Skip to main content
DefendDomain
Under attack?

Find the fake domain at the start of the attack

Fake invoices and bank-detail changes sent by email (business email compromise, or BEC) need a web address first. Criminals register a lookalike of your domain, set it up to send email, then use it. We check the lookalikes of your domains every hour, so you hear about each step, and when one is used against you we get it taken down.

Lookalikes set up to send email but with no website are included. There is no page for a host to remove, so most tools never notice them.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day.

Check for lookalike domains

Checks 150+ lookalikes of your domain in a couple of minutes and shows which can send email as you. No account, no card. We email the report to a work address, not Gmail or Outlook.com.

Prefer to talk first? Book a demo

Out of hours, email security@defenddomain.com.

Two places to catch a fake-invoice attack

What we watch

While the fake domain is being set up

Registration, a mail server and a website can each be seen from the outside. We check for them every hour and watch public certificate logs as entries appear.

What most security tools see

When the attack reaches your systems

Email filters, antivirus and other security tools see an attack when it arrives. A fake invoice sent to your customer never reaches them at all, and nobody has to click anything: the customer simply pays.

An example, step by step

What you see, and what we do, from the day a fake domain is registered.

  1. Step 1

    The lookalike is registered

    Someone registers yourcompany-invoices.com. It shows up at our next hourly check and goes on your watch list: a new lookalike, no website, no email yet.

  2. Step 2

    It is set up to send email

    A mail server and sending records are added. Within the hour it is flagged again: this lookalike can now send email as you. With it comes the evidence pack: who registered the domain, where it is hosted and the email records it was given.

  3. Step 3

    You warn people and decide

    You can tell your accounts team and key customers to doubt anything from that address. If it starts sending fake invoices, you confirm it is a live attack and approve with one click.

  4. Step 4

    We report it to up to 12 places

    The registrar, the host, the email provider it sends through, an abuse-report network and the spam blocklists get the evidence at once. For a domain that only sends email, the blocklists are what cut delivery.

  5. Step 5

    We follow up and keep watching

    Automatic follow-ups at 48 and 96 hours, then to the registry at 120 and 168 hours. We tell you when it is offline, or after 30 days if it has stalled, and alert you if it comes back.

What we have seen in real cases

  • In one case we handled, a replacement fake domain was registered and sending fraud emails 28 minutes later.
  • In our fake-invoice case, a lookalike set up only to send email posed as a named salesperson, told a products company's trade customers that payments had moved to a “factoring” company, and asked them to reply for the new bank details.
  • In our pharmaceuticals case, a hacked employee mailbox sent a client fake payment instructions, and the client paid €150,000 into a fraudster's account. The company brought us in afterwards to watch for the lookalike domains and fake payment pages that can follow. Read the pharmaceuticals case study
What happened
Offline
  1. Lookalike set up to send email, no website
  2. Same dayOn anti-phishing blocklists, which cut delivery of its emails
  3. Same dayReports to ten places: the email platforms, the reply mailbox, the registrar, the DNS provider and blocklists
  4. LaterThe attacker added another email platform. We reported that too.
  5. The registrar took the domain offline

From the case. Names changed.

Read the fake-invoice case study

Find out which lookalikes of your domain exist today

The free scan shows which lookalikes of your domain can already send email as you. In the demo we show you what an alert looks like and how a takedown runs.

Run a free scan