Skip to main content
DefendDomain
Under attack?

Find fake copies of your exchange, wallet or app

Criminals register a web address like yours, such as yourexchange-app.com, copy your site and use it to take logins, seed phrases or funds. We find those domains and copies of your site, and get the ones used against you taken down. In our software-group case, a copy of the group’s website was offline before any customer was known to have used it.

A fake copy already live?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day.

Check for lookalike domains

Checks 150+ lookalikes of your domain in a couple of minutes and shows which are registered. No account, no card. We email the report to a work address, not Gmail or Outlook.com.

Prefer to talk first? Book a demo

Out of hours, email security@defenddomain.com.

Crypto payments cannot be reversed. What you can change is how soon a fake is found and reported.

Speed comes from watching the address before anything is on it. A lookalike is flagged when it is registered and alerted when it looks set up to attack you.

How crypto scams use your name, and the part we cover

A scam that uses your name has to send people somewhere to log in or sign. Not all of those places are a web address like yours.

Not covered

Fake accounts on social channels

Fake support accounts on X, Telegram or Discord that send people to scam links.

We cannot remove accounts or posts. If they link to a lookalike of your domain or a copy of your site, we go after the site.

Not covered

Contracts built to drain wallets

Smart contracts that empty a wallet once someone signs.

Wallet warnings are the defence here.

Where we help

Fake copies of your site

Your site copied onto a lookalike of your domain, or onto any other address.

Reported to its registrar and host, wherever in the world they are.

Crypto fakes we find

Each of these sits on a web address made to look like the real platform's.

  • Fake websites

    Fake copies of crypto platforms

    yourexchange-app.com

    A copy of your exchange or dApp whose connect or claim button leads to the attacker’s contract.

  • Fake logins

    Fake exchange logins

    yourexchange-login.com

    A copy of your login page on a lookalike domain, taking passwords and two-step codes.

  • Fake logins

    Fake logins that relay to the real site

    yourexchange-signin.com

    A page that passes your details to the real exchange as you type, so it can take the session too.

Who it is for

For exchanges and DeFi projects, with or without a security team.

  • Exchange and platform security

    Know when your site is copied

    You hear when a lookalike of your domain shows a copy of your exchange or app, with screenshots and the evidence pack.

  • Founders of smaller projects

    No security team needed

    On Pro, one person reads each alert and approves a takedown with one click. On Enterprise, our analysts do it for you.

  • Community and support teams

    Know which links are fake

    When users ask about a site, you can check it against your alerts and warn your community with the exact address.

  • Compliance and legal

    A record of each fake and what was done

    Each threat keeps its evidence, status and notes from first alert to offline.

What your current defences do not cover

Each of these is worth having. None of them finds a copy of your site on a new web address.

“We warn users in Discord and Telegram”

Keep doing it. A community warning can only go out once someone has spotted the fake; our alert gives you its exact address as soon as it goes live.

Acting before or after an attack

“Wallets warn users before they sign”

They help, and people still click through warnings when a site looks exactly like yours. We report the site to the browser warning lists, which put a red warning screen in front of visitors.

How phishing sites reach people

“We registered similar domains”

Worth doing for the obvious ones. With 240+ domain endings and letters that look the same, nobody can buy them all. We watch the rest, every hour.

Why buying lookalike domains is not enough

“Our smart contracts are audited”

An audit checks your code. A fake site uses the attacker’s contract, so your audit never sees it. We find the site that sends people to that contract, and get it taken down.

How copies of your website are found

How we find a fake platform and get it taken down

Give us your domains. The first two checks need nothing else; the website marker is optional.

Step 1

We list lookalikes of your domains

Around 500 per domain: typos, your name plus a word such as -app, -claim or -wallet, letters that look the same, and endings such as .xyz or .io. Each one is re-checked every hour.

Step 2

We watch new certificates

We watch 100+ public certificate logs as entries appear, for names that contain your brand.

Step 3

We hear when your site is copied

The website marker (optional) is a small script or a 1×1 image on pages you choose. If someone copies your site and it loads on another address, it tells us where.

Step 4

You confirm, we report and follow up

One click sends the evidence to up to 12 places at once, including the registrar, the host and browser warning lists. We chase the ones that do not act.

How the product works

What an alert shows you

The lookalike and a screenshot of the copied site. The evidence pack adds who registered the domain and where it is hosted, each with the time it was captured.

You approve the takedown with one click under the evidence. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

Alerts arrive by email, or in Slack, Microsoft Teams, SMS or a webhook, which can pass the fake’s address to your own bots or blocklists. IT teams can also send them to Splunk, Microsoft Sentinel or Wazuh.

New threat
CriticalExample
yourexchange-app.com

Impersonating yourexchange.com

Copies your app, registered today.

Threat signals

Name built to deceive
Your name plus “app”
Copies your website
Your pages and logo
Certificate issued
Public certificate logs
Take it downThis is ours

What our software-group case looked like

Case study, early 2026

Cloned website taken down

A European software and AI services group, backed by a private equity firm and buying other companies. This is a copied-website case, not a crypto one; a fake exchange site is found the same way.

Read the case study
What happened
Offline
  1. Weeks after an acquisition was announcedIts exact name registered on another ending, with a near-identical copy of the site
  2. Flagged at registration; the certificate was matched within seconds of being logged
  3. One-click takedown: the evidence went to ten places
  4. Offline before any customer was known to use it

From the case. Names changed.

Questions crypto teams ask

Most takedowns take between 2 and 96 hours, depending on the registrar and host involved. If nobody acts, we chase the host and registrar at 48 and 96 hours, then the registry at 120 and 168 hours. In our software-group case, no follow-up was needed.

Yes. It works for anything with a website: exchanges, DeFi front ends, NFT and token claim pages, and wallet sites.

See what we would find for your platform

In a 30-minute demo we show you the lookalikes of your domain that exist today.

  • Which lookalikes of your domain exist now, and which show a website
  • Where the evidence goes when you approve a takedown
  • A clear annual price for your domains

A fake already live? Report a live attack