01.1
Brand & domain protection
Find lookalike domains and suspected copies. Compare pages, DNS, certificates and hosting evidence.
Explore brand protectionExternal security intelligence
Understand your external exposure.
Brand impersonation, exposed services and critical vulnerabilities. Investigate the evidence, assign a response and verify what changed.
One company domain. Verified work email. No credit card.
01 / ProtectBrand & domains
02 / DiscoverExternal assets
03 / InvestigateCVE evidence
04 / RespondVerified actions
01 / Coverage
Start with your domain.
See what connects to it.
Bring brand protection, public infrastructure and vulnerability evidence into one place. Cloud integrations are optional.
01.2
External exposure
Review public hosts, services and applications. Identify relevant findings and assign corrective work.
Explore exposure management01.3
CVE intelligence
Connect affected assets with exploitation reports, version evidence and vendor remediation guidance.
Browse CVE intelligence01.4
Certificate monitoring
Check which certificates your endpoints serve. Track expiry, live use and unresolved checks separately.
See the certificate inventoryCapabilities and monitoring limits vary by plan. Compare plans.
02 / Investigation
A suspicious page.
A complete investigation.
Bring screenshots, page behavior and infrastructure into the same review. Understand what a page does and how it relates to your brand.
Explore website investigationsWebsite investigations are included in Business and Custom.
Website investigationIllustrative example
Observed URLnorthstar-login.exampleNeeds review
Approved site
NORTHSTAR
Welcome backSign in to your account
Work email
Password
Sign in
Form sends to accounts.northstar.example
Observed page
NORTHSTAR
Welcome backSign in to your account
Work email
Password
Sign in
Form sends to verify-northstar.example
Evidence to review
Page appearanceForm destinationHosting
Discover unfamiliar pages
Investigate suspicious URLs, imported referrals or observations from your optional website beacon. A copied snippet can report a page when it runs on another hostname.
Document your decision
Classify the page as a copied login, fake support page, parked domain or unrelated business. Keep the screenshots and evidence behind your choice.
Follow meaningful changes
Choose follow-up after closure. Monitored pages that return or change stay flagged for review, with the earlier decision preserved.
03 / Response
Put the next step
in the workflow.
Conditions, branches, approvals and notifications. Build the response your team needs and keep the delivery history.
SecurityAlert / Workflow editor
- 01
Match the finding
Choose events, brands and severity. Add conditions and response branches.
- 02
Route the decision
Assign an approver or wait for acknowledgement. Apply working hours and delays.
- 03
Deliver and follow up
Notify the team, escalate missed acknowledgements and inspect the run history.
EmailSlackTeamsSigned webhooks
Explore workflows & integrations
Certificate inventory
Know which certificates
are serving traffic.
An expired certificate can still be serving traffic. See the live check, endpoint and expiry together, so your team can identify the certificates that need action.
Explore certificate monitoringSecurityAlert / Certificates
Additional coverage
Follow the connections.
Vendor monitoring
Follow external vendor posture and changes to published policies, with the evidence behind each change.
See Business coverageCredentials & repositories
Investigate exposed credentials and potential secrets in public repositories. Keep the source and context for remediation.
Explore investigation toolsActor infrastructure
Trace connections across domains, registrants and nameservers to investigate infrastructure linked to tracked actors.
Explore actor tracking04 / Research
Recent research.
Practical guidance.
Updated
CVE-2026-107406: Citrix fixes critical NetScaler SAML memory overflow
A new NetScaler vulnerability can allow remote code execution or denial of service. Check the SAML role and running build: some recently patched IdP deployments need another update.
Read researchUpdated
CVE-2026-88779: CISA lists NetScaler SAML denial of service as exploited
CISA added CVE-2026-88779 to its exploited-vulnerability catalog on October 4. Covered federal agencies have an October 7 remediation deadline and must perform forensic triage. Citrix has released fixed builds.
Read researchUpdated
Citrix NetScaler zero-days: web shells and credential theft extend the response
New evidence dates the attacks to early September and identifies web shells and internal tunneling. Investigate pre-patch exposure alongside the urgent NetScaler upgrade.
Read researchGetting started
Start with one company domain.
Use your verified work email to start 14 days of monitoring for one company domain. No credit card is required. One trial per company domain.
Monitoring stops at the end of the trial unless you subscribe. Your saved assessment remains available.
Cloud integrations are optional. Domain monitoring does not require access to Azure or another cloud account.
Pro
2 brand monitors, threat intelligence and certificate alerts.
$29/month
Solo
5 brand monitors, credential and repository checks, and actor tracking.
$79/month
Business
10 brand monitors, unlimited users, website investigations, response workflows and vendor monitoring.
$249/month
Prices in USD. See pricing for full features and limits.
Try a public lookup first.
Research and public tools are free to use.