Cybereinforce Threat Enforcement

Free IOC Lookup: see what Cybereinforce does with any domain or URL

• NewFree IOC Lookup at cybereinforce.com/community/ioc-lookup: paste a domain or URL, defanged or not, and see whether Cybereinforce blocks it, warns about it or lets it open. Answers come from our full threat intelligence and the same live phishing checks the browser extension runs, including brand look-alikes and newly registered domains. Ten free lookups a day.
• NewDomains we haven't seen before are queued for Cybereinforce analysts. Leave your email address and we'll send you the verdict. Every result also lets you report a false positive, suggest a category or ask us to block something.
• NewSign in to the IOC Lookup with your Microsoft work account and join the free Cybereinforce community: 100 lookups a day instead of 10, and the reasons behind every verdict, such as brand look-alikes, domain age and high-abuse domain endings. It is our gift in return for the weekly Cybereinforce threat newsletter.
• NewMembers can also get a daily email with the free threat intelligence to block, the same list we share on LinkedIn.
• ImprovedCybereinforce Threat Intelligence now judges every newly registered domain, not only brand look-alikes. Names built for phishing (account, login and recovery wording), machine-generated names and domains on nameservers known for abuse are blocked or flagged on the day they appear in the registry.
• ImprovedCybereinforce clients just sign in to the IOC Lookup: 100 lookups a day, and 200 for client administrators, with the reasons included and nothing to join.
• NewThe weekly Cybereinforce threat newsletter for community members: what our threat watch saw that week, a story from our Insights, and new domains worth blocking. New members get a welcome email with everything they can use.
• ImprovedExtended Check: pick the domains to check in each option, one domain or up to 10 domains, one-off or with monthly runs, with tick all and untick all for long lists. The price updates as you tick, and the check runs for, and reports on, exactly the domains you chose.
• NewBrand Protection now has its own page at cybereinforce.com/brand-protection.html: how look-alikes of your brand are found, checked and blocked, what you get, and the pricing.
• NewSearch the whole website: press the Search button in the menu, or / or Ctrl+K on any page, to find products, pricing, articles and tools as you type.
• ImprovedOne clear menu on every page of the website, with Products, Pricing, Partners, Resources and Support, so every product and tool is two clicks away.
• ImprovedFree trials now include Cybereinforce Threat Intelligence, as on the Corporate plan: the curated threat feed and the live checks for newly registered domains, brand look-alikes and phishing lures, switched on from the first day. Trials that are already running get it too.
• ImprovedMarketing Resources at cybereinforce.com/Marketing brought up to date: new one-pagers for Threat Intelligence, Brand Protection, Device Code Attack Protection and Deployment & Integrations, a new Defender & XDR one-pager, a second edition of the whitepaper and refreshed presentations.
• NewCybereinforce Brand Guidelines in Marketing Resources at cybereinforce.com/Marketing: how to name, show, colour and write Cybereinforce, with the logo to download, for partners, MSSPs and agencies. All one-pagers, briefs, the whitepaper and decks now show the Cybereinforce name in one colour.
• NewA 90-second introduction video on the home page: get to know Cybereinforce in German or English. Visitors from Germany, Austria and Switzerland see the German version first, everyone else the English one, and a switch changes it at any time.

Deeper look-alike coverage: every existing domain checked, all Microsoft products protected

