What endpoint protection does not cover

EDR and antivirus protect the devices you manage. Your customers, partners and contractors, and staff on personal devices, have none of your agents. If someone copies your download page onto a lookalike domain, only your own devices are covered. We find the fake site and get it taken down, whichever devices its visitors use.

A common assumption

“We have EDR on every company device, so malware downloads are blocked.”

On company devices, many are, once the file is downloaded. The page that offered it stays online for the next visitor.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.

Check for lookalike domains

Out of hours, email security@defenddomain.com.

What EDR protects, and where it stops

EDR and antivirus act on a device after a file arrives. A fake download site is a web address, and that is where we act.

What EDR does well

Detects and blocks known malware on managed devices
Watches processes and memory for unusual behaviour
Gives your team evidence for incident response
Quarantines bad files after they arrive

What it does not reach

Your customers’ devices
Partners and contractors on their own laptops
Fake download sites on lookalikes of your domain
A lookalike being set up, before anything is downloaded

How a fake download site works

The criminal needs a web address like yours, a file and a way to bring people to it. The web address is the part we can find, and every step below depends on it.

Step 1
Copy your download page
The criminal copies your software download page onto a lookalike of your domain.
Step 2
Swap the installer
The page offers a fake installer, or your real software bundled with malware.
Step 3
Bring people to it
Through search ads, social media, forum posts or email. Someone searching for your software can find the fake first.
Step 4
Someone installs it
The installer runs, and the malware starts collecting the passwords saved on that device.
Step 5
Log in with the stolen passwords
If one of them opens your systems, the criminal logs in as that person. EDR may see that step, but not the fake site where it started.

What we watch for

We look for a fake download site in three places, and any one is enough to find it.

Names with -download or -update

Around 500 lookalikes per domain, checked every hour. One that is registered or gets a website is flagged; one that looks set up to attack you raises an alert, with screenshots, who registered it and where it is hosted already gathered.

Your download page, copied

The website marker (optional, a small script or a 1×1 image) on your download page tells us when a copy loads somewhere else, and we search the web for your page’s wording.

A padlock for the fake

Most fake download pages get a padlock so they look safe, and every certificate is logged in public. We watch 100+ certificate logs as entries appear.

Once you confirm the fake site

One click sends the evidence to up to 12 places: the registrar, the host, the email provider if it sends mail, an abuse-report network, blocklists and threat feeds (the malware feeds among them), browser warning lists and search engines. The warning lists put a red screen in front of visitors while the registrar and host act. If the registrar or host has not acted, we chase them at 48 and 96 hours, then go to the registry, which runs the domain ending, at 120 and 168 hours. Most takedowns take between 2 and 96 hours, depending on the registrar and host involved.

We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back. More on how we handle fake downloads.

Case study, mid-2026

Copied website removed in about a day

We have no malware case to show yet; this copied website was found by the same checks. A full copy of an AI consultancy’s website appeared on a subdomain of a free hosting platform, with a valid padlock. No domain was registered, so there was no lookalike domain to find.

Read the case study

What happened

Offline

A full copy of the site on a free hosting subdomain, with a working padlock
Found by the certificate logs, a search for its wording and the website marker
The day it was confirmedOne report with the evidence to the hosting platform
About 24 hours laterOffline

From the case. Names changed.

EDR and DefendDomain side by side

They act in different places.

Question	EDR and antivirus	DefendDomain
A customer’s laptop	EDR and antivirus: Not covered	DefendDomain: Not covered either: we watch the site it downloads from
Fake download sites	EDR and antivirus: Not seen until a file arrives	DefendDomain: Found through the names, the certificate logs and the website marker
When it acts	EDR and antivirus: After a file reaches a device	DefendDomain: When a lookalike is registered or gets a website (checked every hour)
Getting the fake taken down	EDR and antivirus: Not its job	DefendDomain: We get it taken down, and chase the places that do not act

Questions about endpoint protection and fake sites

No, but the two work together: if EDR catches a fake copy of your installer, report the web address it came from to us.

Not the ads themselves, which we cannot see or remove, but the site an ad leads to, if it is a lookalike of your domain or a copy of your site. It is the same with messages: in our recruitment-scam case we cannot remove the SMS or WhatsApp messages themselves, so we go after the fake websites they point to.

See the lookalikes of your domain that exist today

In a 30-minute demo we show you the lookalikes of your domain and which show a website.

Which lookalikes of your domain exist now, and which show a website
How the website marker goes on your download page, if you want it
A clear annual price for your domains

Rather see results first? Run a free scan

What endpoint protection does not cover

Already happening?

Check for lookalike domains