| Action | What it does | What it doesn’t do |
|---|---|---|
| Domain monitoring | Finds new and changed lookalike domains and watches parked ones for activation | Doesn’t remove anything |
| Blocking | Warns visitors in browsers once a domain is confirmed malicious | Doesn’t take the domain down |
| Domain takedown | Gets the registrar to suspend the domain and the host to remove the content | Doesn’t stop the next registration |
Typosquats and lookalikes
Misspellings, added words, different endings and lookalike characters. See how to monitor for lookalike domains.
Subdomain tricks
Your brand as a subdomain of someone else’s domain, where the registrar of the real domain matters.
Parked domains that activate later
Registered, watched, and filed the day they turn malicious.
Domains behind proxies
Where the host is hidden and the proxy has to be asked first. See registrar vs host vs Cloudflare.
Monitor
Certificate transparency logs, newly registered domain data and permutation checks across your brands, continuously.
Classify
Each domain is checked for content, redirects and brand assets. Parked domains are watched, and malicious ones move to enforcement.
Block
Once we confirm a malicious website or phishing link, we block it across security integrations, including enterprise DNS filtering, within minutes. Major browsers such as Chrome, Safari and Firefox typically block it within 1–2 hours through Google Safe Browsing, so visitors see a warning while the takedown runs. Blocking applies to web domains and URLs. Fake social profiles and chat accounts are removed through platform takedowns.
File
Registrar, host and proxy at once, with the evidence each requires. Registrars of generic domains must act promptly on actionable evidence of phishing under ICANN’s 2024 rules, and our direct takedown integrations with some registrars and registries send requests automatically.
05
Follow up
We follow up with platforms until we’ve confirmed each case has been removed, refile automatically when a provider stalls, and escalate from hosts to registrars and registries. Removed domains are rechecked automatically, and enforcement reopens if a site comes back.
Frequently asked questions