What you can do before an impersonation attack starts

Incident response, cyber insurance and crisis PR help once something has gone wrong. None of them looks for the fake domain while a criminal is setting it up, so we re-check lookalikes of your domain every hour, and when one is used against you we get it taken down. In our software-group case, the copy was offline before any customer was known to have used it.

A common assumption

“We have an incident response team, a PR firm and cyber insurance, so we are covered.”

Each of them starts when you call it, and most are paid for per incident. Watching for the fake domain is a fixed annual cost, priced by the number of domains.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.

Check for lookalike domains

Out of hours, email security@defenddomain.com.

What incident response, insurance and PR cover

They are worth having, and they all start once an incident is known.

What they do well

Incident response contains and cleans up an attack
Cyber insurance pays for some of the direct losses
A PR firm handles what you say in public
Lawyers can go after the people behind it

What they cannot do

Tell you a lookalike can now send email as you
Get money back once it has been moved on
Get a fake domain onto blocklists and browser warning lists

Keep all of them. When we alert you, the evidence your incident response team would otherwise spend its first hours gathering is already in the alert: screenshots, who registered the domain and when, where it is hosted and who handles its email.

How an impersonation attack unfolds

We flag the fake domain at step one, and alert you when it looks set up to attack you.

Step 1
The fake domain is set up
A lookalike is registered and set up to send email or given a website.
Step 2
The first emails or links go out
Customers, staff or suppliers start receiving them.
Step 3
Someone is fooled
A payment goes to the wrong account, or a password is typed into a fake page.
Step 4
Someone notices
A customer asks about a payment, or an employee reports a strange email. Incident response starts here.
Step 5
Clean-up
Investigation, calls to customers, reports to the police and the bank. The fake domain still needs reporting to the companies that can switch it off.

What we add before an incident

We watch for the fake domain, gather the evidence, and when you confirm it is being used against you, send the takedown and chase it.

The fake domain, as it is set up

Around 500 lookalikes of your domain, re-checked every hour. One that is registered, gets a website or is set up to send email goes on your watch list; one that looks set up to attack you is alerted, with screenshots, who registered it and where it is hosted.

Its certificate, as it is issued

A fake site needs a certificate before a browser shows a padlock, and every one is logged in public. We match the entries for names like yours as they appear.

The takedown, and the chasing

When you confirm a live attack, one click sends the evidence to up to 12 places: the registrar, host and email provider, an abuse-report network, blocklists and threat feeds, browser warning lists and search engines. If a company does not act, we chase it at 48 and 96 hours, then the registry at 120 and 168 hours.

We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

How takedowns work

Responding after an attack, and watching before one

One of our cases from each side.

Responding after: our pharmaceuticals case

A €150,000 loss, then monitoring

In early 2023, before DefendDomain existed, attackers broke into an employee’s email account at a specialty pharmaceutical company and used it to write to a client about a pending payment. They sent the client to a website with fake payment instructions, and the client paid €150,000 into a bank account opened under a false name. The company later brought in DefendDomain to watch for lookalikes of its web addresses and for fake payment-instruction sites. We do not protect a real mailbox that has been broken into; we cover the fake domains and websites that can come with this kind of attack.

Read the case study

Watching before: our software-group case

A copied website offline before any customer was known to have used it

Weeks after an acquisition was announced, someone registered a European software group’s exact name on a different domain ending and put up a near-identical copy of its website. Lookalike monitoring flagged the domain after it was registered. When the copy went live, the group’s security team was alerted and one click sent the evidence to ten places. No follow-up was needed.

What happened

Offline

Weeks after an acquisition was announcedIts exact name registered on another ending, with a near-identical copy of the site
Flagged at registration; the certificate was matched within seconds of being logged
One-click takedown: the evidence went to ten places
Offline before any customer was known to use it

From the case. Names changed.

Read the case study

Questions about acting earlier

Findings are sorted automatically: threats are alerted, doubtful ones go on a watch list and the rest are marked safe. On Enterprise, our analysts check every alert for you.

Keep them. Alerts can go into Splunk, Microsoft Sentinel or Wazuh, or by webhook, so the team works from its own tools, and the takedown reports, the chasing and the hourly check that the site is still up are done for them.

See which lookalikes of your domain exist today

In a 30-minute demo we show you the lookalikes of your domain and which can send email.

Which lookalikes of your domain exist now, and which can send email
What an alert looks like and who on your side would read it
A clear annual price for your domains

Rather see results first? Run a free scan

What you can do before an impersonation attack starts

Already happening?

Check for lookalike domains