Find fake login pages on web addresses like yours
Criminals copy your Microsoft 365 sign-in or your customer login onto a domain such as yourcompany-login.com, then send staff or customers there to collect passwords. We find those domains and copies of your login page, and get the ones used against you taken down. In our consultancy case, a copied site was offline about a day after it was confirmed.
Most fake login pages use a web address that looks right to the person typing their password.
One password is enough for a criminal to read that person’s mail and write to colleagues and customers from a real account. So the aim is to find the fake page before the links go out: a lookalike is flagged when it is registered, and alerted when it looks set up to attack you.
How passwords get stolen, and the part we cover
Credential harvesting means collecting usernames and passwords on a fake login page. Not every fake page uses an address like yours.
Fake login pages we find
Each of these sits on a web address made to look like the real company's.
Who it is for
Usually IT. In a small firm, whoever looks after Microsoft 365.
IT and security
Check reported links without opening them
When staff forward a suspicious login link, you can check its address against your alerts.
Microsoft 365 and identity admins
Find fakes of your sign-in page
You get an alert with the evidence when a fake of your Microsoft 365 or Entra ID sign-in appears on a lookalike domain.
Customer-facing teams
Protect customer accounts
A fake copy of your customer login leads to taken-over accounts and support calls. You can tell customers exactly which address is fake.
Owners and directors
No security team needed
On Pro, one person reads each alert and approves a takedown with one click. On Enterprise, our analysts do it for you.
What your login security does not cover
These all protect your real login. None of them looks for a fake one on an address like yours.
How we find a fake login page and get it taken down
Give us your domains. The first two checks need nothing else.
Step 1
We list lookalikes of your domains
Around 500 per domain, including your name plus words such as -login, -sso or -portal, and other endings such as .co. Each one is re-checked every hour.
Step 2
We watch new certificates
Most fake login pages get a security certificate (the padlock) so they look safe. We watch 100+ public certificate logs as entries appear, for names that look like yours. In our software-group case, the certificate for the copied site was matched within seconds of being logged.
Step 3
We hear when your login page is copied
The website marker (optional) is a small script or a 1×1 image on your login page. If someone copies the page and it loads on another address, it tells us where.
Step 4
You confirm, we report and follow up
One click sends the evidence to up to 12 places at once, including the registrar, the host and browser warning lists, so browsers start warning visitors. We chase them automatically.
What a fake-login alert shows you
The lookalike, a screenshot of the login page, and whether it can also send email. The evidence pack adds who registered the domain, where it is hosted and who handles its email, each with the time it was captured.
No report goes to a registrar, host or blocklist until you confirm it is a live attack and type the domain to approve. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.
Alerts go where your team already works
Every alert is in your DefendDomain dashboard, and we send it to any of these eight places.
Slack
Teams- Webhooks
- SMS
Splunk HEC
Sentinel
Wazuh
What our consultancy case looked like
Case study, mid-2026
Copied website removed in about a day
A company that sells AI solutions and consulting. This is a copied-website case rather than a fake login: the copy sat on a free hosting platform where no domain had been registered, so lookalike monitoring could not see it. No client, prospect or employee was known to have reached it.
Read the case study- A full copy of the site on a free hosting subdomain, with a working padlock
- Found by the certificate logs, a search for its wording and the website marker
- The day it was confirmedOne report with the evidence to the hosting platform
- About 24 hours laterOffline
From the case. Names changed.
Questions IT teams ask
See what we would find for your domains
In a 30-minute demo we show you the lookalikes of your domain that exist today.
- Which lookalikes of your domain exist now, and which show a login page
- What a fake-login alert looks like and who on your side would read it
- A clear annual price for your domains
Rather see results first? Run a free scan