Campaigns
Deal with them together.
Lookalikes run by the same people are grouped into one campaign, so you can see the whole operation instead of chasing addresses one at a time.
Find the fake websites using your name. And get them taken down.
Brand protection finds web addresses made to look like yours, such as acme-payro11.com. It shows which can receive email or host a fake sign-in page, and drafts takedown emails for you to send.
Coverage
What do we look for? Twelve things, always watching.
Add a domain and we keep watching for addresses that imitate it, then look closely at every one we find. Here is everything brand protection records.
Typos
Addresses one slip of the keyboard away from yours, such as acmme.co.uk.
Swapped and lookalike characters
An "rn" that reads as "m", a "1" in place of an "l", or a dot turned into a hyphen.
Added words
Your name with a word bolted on, such as acme-payroll or acme-login.
Registered, and what changes
Whether each lookalike is registered, and how it changes over time.
Can receive email
Lookalikes with mail servers set up, so mail sent to a name close to yours can arrive.
A screenshot of the page
What each live lookalike shows, captured so you never have to visit it.
What the page does
Whether it has a login form, uses your brand or takes payments.
Risk and triage
Each finding ranked by risk, with a status, relevance, assignee, notes and a timeline.
Campaigns
Lookalikes run by the same people, grouped so you can see the whole operation.
New domains with your name
Newly registered domains that contain your brand name, using watch rules you set.
Your email set-up
Whether SPF and DMARC on your own domains stop other people sending mail as you.
Your certificates
A warning before the SSL certificate on one of your domains expires.
How it works
How does it work? You add a domain. We do the looking.
There is nothing to install. We work from public information about your domain and the lookalikes around it, and you decide what happens to each one.
- Once per domain
Add your domains
Add the domains you own. If you have several, group them into brands so they sit together.
- Continuously
We look for lookalikes
Each domain is checked for typos, swapped or lookalike characters and added words. Each lookalike is checked for registration and mail servers.
- When one is found
We capture and rank it
Its page is captured and analysed for login forms, use of your brand and payments, then ranked by risk. You get an alert for new lookalikes and for changes.
- When you are ready
You decide and act
Set a status, assign it and add notes. For a real threat, download the takedown emails to send yourself, or export a blocklist.
Page capture
Which lookalikes are dangerous? The riskiest come first.
Some lookalikes sit parked or up for sale. Others go live with a page that copies yours. We capture each page, check what it does and rank the list by risk, so the dangerous ones are at the top.
- A screenshot of each lookalike page, so you can see what your customers would see without visiting it yourself.
- Findings in plain words, such as "Asks visitors to sign in or pay". You never get an unexplained number.
- Ranked by risk, with checks for login forms, use of your brand and pages that take payments.
- Triage as a team. Set a status, mark relevance, assign it to someone and add notes. Every change lands on the finding's timeline.
New lookalikes and changes to known ones also arrive as alerts. About alerts
Screenshots · Page analysis · Risk ranking · Triage
Takedown emails
How do I get a fake site taken down? We write the emails.
Getting a lookalike removed means writing to the company it was registered through and the company hosting it. We draft both emails for you, with the evidence and a technical record, so you only have to read them and press send.
- One email for the registrar and one for the host, written in your name.
- Evidence and a technical record included, so the abuse team has what it needs to act.
- Download it as an .eml file and send it from your own mailbox.
- We never send or submit anything for you, so you stay in control of what is said in your name.
Registrar and host · Evidence · .eml download
Campaigns
Who is behind it? Group them. Dig deeper.
When the same people run several lookalikes, we group them into a campaign. When one needs a closer look, an AI investigator examines it and writes you a report.
AI deep dive
A written report on one lookalike.
An AI investigator examines the lookalike and writes a report you can download as a PDF or Markdown. You can ask for up to 20 a day.
Domain hub
Could someone send email as you? Check your own set-up.
A lookalike is one way to fake your email. Another is mail that claims to come from your real domain. Each domain's hub shows its email set-up beside its certificate, its lookalikes and its activity.
- Email set-up at a glance: whether SPF and DMARC are published, and whether they stop spoofed mail.
- Group domains into brands, so acme.co.uk and your other names sit together under one brand.
- A warning before a certificate expires, for every domain you add.
- Activity per domain, so you can see what changed and when.
Certificates are watched for every domain you add. More on certificate monitoring
Domain hub · SPF · DMARC · Certificates · Activity
Exports and blocklists
Can I block them on my own network? Export a blocklist.
Once you know a lookalike is dangerous, stop your own people reaching it. Export the list in a format your tools already read.
- A DNS firewall file (RPZ) to load into your own resolvers.
- A Microsoft 365 block list to import into the Tenant Allow/Block List.
- STIX 2.1 indicators and a CSV for a SIEM, a threat-intel platform or a spreadsheet.
- Evidence packs and a monthly PDF report for anyone who needs the paper trail.
Brand alerts can also go to your own tools by webhook, formatted for Slack, Microsoft Teams, Splunk or Microsoft Sentinel. About integrations
CSV · STIX 2.1 · RPZ · Microsoft 365 · PDF
A web address made to look like yours, with a typo, a swapped or lookalike character, or an extra word, such as acme-payro11.com instead of acme.co.uk. Scammers use them for fake websites and emails that fool customers and staff.
We keep watching each domain you add, and tell you as soon as we spot something. You get alerts for new lookalikes and for changes to the ones we already know about.
We prepare the takedown emails to the registrar and the host, with the evidence and a technical record, and you send them yourself as an .eml file. We never send or submit anything for you.
No. You see plain-language labels such as "Uses your brand name" or "Asks for a password" and a risk level, never a numeric similarity or AI score.
Yes. Export a CSV, STIX 2.1 indicators, a DNS blocklist (RPZ) or a Microsoft 365 block list, and download evidence packs and a monthly PDF report. Brand alerts can also go out by webhook, formatted for Slack, Microsoft Teams, Splunk or Microsoft Sentinel.
Set brand watch rules and we pick up newly registered domains containing your name from registry changes and certificate logs as they appear. See new domain monitoring for how it works.
Get started
Spot fake sites using your name early. And get them taken down.
Add your domains and we keep watching for lookalikes, show you which ones are dangerous, draft the takedown emails and give you block lists for your own network.