01 Monitoring & detection
Brand & Domain Protection
Lookalike domains and cloned sites are the front end of most fraud committed against professional firms. They are also the easiest thing to catch early.
Start a pilotA domain built to impersonate you is usually registered days before it is used, configured for mail, and then pointed at your clients or your finance team. Everything in that sequence is observable at registration — if somebody is watching certificate transparency logs and registrar records for permutations of your name.
We monitor for those registrations, for cloned sites and app listings, and for accounts impersonating your executives. When one appears we evidence it properly — registration data, hosting, mail configuration, screenshots with timestamps — so that a takedown request lands with everything the registrar or platform needs.
01 What you receive
Deliverables.
Every engagement produces a written, sourced deliverable — not a dashboard login you will never open.
- Registration monitoring
- Permutations of your domains and brands, watched at the point of registration.
- Clone detection
- Copies of your website, portals and app listings.
- Executive impersonation
- Accounts and profiles using the names of your senior people.
- Takedown evidence pack
- Documented, timestamped evidence structured for registrars and platforms.
02 Method
How it runs.
- 01
Profile
We map the domains, brands and names worth watching, and the permutations most likely to be used.
- 02
Detect
Certificate transparency, registrar records and content matching run continuously.
- 03
Evidence
On detection we capture and document the infrastructure before it changes.
- 04
Support takedown
We supply the pack and support your counsel or provider through the process.
04 Common questions
Do you handle the takedown yourselves?
We produce the evidence pack and support the process. Formal takedown requests are usually best submitted by your counsel or your brand-protection provider, and we work alongside whoever holds that relationship.
How fast can a domain be taken down?
It depends entirely on the registrar, the hosting provider and the jurisdiction. Our fastest documented case ran 72 hours from detection to removal. Others take considerably longer, and some do not succeed — we will tell you which we expect at the outset.
What if the domain has been registered but not used yet?
That is the best time to find it. An unused lookalike domain with mail records configured is a strong indicator of intent, and evidencing it early gives you a head start on both takedown and warning your clients.
Tell us what you would want watched. We will scope a pilot on it, in writing, before anything is agreed.