Protect · Brand & fraud
Find the fake login page. Block it, take it down, and know how long it took.
Lookalike domains in the scripts your customers read, fake apps in the stores, scam numbers and mule accounts your customers report, each one a candidate until the evidence or an analyst confirms it. Then it reaches your blocklists, your customers’ warning page and the registrar’s inbox, with the clock running.
Lookalike domains
Generate, discover, read, confirm, act. With a floor, not a firehose.
01
Generate
Typosquats, combosquats, homoglyphs, diacritics and ccTLD swaps for every monitored brand, computed on the registrable domain.
02
Discover
Certificate transparency, ICANN zone files (CZDS), RDAP or WHOIS age and DNS surface the registrations nobody generated.
03
Read the page
Screenshot, credential form, clone-of-your-login match and a read of what the page says it is, so a parked or unrelated business is told apart from an impersonation.
04
Confirm
A candidate becomes confirmed on the page read or an analyst’s decision. Never on a single weak signal.
05
Act
Confirmed lookalikes reach your blocklists, the brand feed and the public alerts page, and a takedown with evidence is one click away.
Generation & discovery
The names an attacker would register, in the scripts your customers read.
typosquat · combosquat
Typos and add-ons
Omissions, swaps, keyboard neighbours and the words fraudsters bolt on (login, secure, verify, app, on a list you can extend), resolved on a schedule so a parked domain that goes live is noticed the day it does.
а · е · о · р · ο · ν
Cyrillic and Greek homoglyphs
Characters that render like Latin letters, generated as IDN and checked like any other name.
č ć š ž đ
Latin diacritics
The letters of the region’s languages, plus the common accented vowels: the domain your customer would not spot on a phone screen.
.me · .co.me · .rs · .ba · .hr · .si · .mk · .al · .eu
ccTLD swaps that understand suffixes
Swaps across the region’s country codes, computed against a mirrored Public Suffix List, so .co.me is treated as a suffix and not as your brand.
.срб · .мкд
Cyrillic IDN
For a brand with Cyrillic keywords, the full Cyrillic name is generated for the Cyrillic country-code domains.
crt.sh · CZDS
Certificate transparency and zone files
A certificate or a new registration for a name like yours is an early signal, often days before content appears.
RDAP · WHOIS
Registration age, even where RDAP is missing
Several Balkan registries publish no RDAP service; a minimal WHOIS reader fills in the creation date and abuse address, and fails open to “unknown age”.
surfacing floor
Precision is a setting
The minimum confidence to surface a lookalike is yours to set: down for a launch week, up for a quiet quarter. Below it, candidates wait rather than alert.
Page analysis
What the page is, not only what the name looks like.
screenshot · form
Screenshot and credential form
Live pages are rendered and captured; a password field on a two-day-old domain carries more weight than a string match.
clone match
Clone of your login
Your own login page is the reference: a copy of its structure on someone else’s host is the strongest single signal there is.
content read
Parked and unrelated sites, recognised
The title, description, headings and footer say what a site claims to be. A real, unrelated business that shares your letters gets a proposed Benign with the reason. Proposed, never closed on its own.
kit fingerprint
Kits linked across copies
The same phishing kit on five domains is one campaign, not five unrelated alerts.
AI provider · optional
Visual comparison where configured
Comparison against your logo runs when an image-capable AI provider is configured. With AI off, the structural signals above still work.
disposition
Every verdict has a reason
Proposed dispositions show their factors on the indicator page. The analyst’s decision is recorded on the indicator with its author.
Page canary
Your login page tells you when it is being served from somewhere else.
Reverse-proxy kits (adversary-in-the-middle) serve your real login page through their own host, so a lookalike scan sees nothing unusual. A small script on your e-banking login page fires only when the page renders off your domain. Legitimate hosts are embedded as hashes, so a kit that rewrites your hostname cannot rewrite the check. A render on your own domain is discarded before anything is stored: no record for legitimate visitors, no cookie, and the client address truncated.
