Why a new fake domain is on no blocklist yet

Threat feeds and blocklists are good at blocking known bad domains. A domain gets onto them after it has been used and reported. A lookalike of your domain registered this morning is on no list. We re-check lookalikes of your domain every hour, so you do not have to wait for a report, and when one is used against you we report it to the blocklists ourselves. In our fake-invoice case, that was the same day.

A common assumption

“Our threat intelligence feeds block known bad domains.”

Known ones, inside your own network. The lookalike’s emails go to your customers and suppliers, who do not run your feeds.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.

Check for lookalike domains

Out of hours, email security@defenddomain.com.

What threat feeds do well, and where they lag

Feeds collect domains from reports, traps and researchers, then share them. The lag is the time between a domain being used and someone reporting it.

What feeds do well

Block known bad domains and addresses across your tools
Give background on who is behind attacks
Add context to alerts in your SIEM
Let firewalls and proxies block automatically

Where they lag

A lookalike of your domain being registered or set up
Domains used for a few hours and dropped
Which domains are aimed at you in particular

Each alert we send carries the evidence pack: screenshots, who registered the domain and when, where it is hosted and who handles its email. Findings are sorted before they reach you: threats are alerted, doubtful ones go on a watch list and the rest are marked safe.

From registration to blocklist

A feed cannot list the domain until step four. In our software-group case, lookalike monitoring flagged the new domain after it was registered, the certificate for it was matched within seconds of being logged, and the copy was offline before any customer was known to have used it.

Step 1
The lookalike is registered
A letter off your name, or your name with a word added. It costs little and takes minutes.
Step 2
It is set up
A certificate is issued, a page is copied or email records are added.
Step 3
The attack starts
Emails, texts or ads go out to your customers, staff or suppliers.
Step 4
Someone reports it
A recipient, a researcher or a security company reports the domain.
Step 5
It reaches the feeds
The domain is checked and added to lists. Your tools block it from then on.

What we add to your threat feeds

Three things your feeds do not have: our own check of each domain that looks like yours, the evidence to act on it, and the report that puts it onto the lists.

Our own check of each lookalike

Around 500 lookalikes of your domain, re-checked every hour. One that is registered, gets a website or is set up to send email goes on your watch list; one that looks set up to attack you is alerted.

The certificate, from the public logs

Every certificate a public authority issues is logged. We watch 100+ of those logs as entries appear and match the names like yours, which can be before the site is in use.

Reports to the blocklists, and the rest

When you approve a takedown, the evidence goes to the blocklists and threat feeds that security tools check, and to the registrar, the host and the email provider, an abuse-report network, browser warning lists and search engines: up to 12 places. If a company does not act, we chase it at 48 and 96 hours, then the registry at 120 and 168 hours.

We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

Case study, mid-2026

A fake-invoice domain on the blocklists the same day

A lookalike of an e-commerce and wholesale products company’s domain, set up only to send email, told trade customers that payments had moved to a “factoring” company. The same day, the domain was put on major anti-phishing blocklists, which cut delivery of its emails, and reports went to ten places. When the attacker added another email platform, we reported that too. The registrar later took the domain offline.

This case used ten places. We can now report to up to 12, depending on the attack.

Read the case study

What happened

Offline

Lookalike set up to send email, no website
Same dayOn anti-phishing blocklists, which cut delivery of its emails
Same dayReports to ten places: the email platforms, the reply mailbox, the registrar, the DNS provider and blocklists
LaterThe attacker added another email platform. We reported that too.
The registrar took the domain offline

From the case. Names changed.

How the product works

Threat feeds and DefendDomain side by side

Keep your feeds. Three rows where the two differ.

Question	Threat feeds	DefendDomain
What you get	Threat feeds: A list of domains and addresses to block	DefendDomain: An alert with the evidence pack, and a takedown when you approve it
Who it protects	Threat feeds: Your own network, where the feed is applied	DefendDomain: Your customers and suppliers too: once the domain is on the blocklists, spam filters cut delivery of its emails
Getting it into your tools	Threat feeds: Built for it	DefendDomain: Alerts by webhook, or into Splunk, Microsoft Sentinel or Wazuh

Questions about threat feeds and lookalike domains

No. Keep them for known bad domains across the internet. We add the lookalikes of your own domains, and when you approve a takedown, the domain goes to the blocklists and threat feeds that security tools check.

We cannot give a figure, because it depends on when a feed would have listed the domain. What we can say is when our alert comes: at the next check after the lookalike is registered or set up, and as the log entry appears for its certificate. In our fake-invoice case, the domain was on anti-phishing blocklists the same day.

See the lookalikes of your domain that no feed lists yet

In a 30-minute demo we show you the lookalikes of your domain that exist today and how alerts reach your tools.

Which lookalikes of your domain exist now, and which can send email
How alerts reach your SIEM or other tools
A clear annual price for your domains

Rather see results first? Run a free scan

Why a new fake domain is on no blocklist yet

Already happening?

Check for lookalike domains