Frequently asked questions
How the monitoring, takedown and DNS work is scoped, what it catches, and what it does not.
Getting started
How do I get started?
Email [email protected] with the domain or brand you are protecting, what prompted the enquiry, and roughly how many domains and trademarks are in scope. That is enough for a first reply saying whether the work is a fit. Nothing needs installing beforehand; addresses are on the contact page.
What happens after the first email, and how quickly do you reply?
A person reads it and replies within one business day. No automated sequence sits behind the address; the reply is normally a short set of scoping questions. If something is being abused right now, use [email protected] instead — monitored 24/7, 30-minute response, described under emergency response.
Why is there no phone number and no contact form?
Email leaves a written record on both sides, which matters when the subject is evidence, timelines and who was told what; a call leaves you nothing to cite afterwards. And a form implies a database behind it — this site collects no lead data at all.
What information do you need to scope monitoring?
The domains you own and the ccTLDs you trade under; trademarks and their classes; brand terms an attacker would combine with them; which registrar holds each domain and who has account access; your DMARC policy. Your tolerance for false positives matters too — a wide net and a quiet alert queue pull in opposite directions.
What monitoring actually detects
Which sources are watched?
Certificate transparency logs, which record publicly trusted certificates and often surface a domain before it serves anything. Zone files for the gTLDs that publish them. Passive DNS, for names that resolved where a sensor could see them. WHOIS and RDAP for registrar, creation date and status codes. Each has a different lag and blind spot.
What is a lookalike domain detection based on?
A generated candidate set — substitutions, transpositions, omissions, keyboard-adjacent typos, confusables, hyphenation, TLD swaps — matched against what is actually registered. A hit is only a string match until enriched: does it resolve, does it have MX records, has a certificate been issued, who is the registrar. Scoring comes from the enrichment. See typosquatting defence.
Why do homoglyph and combosquatting variants matter?
Homoglyphs exploit characters that render alike — Cyrillic а for Latin a, rn read as m — so the address bar looks right even when the punycode does not. Combosquatting misspells nothing: yourbrand-login reads as legitimate inside a lure. A candidate list built only from typos misses both.
What will monitoring not see?
Certificate transparency shows a certificate after issuance, not a registration, and only from publicly trusted CAs. Many ccTLD registries publish no zone file. Passive DNS depends on sensor placement, so a name that never resolved on an observed path stays invisible until used. A phishing page on a legitimate platform's subdomain is not a registration at all.
Is detection the same as prevention?
No, and conflating them is the common failure. Detection tells you a variant exists and gives you evidence; it does nothing to the variant. Risk drops through what follows — defensive registration, registrar and registry locks, DMARC enforcement, resolver blocking, takedown where warranted. The services overview sets out which control does what.
Takedown
What does a takedown involve?
An evidence package first: timestamped captures with the URL visible, HTTP response and page source, DNS records, WHOIS/RDAP output, the host's network details. That goes to the registrar's abuse contact and the hosting provider in parallel, since they act independently. Where a trademark and bad-faith registration can both be shown, UDRP is a formal route. More on domain takedown.
How long does a takedown take?
It depends on who has to act. A clear credential-harvesting page on a responsive host can go the same day, though the domain often outlives the content. Beyond that: the registrar's jurisdiction, gTLD under ICANN contract versus ccTLD under local policy, whether a working abuse contact is published, whether a privacy proxy hides the registrant. UDRP is a filed proceeding — plan in months.
Why do some takedowns fail or run for weeks?
The operator strips the content but keeps the domain, leaving no live abuse to report. The registrant holds a competing right, or the term is generic enough to argue over. The registrar disputes the evidence, or never answers. The site moves hosting mid-request. Or the ccTLD registry has no abuse process at all.
What can I do while a takedown is pending?
Block the domain on your resolvers, mail gateway and web proxy. Submit the URL to browser and anti-phishing feeds — those warnings usually land before removal does. Warn customers through the channel the lure imitates, keep collecting evidence, and watch certificate transparency for a reissue. See phishing and spoofing protection.
DNS and email
What does DNSSEC protect against, and what does it not?
DNSSEC signs records so a validating resolver can detect answers forged or altered in transit — cache poisoning, on-path injection. It does not encrypt queries (that is DoT or DoH), stop a denial-of-service, or say anything about the site at the end. Nor does it stop a hijack: whoever holds your registrar account changes the delegation and the DS record together. See DNS security.
Why do registrar locks matter?
The client-side status codes — clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited — block transfers, nameserver edits and deletion at the registrar, and cost nothing to set. Registry lock goes further: changes need out-of-band human verification. Pair either with MFA and a monitored role mailbox. Related: domain hijacking recovery.
How do SPF, DKIM and DMARC relate to spoofing protection?
SPF lists hosts allowed to send for the envelope domain; DKIM signs the message so the signing domain can be verified; DMARC requires one of them to align with the visible From: domain and tells receivers what to do when neither does. A p=reject policy stops direct spoofing of that exact domain. It does nothing about a lookalike the attacker owns and authenticates correctly.
Incidents
What counts as an emergency, and what does that channel commit to?
An unauthorised transfer or nameserver change, a live phishing campaign against your customers or staff, DNS infrastructure compromise, a certificate issued for your domain that you did not request, coordinated impersonation at scale. [email protected] is monitored 24/7 with a 30-minute response commitment — a commitment to begin triage, not a promise about a registrar's response time. See emergency response.
What should I do in the first hour of a suspected domain hijack?
Query RDAP or WHOIS and record the registrar, nameservers, status codes and contacts, then compare against what you expect — that shows whether the change happened at the registrar or the DNS host. Regain the registrar account from a trusted device: reset the password, revoke API keys and sessions, look for added contacts or a new auth code. Check the mailbox tied to that account, because a hijack usually starts there.
What evidence should I preserve?
Registration data before and after the change, timestamped, from RDAP or WHOIS directly rather than a screenshot of a lookup site. Registrar notification emails with full headers, the account audit log, DNS responses with resolver and time, certificate transparency entries, page captures showing the URL and clock. Hash the files and work from copies.
Commercial
How are engagements structured?
Monitoring is a subscription, scoped by the domains and brand terms watched and by whether takedown handling is included. Incident and recovery work can be engaged on its own if you are dealing with something now rather than watching continuously. Plan shapes are on the pricing page.
Is there a minimum term?
That belongs to the scoping conversation rather than a blanket rule, because it moves with the size of the monitored estate and whether takedown volume is committed up front. Ask explicitly in your first email and get the answer in writing — advice that applies to any vendor, including this one.
What happens to my monitoring data if I leave?
Detection history and the evidence packages produced for you are yours; request an export before the engagement ends rather than after. Monitoring stops when the term does, and anything retained afterwards falls under the privacy policy and the retention schedule in your agreement.
Not covered here?
Send it to [email protected]. Terms are defined in the glossary; issues in our own systems go to [email protected] under the responsible disclosure policy.