03.1
Registrar
Can suspend the domain name, so the address stops working.
Typical pace
Hours to days
Brand impersonation · detection & takedown
Are your customers on a fake site?
Perseus Defend protects banks and consumer brands from impersonation. It finds the fake sites and lookalike domains opened in their name, documents each one with evidence captured at detection, and gets it taken down.
87,141Takedowns in the last 3 months
- Category
- Brand impersonation detection & takedown
- Built for
- Banks, fintech, e-commerce, gaming and telecom brands, worldwide
- Evidence
- Screenshot and registration record, captured at detection
- Filed with
- Registrars, hosting providers, blocklists and authorities
- Export
- PDF · Excel · CSV · JSON
Trusted infrastructure
Why lookalikes
Most fakes aren’t hacked.They’re registered.
Phishing runs on domains bought for the job. Perseus Defend finds them early and gets them taken down.
77%
of the domain names used in phishing were registered by the attacker, not compromised (May 2024 to April 2025).
971,181
phishing attacks observed in Q1 2026, up 13.8% on the previous quarter.
APWG · Phishing Activity Trends Report, Q1 2026(opens in a new tab)
191,561
phishing and spoofing complaints to the FBI in 2025, more than any other crime type.
A takedown request “could take anything between hours to days or even weeks”, says the UK’s National Cyber Security Centre. That is why the evidence has to exist before anyone files.
NCSC · Takedown: removing malicious content to protect your brand(opens in a new tab)
Exhibit 01 · Lookalike check
Type your domain.See it spelled wrong.
Type your domain and see the variants an attacker would try first. Computed in your browser; nothing is sent or stored.
Or try ours:
12 variants generated for perseusdefend.com
- perseu5defend.comhomoglyph · digit
- perseusdefendofficial.comkeyword
- perseusdefend.liveextension swap
- preseusdefend.comletter swap
- prseusdefend.comomission
- perseusd-efend.comhyphenation
- pers3u5defend.comdouble homoglyph
- perseusdsefend.comkeyboard slip
- perrseusdefend.comdoubled letter
- persousdefend.comvowel swap
- pers3usdefend.comhomoglyph · digit
- perseusdefendsecure.comkeyword
Candidates, not findings: none of these was looked up.
12 of 174 variants for perseusdefend.com.
The full scan our analysts run in the panel is much larger: it tries more domain extensions and checks which variants are already registered.
Talk to an analyst about perseusdefend.comExhibit 02 · One case, start to finish
Watch one fake gofrom found to gone.
One lookalike of our demo brand, followed from the moment it is found until it can no longer be reached. The screens are your team’s view of the panel, rebuilt with its own labels.
Every domain sits in one of four states
Threat
A live phishing site. It needs a takedown.
Monitoring
Found and watched: parked, empty or still being checked.
Temporary Takedown
Blocked for now, not yet permanent; we keep at it.
Takedown
Unreachable: blocked, suspended or offline.
“Takedown” means the site can no longer be reached. It does not mean the domain was deleted.
Exhibit 03 · Where a takedown goes
One request.Every party that can act.
Taking a fake down depends on who controls it. You send one request; we file it with each party that can act on it, then keep checking until the fake stays down.
Your takedown request
Takes it down
03.2
Hosting provider
Can take the site’s pages offline.
Typical pace
Hours to days
03.3
Security & network providers
Can put a warning in front of the site and pass the report on to its host.
Typical pace
Their own queue
03.4
Browser & search blocklists
Can warn visitors before the page opens or drop it from search results. They don’t delete the site.
Typical pace
Their own queue
03.5
Authorities
Where the law allows, can have access blocked on their country’s networks.
Typical pace
Their own procedure
03.6
Social platforms
Can remove an account that impersonates your brand.
Typical pace
Each platform’s own queue
Closed · the fake is unreachable
Two clocks.Only one is ours.
Finding, documenting and classifying a fake runs on our clock. Taking it down runs on the clock of whoever hosts or lists it, and nobody can promise their pace.
