client
Someone confirms the attack
Findings are sorted automatically: threats are alerted, doubtful ones go on a watch list, the rest are marked safe. No takedown report goes out until your staff or the client confirm a live attack and approve it with one click.
Step 4 · DefendDomain
We send the reports and follow up
We send the evidence to every place that can act on it, up to 12, and follow up with the host and registrar at 48 and 96 hours. We check every hour whether it is still online and tell you when it goes down.
Check before you apply
Ticketing
If your PSA takes tickets by email or webhook, alerts can go straight in. We have no built-in ConnectWise, Autotask or Halo connector.
What your client sees
Their own dashboard, with each alert, its evidence and how the takedown is going.
Pricing fit
Pro, the plan we sell direct, is annual with 5 domains included. If your clients have one or two domains each, or pay you monthly, ask us how that works before you apply.
Partner tiers and what each one includes
Your tier is set by the number of client companies DefendDomain protects through you. Your margin or commission depends on your tier. Ask for partner terms and we will explain them.
Refer
- Bronze · 1–24 client companies
- Silver · 25–49 client companies
- You introduce a client
- We sell and send the invoice
- You earn commission
Resell
- Gold · 50–99 client companies
- Platinum · 100+ client companies
- You sell and send the invoice
- We deliver the service
- You keep the margin
| Refer | Resell | |||
|---|---|---|---|---|
| Benefit | Bronze1–24 | Silver25–49 | Gold50–99 | Platinum100+ |
| Co-branded marketing material | Not included | Included | Included | Included |
| Shared leads | Not included | Included | Included | Included |
| Resell and bill your clients yourself | Not included | Not included | Included | Included |
| Marketing development resources | Not included | Not included | Included | Included |
| Priority support | Not included | Not included | Included | Included |
| Early look at new features | Not included | Not included | Not included | Included |
| Dedicated account manager | Not included | Not included | Not included | Included |
| Joint business planning | Not included | Not included | Not included | Included |
Ask us how deal registration works. If your own staff look after your clients' security, also ask which tiers get the partner console (all your clients in one login) and how alerts and support work at your tier.
Our partnerships team replies with the programme terms.
How to explain DefendDomain to a client
Criminals register a web address that looks like your client's, such as yourclient-invoices.com. They use it to email new bank details to the people your client sells to, or to show a copy of the website. DefendDomain finds these lookalike domains and tells you when one is set up to send email or shows a copy of the site. If one is used in an attack, we get it taken down.
Checked every hour
We watch around 500 lookalikes of each of your client's domains and re-check every one every hour. We also watch 100+ public certificate logs as new entries appear.
Every alert comes with evidence
Screenshots, who registered the domain, where it is hosted and who handles its email, each with the time it was captured.
One click sends the takedown reports
Once someone confirms a live attack, one click sends the evidence to every place that can act on it, up to 12. If they do not act, we follow up at 48 and 96 hours, then go to the registry. Takedowns are unlimited on Pro and Enterprise.
Where we work
We work with customers in the US, UK, EU and Asia-Pacific. We watch 240+ domain endings, including country endings, and we report to whichever registrar, host or email provider the attacker uses, wherever it is, and chase them automatically until the fake is down.
How this differs from DMARC and email filtering
DMARC, email filtering and Microsoft Defender protect your client's own domain and inbox. None of them stops someone registering a lookalike domain and emailing the people your client sells to. DefendDomain watches for those domains.
What we do not do
We do not recover money that has already been paid, remove social media accounts or ads, or protect a real mailbox that has been hacked.
Ask for partner terms
Want the terms first? Leave your email and our partnerships team replies with the programme terms. No phone number needed.
What happens after you apply
- Step 1Our partnerships team reads your application and replies with the programme terms.
- Step 2We arrange a call to go through margins, deal registration and how billing works for your clients.
- Step 3If you go ahead, we set you up as a partner.
Apply to partner
Tell us about your business. Our partnerships team replies with the programme terms and arranges a call to go through them.