Threat detection

Hear it from us before your customers do.

We read threat sources and certificate logs, match what they report to your brands, and send you one alert, with the reason, when something clears assessment.

Scan your domain Book a demo
Illustrative Fictional brand, example domains
acme-secure-login.example High Found by an hourly certificate check
Certificate
Issued 36 hours ago
Hosting
Web server live, mail (MX) records present
Name
Your brand plus words a login page would use
Automated assessment

A certificate was issued 36 hours ago for a domain that combines your brand name with words a real login page would use. It now has a live web server and mail records, so it can serve a page and handle mail. Suggested next step: draft a takedown.

threats tracked
1.2M+
hosting providers mapped
12,000+

How we count each number

Threat sources

Phishing and malware URLs, matched to your brand.

We read 40+ sources. When one names a domain or URL that matches your brand, it becomes a record that is checked and scored before anyone is alerted.

  • Phishing URLs

    Live phishing pages reported by phishing intelligence sources, matched to your domains and your brand name.

  • Malware URLs

    Malicious payload hosts and download infrastructure from malware URL lists, checked against the same brand matching.

  • One record, then one alert

    Repeat reports from a source are collapsed into one record. Anything that clears assessment reaches you with a plain-language reason.

Certificates

Certificates, checked every hour.

Every hour we check certificate-transparency logs for certificates issued to names that look like your brands. A new certificate often appears before the site does. Lookalike domains themselves are covered on their own page.

Illustrative Fictional brand, example domains
acme-login.example New cert Certificate issued 2 hours ago

Registrations, character swaps and brand-plus-word domains: see lookalike domain monitoring.

Dark web · Business and above

Paste sites and ransomware victim lists.

We check public paste sites and ransomware leak-site victim lists for your brand and domains, so an early sign of a targeted attack reaches you as an alert.

Illustrative Fictional brand, example domains
Paste mentioning acme.example New Found on a public paste site
Acme Co on a ransomware victim list New Listed on a leak site

These two source types only. We don't cover leaked credentials, closed forums or marketplaces.

Fewer false alarms

Assessed before you hear about it.

Matching a name is not the same as a threat. Findings are scored on signs of real intent, and low-value noise is dismissed automatically.

  • Your own domains are set aside

    Your official domains are recognised automatically. Tell us your CDNs and partners and we exclude them too.

  • Scored on intent

    A parked page and a live login page are not treated the same, and the alert says why it was raised.

  • You decide what happens next

    Takedowns are drafted and wait for your approval, or are filed under your signed rules. Nothing goes out outside them.

Scope

What's covered, and what isn't.

Every claim on this page has a limit. These are the limits.

Threat detection: covered and not covered
Area Covered Not covered
Phishing and malware URLs Reports from phishing intelligence sources and malware URL lists, matched to your domains and brand. Attacks that never appear in a source we read, and the source names themselves.
Repeat reports Repeat reports from a source are collapsed into one record. Merging the same URL reported by different sources into a single alert.
Certificates Certificate-transparency checks every hour, for your brands. Alerts the moment a certificate is issued, and brands you haven't added.
Paste sites and ransomware lists Mentions of your brand and domains on public paste sites and on ransomware victim lists. Leaked credentials, closed forums and marketplaces, and mentions of executives.
Your own domains Tell us your official domains, CDNs and partners and we exclude them. Self-serve allow-listing in the console. Our team adds them for you.

Phishing and malware URLs
Covered
Reports from phishing intelligence sources and malware URL lists, matched to your domains and brand.
Not covered
Attacks that never appear in a source we read, and the source names themselves.

Repeat reports
Covered
Repeat reports from a source are collapsed into one record.
Not covered
Merging the same URL reported by different sources into a single alert.

Certificates
Covered
Certificate-transparency checks every hour, for your brands.
Not covered
Alerts the moment a certificate is issued, and brands you haven't added.

Paste sites and ransomware lists
Covered
Mentions of your brand and domains on public paste sites and on ransomware victim lists.
Not covered
Leaked credentials, closed forums and marketplaces, and mentions of executives.

Your own domains
Covered
Tell us your official domains, CDNs and partners and we exclude them.
Not covered
Self-serve allow-listing in the console. Our team adds them for you.
Related

From detection to action

See what's already targeting your brand.

Run a free domain scan, no signup. Or book a demo and we'll walk through your brands.

Scan your domain Book a demo