• ImprovedThe brand watch now checks every domain already registered in the extensions we monitor, not only new registrations, and now also covers country domains whose registries publish them: Sweden (.se), Switzerland (.ch), Liechtenstein (.li), Estonia (.ee), Slovakia (.sk), France (.fr) and .nu. Look-alikes registered before monitoring began, such as names that combine a brand with other words, are found and blocked too.
• ImprovedBrand look-alikes registered at any point in 2026 are now added to the threat feed automatically: blocked when the evidence is strong (a misspelling, look-alike characters or a phishing word next to the brand), otherwise shown with a warning.
• NewEvery major Microsoft product is now protected as part of the Microsoft brand: Copilot, Azure, Entra, Intune, Teams, Outlook, OneDrive, SharePoint, Power BI, Dynamics 365, Fabric, Defender, Sentinel, Purview, Exchange, Skype, Xbox and more. Everyday words such as Teams or Fabric count only when they appear next to a phishing word, so ordinary businesses are not affected.
• NewFree community tools at cybereinforce.com/community, starting with the PHP2Shell Checker: enter any domain to see which PHP version it shows and whether that version is in range of CVE-2026-109618 and CVE-2026-109619. It recognises Linux distribution packages that carry backported fixes, never attempts the vulnerability, and does not store the domains checked.

Newly registered domain monitoring, look-alike lifecycle alerts and a much larger brand watch

• NewNewly registered domain monitoring: every day, newly registered domains across hundreds of domain extensions, from .com to country domains, are checked against the brands we protect. Lookalikes are caught as early as the day they are registered, often before they host a website or send a single email.
• ImprovedThe brand watch now covers more than 250 of the world's most impersonated brands, including banks, payment and crypto services, couriers and government portals across Europe, Turkey, the Gulf, the Americas and Asia, and recognises phishing vocabulary in eight languages.
• ImprovedClear impersonations are blocked straight away; weaker matches on unused domains are marked suspicious and upgraded to a full block the moment the domain is used.
• ImprovedBrand Protection: when you switch it on, we also look back over recent registrations for lookalikes of your brand, so you start with a full picture.
• ImprovedDomains that were dropped and then bought again by someone new are treated as newly registered, whatever reputation their previous owner built up.
• ImprovedFaster decisions on new domains: the registration day of recently registered domains is known instantly from our own registration history, even when a registry is slow to answer.
• NewBrand Protection takedowns: ask us to take a look-alike of your brand down with one click. We report it with the evidence to its registrar, its hosting provider and the browser blocklists, and follow it until it is gone. $199 per takedown, charged only once the domain is down.
• NewBrand Protection now follows each look-alike of your brand through the steps an attacker takes before using it: registered, given a website certificate, set up for email. Each step opens its own Microsoft Sentinel incident, and the moment a look-alike gets mail servers or a sending service you also get an email, usually before the first phishing or fake-invoice message goes out.
• NewHourly look-alike check: the names most likely to be registered against your brand (misspellings, look-alike letters, your name with words like invoice, login or support) are checked every hour across 40 domain extensions, country domains such as .de and .eu included. A new look-alike is seen within about an hour of registration, with or without a website.
• ImprovedMulti-word company names are recognised when an attacker separates the words with hyphens.
• ImprovedThe Brand Protection page shows which steps each look-alike has reached, and how many are already set up for email.
• ImprovedSuccessful takedowns are confirmed with their own email: what was taken down, how we know, and that the invoice goes to your tenant administrators.
• NewExtended Check: a deep search of existing domains imitating your brand, including inactive, parked, redirect-only and email-only domains registered in the last 12 months. Available to every client as a one-off check or with monthly runs, with the results by email, in Microsoft Sentinel and as a downloadable PDF report.
• NewOrder Brand Protection, extra domains and the Extended Check directly on the Brand Protection page. Your invoice arrives straight away as a PDF for all your tenant administrators, and the service starts automatically as soon as your payment is confirmed.
• ImprovedPurchase orders: your invoice is now created and emailed as a PDF the moment you submit the order. Download it any time on the Purchase Order page, follow each step, and let us know with one click when you have paid.
• ImprovedWatched domains are locked once added, with a clear confirmation, so your Brand Protection always covers the domains you chose.

Warnings for suspicious sites, day-zero protection, company-wide deployment and one-click integrations

Warnings and policy enrollment are delivered by extension 1.3.1.

