| Source | Signals |
|---|---|
| Websites and domains | Certificate transparency logs, new registrations, lookalike permutations, page content and redirects |
| Social platforms | X, Telegram, Facebook, Instagram, LinkedIn, TikTok, YouTube and Reddit: handles, names, avatars, bios and posts |
| App stores and APK sites | Listings, developer names, icons and screenshots |
| Ads | Search and social ads on your brand terms |
| Code repositories and extension stores | Repositories and browser extensions using your name |
| Your customers and staff | Reports through the Slack, Telegram and Discord bots and the public reporting page. See community bots |
Allowlist first
Your official domains, accounts and apps are allowlisted at onboarding, so automatic detection leaves them out.
Confidence grading
Each suspected threat gets a threat score and a confidence level, and related findings across linked URLs, redirects and accounts are grouped into campaigns.
Review
Automation handles high-volume threats. Cases that need judgment, such as fan accounts and staff profiles, go to our operations team, and decisions that need you come back to you.
Rechecks
Open cases are rechecked until removal is confirmed.

Web and domain monitoring
Certificate logs, new registrations and lookalike permutations.

Social platform monitoring
Fake profiles and posts across the major social platforms.

App store monitoring
Listings, icons and screenshots in official stores and APK sites.

Ad monitoring
Search and social ads bidding on your brand terms.

Confidence grading
A score and confidence level on every suspected threat.

Campaign grouping
Related findings tracked and reported together.
Frequently asked questions