Protect every company in your portfolio
Criminals register lookalike domains, such as portfolioco-invoices.com, and email a portfolio company's customers new bank details (business email compromise, or BEC). DefendDomain finds these addresses, alerts the company when one is set up to send email, and gets it taken down if it is used in an attack.
We call you within one working day to talk it through.
Want to see results first? Run a free scan on one portfolio company's domain
Referring or reselling to companies outside your portfolio? Apply to partner
What your portfolio gets
- One agreement for all your portfolio companies
- Every company in one console, with alerts to each company and to your team
- Each company's lookalike domains re-checked every hour
- A daily A to F grade for each company's own domains, the same measure across the portfolio
- Unlimited takedowns on Pro and Enterprise
- Priced by the number of domains, and by whether you want our analysts to run it for you
How a portfolio rollout works
Step 1 · Your team
Send us the domains
Give us each company's domains. Lookalike monitoring and the daily check of each company's own domains need nothing installed.
Step 2 · DefendDomain
Alerts go to each company
Each company's own users get its alerts. Your team sees every company in the console and can get the alerts too.
Step 3 · Company or us
Each takedown is approved
On Pro, someone at the company confirms the attack and approves the takedown with one click. On Enterprise, our analysts check every alert and run the takedowns.
Step 4 · Your team
Add companies as you buy them
Add a new company by its domain when the deal closes. Its lookalikes are checked from the next hourly run.
What happened at one PE‑backed software group
A European software and AI services group, backed by a mid-market PE firm, was part-way through a buy-and-build. In early 2026, weeks after it announced an acquisition, someone registered its exact brand name on a different domain ending and put up a near-identical copy of its website.
Read the case study- Weeks after an acquisition was announcedIts exact name registered on another ending, with a near-identical copy of the site
- Flagged at registration; the certificate was matched within seconds of being logged
- One-click takedown: the evidence went to ten places
- Offline before any customer was known to use it
From the case. Names changed.
How to explain DefendDomain to a portfolio company
Criminals register a web address that looks like your portfolio company's, such as portfolioco-invoices.com. They use it to email new bank details to the people your portfolio company sells to, or to show a copy of the website. DefendDomain finds these lookalike domains and tells you when one is set up to send email or shows a copy of the site. If one is used in an attack, we get it taken down.
Checked every hour
We watch around 500 lookalikes of each of your portfolio company's domains and re-check every one every hour. We also watch 100+ public certificate logs as new entries appear.
Every alert comes with evidence
Screenshots, who registered the domain, where it is hosted and who handles its email, each with the time it was captured.
One click sends the takedown reports
Once someone confirms a live attack, one click sends the evidence to every place that can act on it, up to 12. If they do not act, we follow up at 48 and 96 hours, then go to the registry. Takedowns are unlimited on Pro and Enterprise.
Where we work
We work with customers in the US, UK, EU and Asia-Pacific. We watch 240+ domain endings, including country endings, and we report to whichever registrar, host or email provider the attacker uses, wherever it is, and chase them automatically until the fake is down.
How this differs from DMARC and email filtering
DMARC, email filtering and Microsoft Defender protect your portfolio company's own domain and inbox. None of them stops someone registering a lookalike domain and emailing the people your portfolio company sells to. DefendDomain watches for those domains.
What we do not do
We do not recover money that has already been paid, remove social media accounts or ads, or protect a real mailbox that has been hacked.
Want to refer or resell DefendDomain to companies outside your portfolio? Apply to partner, or ask for the programme terms first.
Ask for partner terms
Want the terms first? Leave your email and our partnerships team replies with the programme terms. No phone number needed.
What happens after you apply
- Step 1Our partnerships team reads your application and replies with the programme terms.
- Step 2We arrange a call to go through margins, deal registration and how billing works for your clients.
- Step 3If you go ahead, we set you up as a partner.
Apply to partner
Tell us about your business. Our partnerships team replies with the programme terms and arranges a call to go through them.