Skip to main content
DefendDomain
Under attack?

What your email gateway does not see

Your email gateway checks mail coming into your company, and can warn about some lookalike senders there. It does not see a lookalike domain emailing your customers, because that mail goes to their inboxes, not yours. We find the lookalike itself, wherever its mail goes, and get it taken down.

A common assumption

“Our email gateway catches phishing before it reaches anyone.”

In our fake-invoice case, the lookalike was on anti-phishing blocklists the same day, and that is what cut delivery of its emails.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day.

Check for lookalike domains

Checks 150+ lookalikes of your domain in a couple of minutes and shows which can send email as you. No account, no card. We email the report to a work address, not Gmail or Outlook.com.

Out of hours, email security@defenddomain.com.

What email gateways check, and what they never see

An email gateway (often sold as a secure email gateway, SEG) checks the links, attachments and sender of each message.

What a gateway does well

  • Blocks known bad links and attachments
  • Quarantines suspicious mail coming in
  • Rewrites links and checks them when they are clicked
  • Warns about some impersonation and newly registered sender domains

What it never sees

  • Mail sent from a lookalike to your customers or suppliers
  • Links sent by text message, social media or personal email
  • Fake websites on lookalikes of your domain
  • A lookalike domain being set up, before any mail is sent

Nothing we do needs access to your mail system or your gateway.

How a lookalike avoids your gateway

We can see the first step: a new lookalike of your domain, and then the mail server it needs.

  1. Step 1

    Register a lookalike

    The criminal registers yourcompany-accounts.com and gives it a mail server, SPF and DKIM, so its email passes the sender checks when it arrives.

  2. Step 2

    Write to your customers

    The fake invoices go to your customers, posing as someone they deal with: a salesperson, accounts, a director. Their filters may or may not catch them.

  3. Step 3

    Or send a link another way

    A text message or a social media message, with a link to a copy of your login page. A customer’s phone has no gateway at all.

  4. Step 4

    The reader acts

    Your customer pays a new bank account, or someone types a password into a copy of your login page.

  5. Step 5

    You hear about it last

    Without monitoring, you first hear from a customer, after the money has gone. The case below shows what we did when a lookalike wrote to one company’s customers.

Case study, mid-2026

Fake invoice domain taken offline

An e-commerce and wholesale company’s name was registered with a product word added, on a domain set up only to send email. Posing as a named salesperson, the sender told the company’s trade customers that payments had moved to a “factoring” company and asked them to reply for the new bank details.

Read the case study
What happened
Offline
  1. Lookalike set up to send email, no website
  2. Same dayOn anti-phishing blocklists, which cut delivery of its emails
  3. Same dayReports to ten places: the email platforms, the reply mailbox, the registrar, the DNS provider and blocklists
  4. LaterThe attacker added another email platform. We reported that too.
  5. The registrar took the domain offline

From the case. Names changed.

What we add to your gateway

Where we look, and what happens when you confirm an attack.

A lookalike given a mail server

Around 500 names per domain, checked every hour. A lookalike needs a mail server before it can write to your customers or suppliers: we flag it when it gets one, and alert you if it looks set up to attack you.

The platforms it sends through

We record which email platforms the lookalike sends through and which mailbox collects the replies. If it adds another platform, we see that too.

The page its emails link to

The link in a fake invoice may open a copy of your login or payment page. We look for that copy by searching the web for your site’s wording, and with the website marker (a small script or a 1×1 image) on your pages, we also hear when a copy loads somewhere else.

When it writes to your customers

Confirm the attack, and one click sends the evidence to up to 12 places. The email platforms it sends through can close its accounts, and the registrar and host can take the domain offline. Blocklists and threat feeds are what your customers’ and suppliers’ own email filters check, so getting it onto them cuts delivery of its emails; browser warning lists and search engines cover any page it links to, and an abuse-report network passes the report on. We chase any that have not acted: the registrar and host at 48 and 96 hours, then the registry, which runs the domain ending, at 120 and 168 hours. Most takedowns take between 2 and 96 hours, depending on the registrar and host involved.

We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back. More on how the product works.

Email gateway and DefendDomain side by side

They do different jobs.

QuestionEmail gatewayDefendDomain
Lookalike senders in your own inboxEmail gateway: Some marked as impersonation or newly registeredDefendDomain: Flagged when registered or set up to send email
Fake websites on a lookalikeEmail gateway: Not seen unless a link to one arrives in your mailDefendDomain: Found through the names, the certificate logs and the website marker
Getting the fake taken downEmail gateway: Not its jobDefendDomain: We get it taken down, and chase the places that do not act

Related pages

Questions about email gateways and lookalike domains

Some gateways warn about lookalike or newly registered sender domains in mail sent to you, and that is where its work and ours meet. Pass those to us: the domain goes on your watch list, ready for a one-click takedown if it is used against you.

That any change of bank details must be confirmed by phone, on a number they already have. That is what the company in our fake-invoice case told its customers.

See the lookalikes your gateway never sees

In a 30-minute demo we show you the lookalikes of your domain that exist today and which can send email.

  • Which lookalikes of your domain exist now, and which can send email
  • Where the evidence goes when you approve a takedown
  • A clear annual price for your domains

Rather see results first? Run a free scan