Skip to main content
DefendDomain
Under attack?

Why buying up lookalike domains is not enough

Registering the obvious typos of your domain is sensible. But with 240+ domain endings, letters that look the same and endless word combinations, nobody can buy them all. We watch around 500 lookalikes of each domain and get the ones used against you taken down.

A common assumption

“We have registered all the common misspellings of our name.”

Good for those names. In our software-group case nothing was misspelt: the criminal registered the group’s exact name on an ending it had not bought.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day.

Check for lookalike domains

Checks 150+ lookalikes of your domain in a couple of minutes and shows which are already registered. No account, no card. We email the report to a work address, not Gmail or Outlook.com.

Out of hours, email security@defenddomain.com.

What buying lookalike domains covers, and what it cannot

A defensive domain is one name a criminal cannot have, for a renewal fee every year.

What it does well

  • Secures the most obvious typos and endings
  • Stops someone registering those names to sell them back to you
  • Covers simple letter swaps, such as yourcomapny.com

What it cannot cover

  • Misspellings nobody predicted
  • Domain endings released after you bought
  • Pages on other people’s domains, such as yourcompany.free-hosting-site.com
  • Lookalikes someone else registered before you did

How criminals find a name you did not buy

They use the same free tools anyone can, and pick from what is left.

  1. Step 1

    List the variations

    Free tools list thousands of typos, swaps and endings for any name, and show which are still available.

  2. Step 2

    Pick an ending you did not buy

    Endings such as .xyz, .shop, .co or a country ending are cheap and often left off defensive lists.

  3. Step 3

    Use letters that look the same

    yourcompany.com with a Russian о in place of the o looks the same in many fonts, but it is a different domain.

  4. Step 4

    Add a word

    yourcompany-verify.com or login-yourcompany.com. The combinations never end, so they cannot all be bought.

  5. Step 5

    Use it before anyone notices

    Without monitoring, you may first hear about it from a customer asking about an email. With it, the registration is flagged at the next hourly check.

Watch the names instead of buying them all

Around 500 names per domain, the ones a criminal is most likely to pick, each checked every hour.

The names you did not buy

Generated from your domain and company name, leaving out the ones you confirm are yours. One that is registered or set up is flagged; one that looks set up to attack you raises an alert.

The evidence a takedown needs

Each alert comes with screenshots of what the name shows, who registered it and where it is hosted: what a registrar or host asks for before it acts.

A certificate for a name like yours

Before a website on a lookalike shows the padlock, its certificate is logged in public. We watch 100+ certificate logs as entries appear.

When one of those names is used against you

You confirm the attack, and one click sends the evidence to up to 12 places. The registrar that sold the name can suspend it, and the host and the email provider can switch it off. An abuse-report network passes the report on, and blocklists and threat feeds, browser warning lists and search engines keep it from reaching people until then. If any have not acted, we chase them at 48 and 96 hours, then go to the registry, which runs the domain ending, at 120 and 168 hours. Most takedowns take between 2 and 96 hours, depending on the registrar and host involved.

We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back. More on how lookalike monitoring works.

Case study, early 2026

Its exact name, on an ending it had not bought

The group, a European software and AI services business backed by a private equity firm, was buying other companies. Its security team was alerted when a copy of its website went live on the new domain, and no follow-up was needed.

Read the case study
What happened
Offline
  1. Weeks after an acquisition was announcedIts exact name registered on another ending, with a near-identical copy of the site
  2. Flagged at registration; the certificate was matched within seconds of being logged
  3. One-click takedown: the evidence went to ten places
  4. Offline before any customer was known to use it

From the case. Names changed.

Buying lookalike domains and watching them, side by side

You can do both.

QuestionBuying lookalikesDefendDomain
CostBuying lookalikes: A renewal fee for every domain, every yearDefendDomain: Annual plan, priced by the number of your own domains
If a criminal registers oneBuying lookalikes: You find out when someone noticesDefendDomain: Flagged at the next check, with the evidence gathered
Getting it taken downBuying lookalikes: Not coveredDefendDomain: We get it taken down, and chase the places that do not act

Related pages

Questions about buying lookalike domains

No. Keep and renew the ones you have; a name you own is one nobody else can use.

It may not be on our list either, so two other checks look for it. A website on a name like yours shows up in the certificate logs we watch, and the website marker, a small script or a 1×1 image you can add to your pages, tells us when a copy of one loads somewhere else.

See which lookalikes of your domain someone else owns

In a 30-minute demo we show you the lookalikes of your domain that are registered today, and which are yours.

  • Which lookalikes of your domain are registered, and by whom where that is public
  • Which of them can send email or show a website
  • A clear annual price for your domains

Rather see results first? Run a free scan