Find fake download pages that use your name

Criminals register a web address like yours, such as yourapp-download.com, and offer a fake installer or update that carries malware. We find those domains and get the ones used against you taken down.

We do not scan files or stop malware on a device, which is your endpoint security’s job; we go after the site that hands the file out.

Fake download page already live?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day. Out of hours, email security@defenddomain.com.

Check for lookalike domains

Prefer to talk first? Book a demo

Out of hours, email security@defenddomain.com.

A fake download page is caught by its address, not by the file it serves.

So it can be found before the file has been seen anywhere: a lookalike is flagged when it is registered, whether or not anything is on it yet, and alerted when it looks set up to attack you.

How malware reaches people, and the part we cover

Malware reaches people in several ways. One of them runs on a web address made to look like yours.

Not covered

Infected email attachments

Files with malware sent straight to your staff.

Your email filter and endpoint security are the defence here.

Not covered

Unpatched systems

Attacks on software weaknesses inside your own network.

Patching handles this.

Where we help

Fake download and update pages

A copy of your download, update or support page on a lookalike of your domain, with the installer swapped for one that carries malware.

Covered whoever it is aimed at, staff or customers.

Fake download sites we find

Each of these sits on a web address made to look like the real company's.

Fake downloads
Fake software downloads
yourapp-download.com
Reached from a search result or an ad for your product’s name, with a page that looks like yours and an installer that is not.
Fake websites
Fake support pages
yourapp-support.com
A copy of your help page that asks people to install remote-access software.

Who it is for

For IT and security teams, and for companies whose customers download their software. Our software-group case is about a software company’s copied website.

IT and security
Know when a fake download site appears
You hear when a lookalike of your domain shows a website, with screenshots and hosting details.
Software and product teams
Protect people who download your software
If someone copies your download page onto a lookalike domain, we find it and get it taken down.
SOC and incident response
Addresses to block while the takedown runs
Each alert has the domain and where it is hosted, so you can block it on your own network.
Risk and compliance
A record of what was found and done
Each threat keeps its evidence, status and notes from first alert to offline.

What your malware defences do not see

Keep all of these. Each stops at the edge of your own devices and network.

“We have endpoint protection”

It protects your own devices once a file arrives. Customers and partners who download from a fake site are outside it. We get the fake site taken down, for the people your endpoint tools cannot reach.

Beyond endpoint protection

“We block bad web addresses at the firewall”

Blocklists add a domain after someone reports it. A new lookalike of your domain is on no list yet. We alert you to it first, and report it to the blocklists and threat feeds your firewall reads.

Blocklist and threat feed delays

“Staff know not to download from unknown sites”

A site with your name and a padlock does not feel unknown. We report it to the browser warning lists, so the browser shows a red warning before the page loads, and to the registrar and host, which take it down.

What the padlock really means

“We control what gets installed on company devices”

That covers managed devices. It does not cover customers, contractors, or personal phones and laptops. We cover the site they would download from.

How fake sites reach people

How we find a fake download site and get it taken down

Give us your domains. The first two checks need nothing else; the website marker is optional.

Step 1

We list lookalikes of your domains

Around 500 per domain, including your name plus words such as -download, -update or -support, and other endings such as .co or .app. Each one is re-checked every hour.

Step 2

We watch new certificates

A page needs a security certificate before a browser shows the padlock, and every new certificate is logged in public. We match those for names like yours as they are issued; in our software-group case, within seconds of the certificate being logged.

Step 3

We hear when your page is copied

The website marker (optional) is a small script or a 1×1 image on your download page. If someone copies the page and it loads on another address, it tells us where.

Step 4

You confirm, we report and follow up

One click sends the evidence to up to 12 places at once, including the registrar, the host, browser warning lists and, when malware is involved, malware feeds. We chase the ones that do not act.

How the product works

What an alert shows you

The lookalike, a screenshot of the page and its certificate. The evidence pack adds who registered the domain, where it is hosted and who handles its email, each with the time it was captured.

Two buttons sit under the evidence: take it down, or mark it as yours. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

New threat

CriticalExample

yourapp-download.com

Impersonating yourapp.com

Offers a download that uses your name.

Threat signals

Name built to deceive: Your name plus “download”
Has a website: Registered today
Certificate issued: Public certificate logs

Take it downThis is ours

Alerts go where your team already works

Every alert is in your DefendDomain dashboard, and we send it to any of these eight places.

Email
Slack
Teams
Webhooks
SMS
Splunk HEC
Sentinel
Wazuh

What our software-group case looked like

Case study, early 2026

Cloned website taken down

A European software and AI services group, backed by a private equity firm and buying other companies. This is a copied-website case, not a malware one; a fake download page on a lookalike is found the same way. No follow-up was needed after the takedown.

Read the case study

What happened

Offline

Weeks after an acquisition was announcedIts exact name registered on another ending, with a near-identical copy of the site
Flagged at registration; the certificate was matched within seconds of being logged
One-click takedown: the evidence went to ten places
Offline before any customer was known to use it

From the case. Names changed.

Questions security teams ask

No. When malware is involved, the report also goes to the malware feeds that security tools check.

Most takedowns take between 2 and 96 hours, depending on the registrar and host involved. If nobody acts, we chase the host and registrar at 48 and 96 hours, then the registry at 120 and 168 hours. In our consultancy case, a copied website was offline about 24 hours after it was confirmed.

See what we would find for your domains

In a 30-minute demo we show you the lookalikes of your domain that exist today.

Which lookalikes of your domain exist now, and which show a website
Where the evidence goes when you approve a takedown
A clear annual price for your domains

A fake download site already live? Report a live attack