Find lookalike domains and get them taken down
We find web addresses made to look like yours and tell you when one is set up to send email or shows a copy of your website. If one is used against you, we get it taken down.
The free scan checks 150+ lookalikes of your domain in a couple of minutes and emails you the report. No account, no card.
- 5 layers of protection: four watch for impersonation, one checks your own domains
- ~500 lookalikes watched per domain, each re-checked every hour
- Up to 12 places sent the evidence when you start a takedown
- 8 alert channels, from email and Teams to your security tools
What DefendDomain does, in three parts
You do not need a security team. On Pro you approve each takedown with one click; on Enterprise our analysts run them for you.
Monitoring · Layers 1 to 4
Find lookalikes of your domains
Four layers watch for impersonation: around 500 lookalikes of each domain you protect, re-checked every hour (including ones set up only to send email, which is how most fake-invoice fraud works), public certificate logs, and copies of your website and its wording.
How monitoring worksDisruption and takedown
Get them taken down
Once you confirm a live attack, one click sends the evidence to up to 12 places that can act on it, all at once. If they do not act, we chase them on a set schedule. Unlimited takedowns on Pro and Enterprise.
How takedown worksPrevention · Layer 5
Close the gaps on your own domains
A daily check of your own domains and subdomains: email security (DMARC, SPF, DKIM), DNS, certificates, website settings and exposed files. Each domain is graded A to F, with a written fix for each finding.
How prevention works
Five layers: four look outward, one looks inward
Four layers watch for people pretending to be you, each for a different sign, so a lookalike missed by one can still be caught by another. The fifth checks your own domains for the gaps that make pretending easy. Bought separately, that is two suppliers and nobody joining the two halves up.
Layer 1
Lookalike monitoring
Around 500 lookalikes per domain, re-checked every hour, including ones set up only to send email
Layer 2
Embedded markers
An optional script or 1×1 image on pages you choose, which reports a copy of the page as it loads
Layer 3
Content fingerprinting
Your site's wording searched for on the web, to find copies rebuilt without your code
Layer 4
Certificate monitoring
100+ public certificate logs watched for your name as new entries appear
Layer 5
Security posture
A daily check of your own domains and subdomains, graded A to F
One list of domains for all five
When you tell us a lookalike is yours, it leaves the threat list and joins the Layer 5 scorecard in the same step. How prevention works
To start
Give us your domains; nothing else is needed. The website marker is optional: a small script or a 1×1 image on pages you choose.
One dashboard for every threat
Every lookalike is sorted automatically: threats are alerted, doubtful ones go on a watch list, and the rest are marked safe. No report goes to anyone outside your company until you confirm.
- One list for all threats
- Filter by type and status, whichever layer found it
- No repeat alerts
- Repeat sightings of the same threat are grouped, so your inbox stays quiet
- A status for every threat
- Five statuses, from new, to live attack, to resolved, with a full audit trail
- Evidence collected for you
- Screenshots, who registered the domain, its DNS records and where it is hosted
- The signals behind each score
- Each Layer 1 alert lists the signals that rated it and how much each one counted
Alerts in eight channels
Email, Slack, Microsoft Teams, SMS, webhook, Splunk, Microsoft Sentinel and Wazuh. If your ticketing system takes tickets by email or webhook, alerts can go straight in.
Slack
Teams- Webhook
- SMS
Splunk
Sentinel
Wazuh
Show the board where you stand
What is being watched, what was found and what was done about it.
Your domains
- yourcompany.comGrade B1 open alert
- yourcompany.co.ukGrade ANo open alerts
Certificate of Protection ready to download
Security overview dashboard
The last 30 days of monitoring, for the whole company.
What it shows
- How many domains are protected and how many alerts are open
- Activity across all five layers, day by day
- Certificates checked and matches found
- Who is on the team and which domains the company owns
- How many domains are protected and how many alerts are open
- Activity across all five layers, day by day
- Certificates checked and matches found
- Who is on the team and which domains the company owns
Domain protection dashboard
Where each domain stands on each of the five layers.
What it shows
- A summary card and score for each layer
- An overall status: Excellent, Good, Warning or Critical
- When each layer last ran
- Findings for each layer, on its own tab
- A summary card and score for each layer
- An overall status: Excellent, Good, Warning or Critical
- When each layer last ran
- Findings for each layer, on its own tab
Role-based access for your team
Three roles give each person the access their job needs, across as many brands as you run.
Invite teammates by email and keep a record of who joined, left or changed role. With multi-company support you run several brands from one login, and each company's data stays separate.
Looking after clients as an MSP or IT provider? The partner console puts all your client companies in one login. See the partner programme
Compliance, reporting and integrations
What auditors, insurers and your other systems will ask for.
Evidence exports for your auditor
Formatted for ISO 27001. Evidence is kept after a threat is closed.
A Certificate of Protection
A PDF confirming which of your domains we protect and what we check, for your board, auditors, insurer or customers.
A continuous record of monitoring
For auditors and insurers who ask how long you have been watching.
API and integrations
Alerts into Splunk, Microsoft Sentinel, Wazuh or any webhook, and SAML single sign-on on Pro and Enterprise. An API and custom webhooks are available too; ask us which plan includes them.
ISO 27001 certified and independently penetration tested
How we protect your account and your data. Read our security page
Certified- Standard
- ISO/IEC 27001:2022
- Certificate
- 535732026
- Valid to
- September 2027
Signing in
- A one-time code sent by email, so there is no password to steal
- Single sign-on (SAML) on Pro and Enterprise
- Extra confirmation for sensitive changes
- Sign out of all your devices in one step
Your alert settings kept secret
- Alert-channel credentials, webhook addresses and API tokens are encrypted when saved
- They are only ever decrypted on our servers
Your data kept separate
- Our main database is hosted in London (AWS eu-west-2)
- Data is isolated between companies
- People see only what their role allows, enforced on every record
- Privileged actions audited
Free scan. No account, no card details.
See which lookalikes of your domain already exist
The free scan checks 150+ lookalikes of your domain and shows which are registered and which can send email as you. Monitoring then watches around 500 per domain, every hour.
- Typos, other endings and added words, such as yourcompany-invoices.com
- Which ones are registered, and which are set up to send email as you
- The report in your inbox, usually in a couple of minutes. No account, no card details, no sales call.
Prefer a conversation? Book a demo or see pricing.