Search threats, CVEs… ⌘K

See your company the way an attacker does.

SecurityAlert checks the public trail around your company: lookalike domains, forgotten servers, exposed credentials, and certificates nobody owns. It then shows you which findings matter based on current vulnerabilities, ransomware activity, and threat actors.

Start free See a live demo

monitor / orionhealth.io · live

14:02:11

Lookalike domain · orion-secure-billing.com (homoglyph)

critical

14:01:47

Credential exposure · 47 emails in stealer log "Redline-04/26"

high

14:00:52

Subdomain takeover · beta.orionhealth.io → unclaimed Heroku

med

13:59:08

Phishing kit live · login-orion.support · MX active 4m ago

critical

13:58:31

KEV CVE in stack · CVE-2026-3411 · 2 hosts exposed

high

13:57:14

Paste-site mention · rentry.co · "orion db sample"

med

13:56:29

Watched actor registered · orion-billing.top · registrant + NS match

high

13:55:42

Leaked secret on GitHub · AWS key in orion-tools/deploy.sh

critical

Security rating

Rating 78/100 7-day delta +4 pts · improving

Open findings

• 3 critical • 11 high • 22 med

Open in dashboard →

unsafe claims watchops.com, US · 10h ago

audit team claims AUDIT ENTITY: TE***PB · 11h ago

global claims TOWN OF SUTTON | MASSACHUSETTS, US · 12h ago

global claims Sutton Public Schools, US · 12h ago

AuditTeam claims TE***PB, RU · 13h ago

medusalocker claims Praveg Caves Jawai, IN · 14h ago

medusalocker claims Frisby Roofing (Frisby Construction LLC), US · 14h ago

medusalocker claims Abourametals, AE · 14h ago

medusalocker claims 瑞祥机电 (Ruixiang Jidian), CN · 14h ago

nightspire claims Tuboaços da Amazônia Ltda. · 18h ago

unsafe claims watchops.com, US · 10h ago

audit team claims AUDIT ENTITY: TE***PB · 11h ago

global claims TOWN OF SUTTON | MASSACHUSETTS, US · 12h ago

global claims Sutton Public Schools, US · 12h ago

AuditTeam claims TE***PB, RU · 13h ago

medusalocker claims Praveg Caves Jawai, IN · 14h ago

medusalocker claims Frisby Roofing (Frisby Construction LLC), US · 14h ago

medusalocker claims Abourametals, AE · 14h ago

medusalocker claims 瑞祥机电 (Ruixiang Jidian), CN · 14h ago

nightspire claims Tuboaços da Amazônia Ltda. · 18h ago

Threat data

The data behind each alert.

We keep our own current index of threat actors, vulnerabilities, ransomware groups, and newly observed domains.

Threat actors tracked

895

MITRE ATT&CK Groups + curated

CVEs indexed

390,664

Local NVD mirror, KEV + EPSS scored

Ransomware groups

727

Tracked across leak sites

Domains diffed daily

224M+

ICANN zone data, 15 TLDs

What we monitor

Four ways we help protect your company.

Use the products separately or together. They share the same asset, infrastructure, identity, and threat data.

Brand

Brand & domain protection

Watch for lookalike domains, fake apps, copied brand images, and misleading answers about your company from AI assistants. SecurityAlert investigates the strongest matches and prepares takedowns for your approval.

Typosquat & homoglyph detection (13+ techniques) on newly observed domains daily
App-store impersonation & visual logo matching
AI investigation copilot (dual-engine verdict + drafted report)
Multi-channel takedowns you review and approve
Answer-engine monitoring (what AI assistants say about you)

Explore lookalike monitoring

Intel

Threat intelligence

See which threat actors, CVEs, and ransomware groups are relevant to your industry and the systems you run, with MITRE ATT&CK context.

895 actor profiles + sector-filterable ATT&CK heat map
Own NVD mirror: 365k+ CVEs, CVSS + KEV + EPSS + ATT&CK mapping
Ransomware leak-site tracker + susceptibility scoring
Universal indicator lookup with Cmd+K
STIX 2.1 / TAXII / MISP export

Explore threat intelligence

Exposure

Exposure & posture

Review your public attack surface across 11 security areas. You get an A+ to F rating, a prioritized list of improvements, a modeled annual loss range, and a scorecard you can share.

Outside-in rating (A+ to F) + prioritized action plan
Host & subdomain scanning with KEV / EPSS prioritization
Per-asset view: WHOIS, email auth grades, passive DNS, reputation, exposure
Infostealer credential exposure (employee + customer)
GitHub leaked-secrets + Ransomware Susceptibility Index

Explore exposure management

Certs

Certificates & crypto governance

Find the TLS certificates on your public perimeter, assign an owner to each one, and see which certificates are expiring, were issued outside your process, or use weak cryptography.

Live inventory with A+ to F grading
Owner assignment & rotation history
Shadow-cert discovery from CT logs
Tiered expiry alerts (30/14/7/3/1 day)
PCI / SOC 2 / NIST posture mapping

Explore certificates

After the alert

Investigate and respond in the same place.

Most findings never need you. Automatic triage closes the ones it can prove are harmless, shows the evidence it used, and reopens them by itself if anything changes. What is left keeps its account, asset, source, analyst notes, and next action in one place while your team works on it.

See how the findings connect

Connect assets, cloud inventory, repositories, scanner results, web applications, identities, and controls. You can open the source behind every connection.

Explore exposure management → Identity evidence

See which account is affected

Match authorized directory details with a security event for a specific account. Domain-wide counts are shown separately as background.

Explore operational intelligence → App impersonation

Review suspicious app listings

See the store listing, similarity checks, description, observation dates, analyst notes, and review status for every possible fake app.

Explore brand protection → Repositories

Check CI/CD settings and leaked secrets

Review workflow triggers, runner trust, token permissions, action pinning, possible injection paths, and redacted secret matches.

See repository exposure → Automation

Connect the tools your team already uses

Use SecurityAlert through the dashboard, REST API, MCP, Slack, Teams, email, signed webhooks, STIX/TAXII, or MISP-shaped events.

See integrations → Governance

Control access and record decisions

Use category-level permissions, human approval, append-only analyst notes, and audit events throughout the platform.

See the security model →

New domain monitoring

Catch lookalike domains while they are still new.

Threat actors may change names and email addresses while reusing registrars and nameservers. We check zone files every day and watch for new domains connected to known infrastructure.

New domains

Find new domains that resemble your brand

SecurityAlert checks ICANN zone files across 15 TLDs, including .com and .net. More than 200 million registered domains are compared each day so new lookalikes can be flagged when they first appear.

Check a domain free

Actor tracking

Watch the infrastructure behind a campaign

Search our registrant and nameserver index by email, phone, name, organization, or nameserver. If you watch an actor's infrastructure, SecurityAlert can flag a new domain when it first appears in the zone data.

Explore actor tracking

Free tool

Find domains that share a nameserver

Enter a nameserver to see the domains that use it, or enter a domain to find other domains on the same distinctive nameservers. The free tool indexes 24 million domains from ICANN CZDS data.

Try the nameserver graph

Add your domain and see what we find.

The free plan includes one brand monitor, public threat intelligence, and our public investigation tools. You do not need a credit card or a sales call.

Start free See pricing