Certificate transparency monitoring
Every security certificate (the padlock) is recorded in a public log when it is issued. We watch 100+ of those logs as new entries appear and match them against your brand name.
The free scan checks 150+ lookalikes of your domain and emails you the report. It does not search certificate logs; that is part of monitoring.
- 100+ public certificate logs watched as new entries appear
- 75m+ new website certificates checked every day, across all customers
- Seconds from a certificate appearing in a log to our match
Phishing sites have padlocks too, and that leaves a record
Certificates are now free and quick to get, and browsers warn visitors about sites without one. So fake sites have the padlock your customers were taught to look for.
Getting a certificate leaves a public record with a time on it. We check each new name against yours, which can show a fake site being set up before it goes live.
How your brand name is matched
We look for your brand name anywhere in the address on a new certificate. Before we compare, hyphens and dots are removed and letters that look the same are turned back into normal ones.
yourbrandExact- Your name exactly as written, anywhere in the address, including on a subdomain of somebody else's domain such as yourbrand.example.net.
your-brandSplit or joined- Hyphens or dots added or removed, so your-brand and your.brand still match.
yourbrаndLetters that look the same- Letters from other alphabets that look like ours, such as a Russian а in place of a, are turned back into normal letters before matching.
What certificate logs cannot show
Misspellings of your name, such as yourbrnad.com, are not matched here. Lookalike monitoring generates and checks those every hour.
A wildcard certificate (*.example.com) covers every subdomain without naming them, so yourbrand.example.com never appears in the log. A page on a shared hosting platform uses the platform's certificate. The website marker and our search for your wording can still find those.
Your brand name needs to be at least five letters and not an everyday word like “secure” or “portal”, or it would match thousands of unrelated sites. Short or common names rely on lookalike monitoring instead.
AI triage of every match
Most of the work is deciding what not to send you
Your brand name appears in many certificates that have nothing to do with you. If we sent you all of them, you would miss the real ones.
When you add a domain, we read your homepage to note your official name and what your business does. An AI model checks each match against that. A partner using your name for a real reason, a common word that happens to be your brand, or an unrelated company with a similar name is set aside.
- Checked against your official name and what your business does
- Certificates for your own domains recognised as yours
- Alerts include the certificate details, screenshots and who registered the domain
- Matches that are not live yet, or not clearly impersonating you, go on a watch list and keep being checked
- A confirmed threat goes straight to takedown, with its evidence attached
What a certificate showed in one case
In one case we handled, the certificate for a copied website was matched within seconds of being logged, which showed the attacker meant to put a site on it. The site was taken down before any customer was known to have used it.
Free scan. No account, no card details.
See which lookalikes of your domain already exist
The free scan checks 150+ lookalikes of your domain and shows which are registered and which can send email as you. It does not search certificate logs; monitoring does that, along with around 500 lookalikes per domain.
- Typos, other endings and added words, such as yourcompany-invoices.com
- Which ones are registered, and which are set up to send email as you
- The report in your inbox, usually in a couple of minutes. No account, no card details, no sales call.
Prefer a conversation? Book a demo or see all of monitoring.