Catch domains impersonating your brand the hour they go live
We watch Certificate Transparency logs and multiple threat feeds around the clock, match them against your registered brand, keep re-checking suspected lookalikes, preserve evidence, draft takedown notices and track the outcome.
What we cover
Lookalike domains
Brand-term containment, typosquatting (insertion, deletion, substitution, adjacent keys), homoglyphs and IDN/punycode, and brand terms combined with high-risk words such as login, verify or secure.
Phishing pages
Matched domains enter tiered re-scanning so we catch the moment a parked domain starts serving content. Brand name plus a credential or payment form is rated high confidence.
Impersonating ads
We search the Meta Ad Library by brand name. Advertiser pages carrying your brand name that are not on your official-page allowlist, with a non-official landing domain, are flagged as suspected impersonation.
How it works
- Register your brand —— Brand names, local-language spellings, official domains, official social pages and partner allowlists. The allowlist matters: without it your own assets get flagged.
- Continuous monitoring —— Real-time matching against Certificate Transparency plus several threat feeds. Matches are re-scanned on a tiered schedule from 8 hours to 7 days depending on age.
- Evidence capture —— Page screenshot, HTML snapshot with its SHA-256, first-seen timestamp, registrar and registration date, IP, ASN, hosting provider and whether it sits behind a CDN.
- Takedown and tracking —— Notices drafted per channel — registrar, host, CDN, platform — with evidence links and your authorisation letter. After sending we keep checking: offline updates the status, back online is flagged as a revival and alerts you.
- Monthly report —— New findings, takedowns, mean time to takedown, revivals, and the distribution across hosting providers and registrars.
On wording
What we publish are assessments of suspected impersonation, risk scores and verifiable evidence — never legal conclusions about any party. Public pages name no specific domains and carry no personal data. Anyone flagged can contest the assessment through our appeals form and a human reviews it.