Our part
Find, document, classify
As soon as it is found
Your decision
The takedown request
Whenever you send it
Their part
The parties that host or list it
Hours to days, sometimes weeks
Time after the fake is found · log scale
- Covered
- Lookalike domains
- Cloned sites
- Redirect chains
- Fake social accounts you point us to
Timings describe typical behaviour, not guarantees: every party works to its own rules and pace. The UK’s NCSC puts takedown at anywhere from hours to days, or even weeks. NCSC
Exhibit 04 · The panel, uncropped
This is the product.Not a mockup.
app.perseusdefend.com / overview
- A pulse line at the top says whether anything needs attention right now.
- One card per status group (Threat, Monitoring, Temporary Takedown, Takedown), each opening the filtered list.
- Recent detections show each domain’s status and whether AI or a person found it.
Exhibit 05 · The film
All data in the film is an anonymised replay.
Music: “Inspired” by Kevin MacLeod (incompetech.com), licensed under CC BY 4.0
Watch a clone get found, documented and filed.
73 seconds in the panel, with anonymised data: the daily overview, the threat list, the screenshot kept as evidence, the takedown request and the case that follows it.
Chapters
Read the transcript
- 00:00
OpeningYour customers may be transacting on a fake copy of your site right now. And before you notice, your brand’s reputation is at risk.
- 00:14
Overview: what is happening today?Perseus Defend finds fake sites opened in your brand’s name, documents them and gets them taken down. The panel is the daily summary: is a threat live, how many domains are in which state. Let’s follow this domain from recent detections.
- 00:29
The threat listEvery record the AI finds sits on one row with brand, detection date and status. Here is the domain we are following.
- 00:38
Evidence: the screenshotThe screenshot taken at detection time is kept as evidence: is it really a copy of your site, at a glance.
- 00:46
The takedown requestThe takedown request comes from a single menu: confirm the domain, add a note, send. Bulk sending is possible too.
- 00:56
Case trackingThe request becomes a case; which channel, when, and what came back, all here in order.
- 01:06
ClosingDetect faster. Take down sooner. Perseus Defend.
Lookalike domains and cloned websites that use your brand, plus the fake social media accounts you point us to, which are added to your panel by URL.
Our part runs as soon as a domain is found: the site is documented with evidence and classified. Once a takedown is filed, the parties that register and host the fake set the pace, usually hours to days.
Every AI verdict is stored with its confidence score and the screenshot taken at detection, so a person can check it. Your own and partner domains go on the Whitelist and are not flagged again. Nothing is filed without a takedown request, and a request can wait for approval before it goes out.
Finding, documenting and classifying are automatic. The takedown request is raised in the panel by your team or by our analysts, and in some setups it is raised automatically. We then file the case with every party that can act on it.
The case doesn’t rest on one party. Where it qualifies, it also goes to the other parties that can block access to the site: security and blocklist providers and the relevant authorities. We keep checking the site until it stays down.
That the site can no longer be reached. It doesn’t necessarily mean the domain was deleted, and we don’t report it that way. If a closed site comes back, it is picked up again.
In your panel, each record keeps the screenshot captured at detection, the registrar, the IP owner, the detection date and the status. Lists export as PDF, CSV, Excel or JSON.
Each client works in its own tenant: your records are visible to your team and to our analysts, not to other clients. Personal data is processed in line with KVKK and GDPR; see our privacy policy for the details.
You talk with one of our analysts. We walk you through the panel and look at your domain together, so you can see how a case would run for your brand.
Dossier
Field notes,dated.
Article · 11 min readAI‑Accelerated Threat: UI Cloning and Brand Safety RiskÖner TekinIncludes a video · 0:55ReadGuide · 12 min readClone Sites: The Hidden Threat in Your Brand's Digital MirrorOrkut GülerReadVideo@PerseusDefendProduct films and panel walkthroughs: subscribe to the channel.YouTubeMethod/how-it-worksHow it works: detection, evidence, takedown.Read
Next case
perseusdefend-giris.com
perseusdefend-giris.com · Takedown
Find the fake. Take it down.
Tell us which brand you need to protect. We’ll walk you through the panel and follow one case from detection to takedown.