- rendered on
- ebanka-prijava.example
- first seen
- 06:41 · 37 renders since
- client
- 203.0.113.0/24 (truncated, never whole)
- state
- candidate → confirmed · page read: clone of your login
Financial indicators
Fraud infrastructure is more than a domain.
Seven indicator types for the things a scam actually runs on, validated on the way in so a typo never becomes a block. They travel through the same blocklists, STIX and MISP exports as every other indicator, and an IBAN or phone number can be checked from your payment pipeline.
| type | validated as |
|---|---|
| iban | ISO 13616, mod-97 checked |
| bic | ISO 9362, 8 or 11 characters |
| card-bin | 6-8 digits; longer is refused |
| phone-number | E.164 |
| sms-sender-id | 1-11 alphanumeric, or E.164 |
| app-package | Android package or iOS bundle id, optional signer |
| social-handle | platform:handle, closed platform list |
A full card number is refused at every entry point. The payee-risk lookup answers your payment system by IBAN or phone.
Beyond the web
Fake apps, scam reports and your own social channels.
Apple App Store · Aptoide
Fake apps in the stores
Listings that carry your brand under a developer that is not yours are filed as candidates; an icon match against your logo with a foreign developer confirms them. The package is never downloaded or run; only the store’s published metadata is read.
report-a-scam
A channel for your customers
A public form and a mailbox where customers report the link, number, sender, account or IBAN that targeted them. Each item is a candidate; the same link a scan already confirmed reads as malicious in seconds.
QR
QR codes, decoded without the image
On the form, the QR code is decoded in the customer’s browser and only its content is sent; no screenshot ever leaves their phone. Images sent to the mailbox are decoded on arrival.
3 reporters · 14 days
Confirmed by more than one voice
A phone number, sender ID, social handle or IBAN is confirmed only when three distinct reporters name it within 14 days, or an analyst does. One stranger’s word never reaches a blocklist.
privacy
Nothing about the reporter
No name or e-mail field; a mailbox sender is kept only as a short hash, a form address only as a /24. Proof-of-work stands in for a third-party CAPTCHA, so no vendor sees your customer first.
Telegram · YouTube
Social watch lists
Your own Telegram and YouTube handles are checked daily for a change of title, image or identity (the sign of a takeover). Public Telegram channels an analyst names are read for links and numbers that mention your brand. No logins, no crawling.
Takedowns
Sent by the platform when the analyst says so. Then measured.
The notice is drafted from the evidence on file and sent from the case with one click. Nothing sends a first notice automatically, and nothing closes a takedown by itself.
A hashed evidence pack
Screenshot, page extract, certificate-transparency entries, RDAP record, DNS resolution and HTTP response, zipped and hashed once, so every reminder and escalation carries identical bytes.
Replies threaded, reminders opt-in
Replies to the notice attach to the request. Reminders follow after 48 hours of silence only if the sender armed them.
An escalation ladder, drafted
Registrar → hosting provider → ccTLD registry → national CERT. Each rung is drafted when the previous one goes quiet, and each send is still a click.
Blocklist reporting in the same pass
Netcraft through its API; Google Safe Browsing, Microsoft SmartScreen and PhishTank through pre-filled report forms. A fake app’s takedown starts at the store.
Time-to-takedown
Median and 90th percentile, per provider and per month, from first send to the target going down. Verification proposes completion; the analyst closes.
| provider | sent | median | p90 |
|---|---|---|---|
| registrar-a.example | 14 | 19 | 41 |
| registrar-b.example | 9 | 27 | 70 |
| host-c.example | 6 | 11 | 30 |
| registry .me | 3 | 52 | 96 |
Confirmed feed & public alerts
What you confirmed protects your stack and warns your customers.
