Skip to main content
DefendDomain
Under attack?

Find the fake sites behind scam texts in your name

A text pretending to be you, about a parcel, a payment or an account, links to a web address like yours, such as yourbrand-delivery.com. We cannot stop the text or remove the number it came from. We find the site it links to and get it taken down.

This works when the fake site uses a lookalike of your domain or copies your website.

Scam texts already going out?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day.

Check for lookalike domains

Checks 150+ lookalikes of your domain in a couple of minutes and shows which are registered. No account, no card. We email the report to a work address, not Gmail or Outlook.com.

Prefer to talk first? Book a demo

Out of hours, email security@defenddomain.com.

In our recruitment-scam case, fake recruiters sent job seekers by SMS and WhatsApp to copies of a software company’s website, and charged a “training fee”.

Each time the company got one fake site removed, new ones appeared.

How scam texts work, and the part we cover

SMS phishing (smishing) sends a text with a link to a fake site. Mobile networks and phone controls catch some of it.

Other defence

Filtering by mobile networks

Mobile networks block some known scam numbers and links.

A new lookalike of your domain is on no list yet.

Other defence

Company phone controls

Device management limits apps and settings on company phones.

It cannot stop someone tapping a link in a text.

Where we help

The site the text links to

A page on a lookalike of your domain, made for phone screens, where only the start of the address shows.

It is where the money or the password goes.

Scam texts we find the sites for

Each of these links to a web address made to look like the real company's.

  • Text messages

    Scam texts that use your name

    yourbrand-delivery.com

    A text about a parcel, a payment or an account, linking to a lookalike of your domain.

  • Fake logins

    Fake login pages

    yourbrand-login.com

    A copy of your login page on a lookalike of your domain, made to work on a phone.

Who it is for

For companies whose customers get texts from them, and whoever looks after their domains.

  • Customer service and marketing

    Know which links are fake

    When customers forward a suspicious text, you can check the address against your alerts.

  • Digital and mobile teams

    Protect the texts you send

    If you send texts to customers, criminals copy them. We watch lookalikes of the domains your texts link to.

  • IT and security

    Check a link without tapping it

    Each alert has the domain, a screenshot of the page, who registered it and where it is hosted.

  • Risk and compliance

    A record of what was found and done

    Each threat keeps its evidence, status and notes from first alert to offline.

What your current defences do not see

Each of these helps. Here is what each one misses, and what we do about it.

“We have an email filter”

It does not see text messages at all. We do not need to see them, because we watch the lookalikes of your domain.

What email filters miss

“We manage company phones”

Most texts are read on personal phones, outside your device management, and your customers’ phones are outside it altogether. We report the scam site to the browser warning lists, which are checked on whichever phone the text lands on.

Beyond endpoint protection

“We registered our sender name for texts”

That helps people trust your real texts. Criminals send from other numbers, and people judge the link, not the sender. So do we: a lookalike of your domain is flagged when it is registered and alerted when it looks set up to attack you.

How phishing sites reach people

“We train staff to spot phishing”

Training helps with email at a desk. A text is read on a phone, in a hurry, with no link to hover over. We alert you when a page made for that moment appears on a lookalike of your domain, with a screenshot to show your staff.

What the padlock really means

How we find the site and get it taken down

Give us your domains, including the ones your own texts link to. The website marker is optional.

Step 1

We list lookalikes of your domains

Around 500 per domain, including your name plus words such as -delivery, -pay or -account, and other endings such as .co. Each one is re-checked every hour.

Step 2

We watch new certificates

Scam texts link to https addresses, because a phone marks a page without a padlock as not secure. Every certificate is published in public logs. We watch 100+ of them as entries appear, for names that look like yours.

Step 3

We hear when your page is copied

The website marker is a small script or a 1×1 image on your login or delivery tracking page. A copy of the page carries it, and when the copy loads on another address the marker tells us which.

Step 4

You confirm, we report and follow up

Once you confirm it is a live attack, one click sends the evidence to up to 12 places, among them the registrar, the host, blocklists and browser warning lists. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

How the product works

What an alert shows you

The lookalike, when it was registered, a screenshot of the page the text links to and its certificate. The evidence pack behind it names who registered the domain and where it is hosted, each with the time we captured it.

A lookalike that is registered or set up to send email is flagged on your watch list; one that looks set up to attack you is alerted, by email, or in Slack, Microsoft Teams, SMS or a webhook. IT teams can also send alerts to Splunk, Microsoft Sentinel or Wazuh.

New threat
CriticalExample
yourbrand-delivery.com

Impersonating yourbrand.com

Copies your delivery tracking page.

Threat signals

Name built to deceive
Your name plus “delivery”
Copies your website
Your tracking page and logo
Has a website
Registered today
Take it downThis is ours

Questions about scam texts

A sent text is beyond reach, but it is only a pointer. The site it opens has a registrar and a host, and they can switch it off; once they do, the link in every copy of that text leads nowhere.

Within the hour, for a site that goes up on a lookalike we already list, and as the public logs publish a certificate for a name like yours.

See what we would find for your domains

A 30-minute demo, on your own domains: the lookalikes that exist today and what we would do about the ones already in use.

  • Which lookalikes of your domain exist now, and which show a website
  • Where the evidence goes when you approve a takedown
  • A clear annual price for your domains

A fake site already live? Report a live attack