Digital risk protection · Detection
You cannot take down what you cannot see
Detection quality depends on the data behind it. A tool that reads new domain registrations and search results will find the obvious lookalikes and miss most of the rest: the subdomain on a free site builder, the phishing page reached through a paid search ad, the closed Telegram group selling your customers’ logins. This page describes what is watched, and how millions of signals become a short list worth an analyst’s time.
Six kinds of source
| Source | What it covers |
|---|---|
| Passive DNS | Global passive DNS at millions of resolutions per second. It shows new domains and new subdomains as they start resolving, not just new registrations. |
| Instant messaging | More than 3,000 criminal chat groups on Telegram, WhatsApp, Discord and ICQ, in more than 12 languages. |
| Deep and dark web | Underground forums and markets, accessed through managed analyst identities that have the standing to be let in. |
| Threat actor engagement | Hundreds of sessions a month in which analysts interact with threat actors to confirm intent and recover evidence. Engagement on your behalf happens only when you ask for it. |
| Social media | Proprietary access to Facebook, Instagram, LinkedIn, X, TikTok and Bluesky for impersonation detection. |
| Breach and scan data | Personal data from thousands of breaches, plus active scans of more than 2,000 ports per IP address. |
Mobile apps are checked across more than 300 official and unofficial app stores.
Why domain names are not enough
Lookalike domains are the attack everybody expects, and they are still common. But the campaigns that do the most damage increasingly avoid them.
Site builders
One phishing campaign reused free website-builder templates to target more than 200 US banks, using subdomains of a trusted builder. There was no new domain registration to detect.
Search ads
70% of the phishing sites reached through malicious search ads had no resemblance to the brand’s domain at all, and malicious ad creation grew 28% in 2023 (BlueVoyant research on search-engine ads, 2024).
Payment-brand kits
One kit impersonated a payment brand and let victims pick their own bank from hundreds. The targeted bank’s name never appeared in the domain.
That is why the collection starts from passive DNS and from the content of pages, not only from registration feeds. A page that carries your logo, copies your HTML or loads your login page is found whatever its address looks like.
Nine models before a human looks
Collection produces far more candidates than any team could read. Nine automated components score and filter them, so the analysts start from a ranked list.
| Component | What it does |
|---|---|
| Lookalike scoring | A string-similarity model scores from 0 to 100 how closely a domain imitates yours. |
| Suspicious domain detection | Registration and infrastructure data flag domains with a risky profile. |
| Domain monitoring | Parked and inactive domains are re-probed, with an alert when their behaviour changes. |
| Computer vision | A deep-learning model recognises your logo and its variations on a page. |
| HTML model | Machine learning finds login pages and pages that reuse your code or design. |
| Social media detection | Profiles and pages are probed and scored for impersonation. |
| Facial recognition | Detects impersonation of named executives through their photographs. |
| Instant-messaging scraping | Harvests stolen credentials and payment data from chat groups and dark web sources. |
| Takedown automation | Builds the evidence package, so approved takedowns can be filed at scale. |
How a suspicious domain moves through the pipeline
- Seed. Your brand keywords, official domains, logos and site content define what to look for.
- Discover. Passive DNS, new registrations, subdomains on hosting platforms and site builders, and search ads produce candidates.
- Score. Lookalike score, logo match by computer vision, and HTML similarity rank the risk. A lookalike with an MX record, set up to handle email, can be raised in severity.
- Validate. An analyst reviews the content, removes redirects and benign sites, and captures evidence. How validation works →
- Watch. Parked domains are re-probed. When one comes to life, a new alert is raised and the takedown can start.
Social media: a classifier, then an analyst
Each profile is scored on two things: how legitimate it looks, and how closely it resembles your official accounts. Legitimacy signals include follower count, the match between screen name and username, and unusual symbols or numbers in names. Similarity compares names, text and profile images with your official footprint. A gradient-boosted classifier trained on labelled real and fake profiles makes the first call; positives go to an analyst and then to the platform.
This is why the list of official accounts you give us at onboarding matters: it is what similarity is measured against.
Three integrations that use data you already have
| Integration | How it works | What it finds |
|---|---|---|
| Web beacon | A short JavaScript snippet on your official login page. Whenever it runs outside your authorised domains, it makes a short call to the detection engine, so analysis of the copied page starts immediately. | Cloned copies of your login page, as soon as they load. |
| Abuse box | Phishing complaints from your abuse inbox are forwarded automatically. The URLs are extracted and run through automated detection, then analyst validation and your takedown policy. | Phishing sites your customers have already seen, without anyone on your team triaging the reports. |
| Referral logs | Session logs from your website show where visitors arrived from. | Phishing sites that redirect victims to your real site afterwards to cover their tracks. |
None of the three needs a new licence or new headcount. Each makes detection earlier, and the abuse box takes a manual task off your team.
Where this stops
Coverage of closed communities is broad, not total. Thousands of chat groups and forums are watched, but no one has access to all of them, and the most closed groups are closed for a reason.
Searching runs around the clock; analysts do not. Every source is searched and alerted continuously. Analyst review happens during business hours, and at weekends when a case is urgent.
Detection follows the footprint. A brand, app or executive missing from your onboarding list will not be recognised.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
A domain-monitoring tool watches registrations and tells you a lookalike exists. This watches passive DNS, page content, social media, app stores and criminal channels, so it also finds subdomains, cloned pages on trusted platforms, fake profiles and leaked credentials. And what it finds is checked by an analyst and, where possible, taken down, rather than left in a list.
Often, yes. A domain that is registered and parked can be flagged while it is still dormant, and is then re-probed. When it comes to life, a new alert is raised. A parked domain cannot usually be taken down while it is empty, which is why it is watched instead.
Criminal chat groups are monitored in more than 12 languages. Where you ask an analyst to engage a threat actor on a specific case, that conversation can be held in 24 languages, Hungarian and German among them.
The rest of the service
Onboarding
What we need from you to start, and the two to three weeks from order to live service.
Validation
Every finding is reviewed by an analyst: false positives removed, evidence attached, an action recommended.
Brand impersonation
Lookalike domains, phishing sites, fake social media profiles and rogue apps, found and taken down.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.