Each brand has its own confirmed feed, in the blocklist formats your mail gateway, web proxy, resolver and fraud engine already read, and as a TAXII collection and MISP feed. A brand that opts in also gets a public fraud-alerts page in English and Montenegrin: confirmed fake sites, fake apps and scam numbers with their state, a line on how to recognise the real site, and the link to report a scam. Never a screenshot, an analyst’s name or an IBAN.
Prava stranica: ebank.banka-primjer.example
- Lažna stranica · ebanka-prijava.exampleaktivno
- Lažna aplikacija · App Storeuklonjeno
- SMS pošiljalac · BANKA-INFOaktivno
Prijavi prevaru · Report a scam
Exposure monitoring
Leaked credentials and secrets, handled as what they are.
Breached accounts on your domains from Have I Been Pwned; stealer-log captures against your e-banking host (your customers) and your mail domain (your staff), which needs an HIBP Pro subscription and a verified domain; ransomware leak-site posts naming your brands or clients; and secrets pushed to public GitHub code beside your identifiers. All of it is masked, TLP:RED and visible to admins only.
- j••••.d••@banka-primjer.exampleHIBP · breach 2026-08
- sha256:4be1…9c07stealer log · ebank host
- AKIA••••••••••••••Q7public GitHub code · High
- Leak-site post naming a clientaggregator · 3 days ago
Leaked secrets in public code
The key a contractor pushed to a public repository.
GitHub code search
Your identifiers, searched
Your domains, mail domains and the internal project names you choose are searched in public GitHub code, newest first; your own open-source repositories can be allowlisted.
22 patterns
Classified by a cited catalogue
Cloud keys, tokens, connection strings, private keys and generic passwords, each pattern citing its published source. Severity rises with proximity to your identifier.
masked · hashed
Never tested, never minted
The secret is stored masked and hashed with a short redacted excerpt; it is never tried against the provider, never becomes an indicator, and the committer is never contacted by the platform.
secret-scanning alerts
Your own organisation, mirrored
With an organisation token, GitHub’s secret-scanning alerts for your repositories appear beside the public findings. Resolution stays in GitHub.
How the modules work together
One fake login page, from certificate to closed takedown.
Each step below is a different part of the platform. None of them needs a second tool, and every hand-off is recorded on the case.
01 · Certificate transparency
A certificate is issued for a name one homoglyph away from your e-banking host. The name becomes a candidate the same day, often before any content exists.
02 · Page analysis · page canary
When the page goes live it is screenshotted and read: a credential form, your login’s structure. If it is a reverse proxy of your real page, your own login page reports where it was rendered.
03 · Analyst confirms
The evidence is on the indicator page. One decision marks it a true positive; nothing was closed or confirmed without it.
04 · Blocked where your users are
The domain enters the brand’s confirmed feed and your blocklists: firewall, proxy, mail gateway, DNS RPZ and, through Android Private DNS, staff phones.
05 · Takedown with evidence
The notice goes to the registrar’s abuse contact with a hashed evidence pack and can be reported to Netcraft from the same screen, with reminders and the next rung drafted if nobody answers.
06 · Reports join the case
Staff who report a mail carrying the same link from Outlook are matched to the confirmed indicator and join the same case, with a verdict and its reason shown in their pane.
07 · Measured
When the target goes down the takedown proposes completion, the analyst closes it, and time-to-takedown appears in the monthly figures and the management-body report.
Stated plainly
What it does not do.
No automatic takedowns
No job, rule or playbook sends a first notice or closes a takedown. A playbook can open a draft; a person sends it.
Not every store, not every network
Apps are read from the Apple App Store and Aptoide. Stores and social networks that serve search only to a logged-in browser are not scraped; customers report what reached them instead.
No card numbers, no binaries
A full card number is refused everywhere. App packages are never downloaded, run or detonated.
No live-testing of secrets
A leaked key is never exercised to see whether it works; rotation guidance and links are given to the analyst.
Give us one brand.
We will show the generated candidates, the certificate-transparency hits and the page reads, and where the floor should sit for you. Brand Protection is in the Standard package and above, or licensed on its own.