The padlock on fake sites

A padlock means the connection to a site is encrypted. It does not say who runs the site. A criminal who registers yourcompany-login.com can get a free certificate for it in minutes, so their fake page shows a padlock too. Every one of those certificates is logged in public, and we match the ones for names like yours as they appear. In our software-group case, the match came within seconds of the certificate being logged.

A common assumption

“Our users know to check for the padlock.”

Browsers stopped showing a site’s owner beside the padlock years ago. The only thing left to check is the address itself, and the lookalike is chosen to pass that check.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.

Check for lookalike domains

Out of hours, email security@defenddomain.com.

What the padlock proves, and what it does not

HTTPS encrypts the connection between a browser and a server. The certificate behind it only proves that whoever asked for it controls that domain name.

What HTTPS does

Encrypts data between the browser and the server
Stops anyone on the network reading or changing it
Proves the server holds a certificate for that domain name

What it does not prove

That the site belongs to the company it claims to be
That the domain is genuine, not a lookalike
That the page is safe to type a password or card number into

We do not ask your users to tell the two apart. When a lookalike of your domain carries a copy of your site, we send the registrar and the host the evidence they need to take it down.

How a fake site gets its padlock

Each step takes minutes, and none of them touches your systems. The first two can be seen from outside, and that is where we look.

Step 1
Register a lookalike
yourcompany-login.com, or the same name with a letter from another alphabet. It costs little and takes minutes.
Step 2
Get a free certificate
A free certificate authority issues one automatically once the criminal shows they control the domain. Nobody checks who they are.
Step 3
Copy your site
Your login page, logo and layout are copied to the lookalike.
Step 4
Send the link
By email, text or social media. The padlock is there and the page looks right.
Step 5
Collect what people type
Passwords and card numbers travel encrypted, all the way to the criminal’s server.

Why the padlock helps the criminal

Nothing on the page warns your users. Once you confirm a fake, browser warning lists put a red screen in front of the next visitor while the registrar and host take it down.

The padlock advice misleads people

“Look for the padlock” teaches people to trust any site that has one, fake sites included.

Phones hide the address

A phone shows the padlock but often only the start of the web address.

No warning screen

An encrypted fake site does not trigger a “not secure” warning, so nothing prompts people to stop and check.

Why certificates help us find fakes

Every certificate a public authority issues is recorded in a public log. We watch 100+ of those logs as entries appear, alongside the domain and the page each certificate belongs to.

A certificate for a name like yours

The log entry appears when the certificate is issued, which can be before the fake site is in use. The alert names the domain and the certificate.

The domain under the padlock

Around 500 lookalikes of your domain, re-checked every hour: whether each is registered, shows a website and has a certificate. A parked one that goes live is caught within the hour.

Your page behind someone else’s padlock

We search the web for your site’s wording. The website marker (optional) tells us the address a copy of your page loads on, whatever name is on its certificate.

The evidence

Screenshots of the fake page beside your real one, who registered the domain and when, where it is hosted and the certificate it is using, each with the time it was captured. That is what a registrar or host asks for before it acts.

One click, up to 12 places

When you confirm the attack, the evidence goes at once to the registrar, the host and the email provider, an abuse-report network, blocklists and threat feeds, browser warning lists and search engines. Places that do not apply are skipped.

Until it is offline

If a company does not act, we chase the registrar and host again at 48 and 96 hours, then the registry, which runs the domain ending, at 120 and 168 hours. Most takedowns take between 2 and 96 hours, depending on the registrar and host involved. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

Case study, early 2026

A copied website offline before any customer was known to have used it

Weeks after an acquisition was announced, someone registered a European software group’s exact name on a different domain ending and put up a near-identical copy of its website. Lookalike monitoring flagged the domain after it was registered, and the certificate for it was matched within seconds of being logged. When the copy went live, the group’s security team was alerted, and one click sent the evidence to ten places that could act on it.

This case used ten places. We can now report to up to 12, depending on the attack.

What happened

Offline

Weeks after an acquisition was announcedIts exact name registered on another ending, with a near-identical copy of the site
Flagged at registration; the certificate was matched within seconds of being logged
One-click takedown: the evidence went to ten places
Offline before any customer was known to use it

From the case. Names changed.

Read the case study

How certificate watching works

Questions about HTTPS and fake sites

No. An EV certificate checks the organisation behind your own site, and the browser shows the same padlock for it as for a free one. A lookalike is a different domain, so it gets its own certificate whatever you buy for yours. We watch for those certificates.

Yes. In our software-group case, the certificate for the copied site was matched within seconds of being logged, and the site was offline before any customer, prospect or employee was known to have used it. In our e-commerce case, six of the first seven fake stores were found by certificate monitoring. A wildcard certificate (*.example.com) hides the full name, which is why the hourly lookalike checks run as well.

See the lookalikes of your domain that have a padlock

In a 30-minute demo we show you the lookalikes of your domain that exist today and which have a certificate.

Which lookalikes of your domain exist now, and which have a certificate
Where the evidence goes when you approve a takedown
A clear annual price for your domains

Rather see results first? Run a free scan

The padlock on fake sites

Already happening?

Check for lookalike domains