How it works

Four stages, before the first email lands.

Spot

A lookalike is registered.

We fingerprint it and find its siblings.

Every domain in the campaign is re-checked on a schedule, most often in the first week.

You get the alert and the indicators while the campaign is still being staged.

Only public signals: DNS, certificate transparency, registration data and public web pages. No access to your systems is needed.