Cybereinforce Threat Enforcement
Look-alikes of your brand, found and blocked before anyone falls for them.
A domain one letter away from yours is all it takes to send your customers a fake invoice or your staff a fake sign-in page. Cybereinforce watches every new website certificate, every new domain registration and the names most likely to be registered against you. Every look-alike is checked, blocked in every enrolled browser and reported straight to your SOC.
Four places every look-alike shows up
We do not wait for someone to report a look-alike. We look where it has to appear before it can be used.
Website certificates
A phishing page needs the padlock. Every publicly trusted certificate is published in Certificate Transparency logs, often before the page is even online. We read all of them, around the clock.
New domain registrations
Newly registered domains across hundreds of extensions are checked every day, so a look-alike is caught on the day it is registered, often before it has a website or sends an email.
Your most likely look-alikes
Misspellings, look-alike letters and your name next to words like invoice, login or support are checked every hour, country domains such as .de and .eu included.
Domains that already exist
The moment you switch Brand Protection on we also look back over recent registrations, so you start with the full picture, not an empty list.
Every spelling that matters
We take your domain and your company name and watch them in the spellings attackers use, including the ones you would never think of yourself. Using Microsoft as the example:
- Your name as a word or inside a word, like microsoft-login or securemicrosoft
- Misspellings: a letter added, dropped, swapped or replaced
- Look-alike letters: rn for m, vv for w, digits for letters, and Cyrillic or Greek characters that render like Latin ones
- Your real domain used as bait at the front of someone else's domain
- Local spellings: German umlauts written both ways, accents dropped, letters doubled
Your own domains are never flagged, and anything you mark as yours with one click stays yours.
Checked, not just matched
Plenty of honest businesses carry a brand name in their domain. Every candidate is checked the way our analysts would check it.
How old is it?
The registration date comes straight from the registry. A look-alike registered in the last 30 days is blocked right away.
Who registered it?
Large brands register their own domains through specialist brand registrars. Those are recognised as the brand's own and left alone.
Does anyone else know it?
When other security vendors already flag an older look-alike, it is blocked too. Every new sighting adds evidence, and a stronger signal turns a warning into a block.
Has someone decided?
A domain a person has reviewed stays decided. Everything that needs a human eye goes to our analysts.
Followed through every step an attacker takes
A look-alike is rarely used on the day it is registered. We follow it until it is, and tell you at every step.
Registered
The look-alike is found and a Microsoft Sentinel incident opens, with the domain as its entity.
Given a certificate
It gets the padlock it needs for a phishing page. A second, higher severity incident opens.
Set up for email
Mail servers or a sending service appear. You get an incident and an email, usually before the first fake invoice goes out.
Taken down
One click asks us to report it, with the evidence, to its registrar, its host and the browser blocklists, and follow it until it is gone.
What you get
In every enrolled browser
New or known-malicious look-alikes are blocked for every Cybereinforce user, so your colleagues are protected and so are the companies on our platform that do business with you.
Microsoft Sentinel incidents
One incident per step, with the look-alike domain as its entity, ready for your hunting queries and playbooks. Deployed from the Brand Protection page in one click.
Email to your administrators
The moment a look-alike gets ready to send email, so finance and customer teams can be warned before the first message arrives.
Every finding in your portal
How each look-alike imitates you, when it was registered, what we did about it, and a one-click takedown.
Extended Check
A deep search of existing domains imitating your brand, including parked, redirect-only and email-only ones, as a one-off check or with monthly runs, with a PDF report.
Takedowns
$199 per takedown, charged only once the domain is actually down. Nothing is due when you ask, and nothing if it stays up.
Pricing
Brand Protection is switched on from the Brand Protection page of your admin portal. Prices in USD, plus VAT where it applies.
Included
$0For Enterprise clients from 100 licences, one watched domain per 500 licences.
Brand Protection add-on
$29/monthBilled annually ($348 a year). Two domains included, extra domains $10 a month each.
Takedowns and Extended Check
$199 per takedownTakedowns are charged only when the domain is down. Extended Check is ordered per domain or as a bundle, one-off or monthly.
See all plans on the pricing page and every feature side by side in Compare Plans.
Questions we hear
Do I need Microsoft Sentinel?
No. Every finding is listed in your admin portal and your administrators get email. Sentinel incidents are there for teams that want look-alikes in their SOC workflow.
How quickly is a new look-alike found?
Within minutes of its first website certificate, within about an hour of registration for the names most likely to be used against you, and on the day of registration for everything else in the daily registration data.
Will my own domains or partners be blocked?
Your own domains are never flagged. If we find a domain that is really yours or a partner's, mark it as yours with one click and it is left alone.
Which brands are watched?
Your company name and your domains, in every spelling shown above. On top of that, more than 250 of the world's most impersonated brands, including every major Microsoft product, are watched for every Cybereinforce customer at no extra cost.
See which look-alikes of your brand already exist
Start a free trial, switch Brand Protection on, and we look back over recent registrations straight away.
Start Free Trial Read how it works Check a domain for free Talk to us