| Threat | What it looks like | Who removes it |
|---|---|---|
| Cloned login and verification pages | A copy of your sign-in or one-time-passcode screen on a lookalike domain | The host removes the content and the registrar suspends the domain |
| Credential-harvesting and account-draining sites | A page that harvests logins or empties an account once the visitor acts | Host and registrar, with blocklists warning visitors first |
| Fake payment and refund pages | Pages that collect card details to “process” a payment or refund | Host and registrar |
| Lookalike domains | Typos, added words, different endings and lookalike characters | Registrar. See domain takedown service |
| Phishing pages on free hosts and builders | Pages on site builders, cloud storage and link shorteners | The platform acting as host |
Detect
We find phishing sites through certificate logs, new domain registrations, lookalike permutations, ad and social monitoring, and reports from your customers and staff, in multiple languages.
Confirm
Each site is checked for the impersonated asset, the harmful action and the infrastructure behind it. Screenshots, URLs and dates are captured in the format each provider requires.
Block
Once we confirm a malicious website or phishing link, we block it across security integrations, including enterprise DNS filtering, within minutes. Major browsers such as Chrome, Safari and Firefox typically block it within 1–2 hours through Google Safe Browsing, so visitors see a warning while the takedown runs. Blocking applies to web domains and URLs. Fake social profiles and chat accounts are removed through platform takedowns.
File
We file with the registrar, the host and any proxy in front of the site at the same time. Registrars of generic domains must act promptly on actionable evidence of phishing under ICANN rules, and our direct takedown integrations with some registrars and registries send requests automatically.
05
Follow up
We follow up with platforms until we’ve confirmed each case has been removed, refile automatically when a provider stalls, and escalate from hosts to registrars and registries. When a kit moves to a new domain, we file again, and removed sites are rechecked so enforcement reopens if one comes back.
Detection across the web
Certificate logs, registrations, permutations, ads, social and customer reports, in multiple languages.
Blocking in browsers
Confirmed sites only, within minutes in security integrations and typically 1–2 hours in major browsers.
Filing with registrar, host and proxy
Evidence in each provider’s format, filed together, with direct integrations where they exist.
Follow-up and escalation
Automatic refiling when a provider stalls, and escalation from hosts to registrars and registries.
Follow every case in the app, plus a monthly report of what’s removed, blocked, still live and waiting on you.
Predictable pricing
Takedowns are included in your subscription, with no surprise per-takedown fees. Enterprise plans include unlimited takedowns. See pricing.
Frequently asked questions