At 3:17 a.m. last Sunday, three domains were registered that look like yours. By 8 a.m., one was live — your logo, your favicon, a login form that posts to a Telegram bot. Your domain monitor never caught it — it never registered the name. It bought acme-secure-login.com, not acmе.com.
You'd never have known. Your customers would have.
Domain monitors watch the names. We watch the pages. Search engines, certificate transparency logs, and what the site actually looks like once it loads — acme-secure-login.com isn't a typo of your domain, it's a typo of your brand. Different problem. Different tool.
AI-planned queries scan search engines every 30 minutes. Certificate transparency logs are polled continuously for lookalike domains. Every signal is enriched with DNS, TLS, and a full browser render — and triaged before it reaches the verification stage.
Each signal is compared against your official pages across 14+ dimensions — text, forms, images, DOM, CSS, scripts, favicon. The verifier model then reads screenshots of both sites side-by-side and returns a verdict with confidence, evidence, and reasoning.
Case-worthy threats cluster into Cases with severity, evidence packages, and recommended reporting routes. Each Case is one click away from registrar abuse forms, hosting provider takedown channels, or legal handoff.
Every 30 minutes, search results re-run. Every 10 minutes, certificate transparency streams. Verified campaigns re-check daily. When anything shifts — a watched domain activates, a baseline page drifts, a phishing kit changes hands — it lands in your channel.
It catches names that look like yours. Most clones don't try. They look like your brand, on a domain that doesn't.
They can manually triage twenty or thirty candidates a day. Our intake queue regularly starts at two hundred.
Every verdict carries a confidence score, side-by-side screenshots, and a human-readable reason. You don't approve what you can't see.
An LLM plans query variants per organization and runs them against Google every 30 minutes. Certificate transparency logs stream in parallel and get matched against your lookalike patterns. Forums, reviews, and benign subdomains are triaged out before anything reaches the verification stage — only artifact-valid Signals pass through.
Each Signal is fingerprinted across 14+ dimensions — text, forms, DOM, images, scripts, favicon — and scored against your baseline. The Classifier Verdict handles obvious matches cheaply. What survives goes to the verifier model with image input, which reads screenshots of both sites side-by-side and returns a Final Verifier Verdict, confidence, and the evidence behind it.
Actionable Signals become Cases with severity, evidence packages, and recommended reporting routes — registrar abuse, hosting provider takedown forms, or legal handoff. The Case is the unit of action: it carries everything an analyst would otherwise have to assemble by hand.
Baselines drift. Phishing kits change hands. Watched domains activate weeks after they were registered. Re-scans run on a schedule, re-verification fires on baseline changes, and severity routing decides what gets paged versus what just lands in the dashboard. The pipeline does not stop after a Case is opened.
No analyst seat. No discovery call. No per-Case overage. Add a domain, watch the pipeline fill the queue, sleep through Sunday morning.
For one brand and a small team — the dashboard your domain monitor never gave you.
Monthly or annual · cancel anytime
Open dashboard →What's included
For brands with sub-brands, regional domains, or a security team that wants real headroom.
Monthly or annual · cancel anytime
Open dashboard →Everything in Basic, plus
For portfolios, regulated industries, and security teams that need contracts before they need a dashboard.
Annual contract · custom terms
Contact sales →Everything in Growth, plus
The full pipeline with Case management, evidence packages, and one-click registrar reports. SSO. No analyst seat required.
Open dashboard →Critical Cases wake your security channel. Each alert links to the evidence package.
set up in /dashboard/notifications/
Stream Case events into your existing brand-security stack. Severity-based email routing for the rest.
POST your-webhook-url
One was reported to the registrar by 9:14 a.m. The second went dark on its own — phishing-kit landlords get nervous when traffic doesn't arrive. The third is still being monitored. It may activate next week.
None of them reached a customer.
That's the dashboard you're about to open.