• NewNewly registered domains are blocked in the browser across 1,100+ TLDs, so a phishing site that went live minutes ago is stopped before any threat feed knows it. Domains under 6 months old are blocked; domains 6 to 12 months old show a warning page, so legitimate young sites stay reachable while users are told to take care.
• NewBrand Protection: your own domains and company name are watched in every spelling (misspellings, swapped letters, lookalike characters, foreign alphabets) across every newly issued website certificate and every site your users open. Lookalikes are blocked for all Cybereinforce users, and you get a Microsoft Sentinel incident (with the lookalike domain as its entity) and an email the moment one is found. Included in Enterprise, available as an add-on for every other plan, with a separate Sentinel analytics rule on the new Brand Protection page.
• NewBrand impersonation watch: every newly issued website certificate worldwide is checked for look-alikes of major brands (misspellings, swapped letters, look-alike characters). New impersonation domains join Cybereinforce Threat Intelligence within minutes, usually before the first phishing email is sent, and reach your browsers and Microsoft Defender automatically.
• NewDevice Code attack protection on by default: the Microsoft device-code sign-in page is blocked for every organisation, with whitelisting for legitimate use.
• NewSuspicious verdict: threat-intelligence entries are either malicious (blocked) or suspicious (users see a warning and may continue at their own risk). Everything is malicious unless an analyst explicitly marks it suspicious.
• NewBlock or Warn per rule. Microsoft Defender indicators set to Warn are enforced as warnings, and Enterprise IOC submissions can also be answered as suspicious.
• NewCompany deployment: a Windows script for Intune, Group Policy and Defender for Endpoint, and a macOS configuration profile, that install and enroll the extension for every user, profile and browser. Private windows stay available and protected.
• NewDirect Sentinel Export with a single Azure deployment: pick your workspace from a list, no app registration, no secrets to copy. Test first, then switch it on.
• NewDefender IOC import deployed from the console: Azure opens with your Cybereinforce token and app Client ID filled in, every setup button opens the right screen of your own app, and the import runs every 2 minutes unless you choose otherwise.
• NewPlain-language Defender import status: connected, last check-in, indicators in Defender, and what to fix if Defender refuses the import. Client-secret expiry reminders 30 and 7 days ahead.
• NewIntegrations has its own section in the admin console: a dashboard showing whether the Defender IOC import and the Sentinel export are active, when they last checked in and what needs attention, plus a page for each with setup, status and settings together.
• NewSentinel incidents for silent failures: devices that stop checking in, outdated extensions, private windows left unprotected, integrations that stop or are rejected, expiring secrets, and users who continue past a warning.
• NewAutomatic seat management: seats held by long-absent devices are reclaimed, and waiting devices switch on as soon as a seat is free.
• NewLearning loop: high-confidence automatic blocks are reviewed and added to the shared threat intelligence that protects every customer.
• NewPublic Threat Intelligence & Detections, Device Code Attack and Release Notes pages, and new Insights articles with detection videos.
• ImprovedWhile Direct Sentinel Export is on, Cybereinforce keeps no per-event data at all, only daily counts; switching it on moves existing events to your workspace. Events carry the exact time they happened (EventTime).
• ImprovedRetention follows your plan: 7 days (Trial), 30 days (SME), 90 days (Corporate), 365 days (Enterprise). Daily block counts are kept for 12 months on every plan.
• ImprovedDefender integration: your administrators decide whether device groups and domain indicators are imported, and the import only needs read access to Defender indicators.
• ImprovedIntegrations never break: connected Defender and Sentinel integrations keep working when integration tokens are rotated or revoked, and can be disconnected one by one.
• ImprovedJoin page: the extension installs without leaving the page, the right store opens for each browser (also Chrome, Edge, Brave and Firefox on a Mac), and enrollment starts by itself as soon as the extension is ready.
• ImprovedFaster threat checks; the Events page shows the newest events first; token and join-link history is paginated; daily health checks cover every region.
• ImprovedPrivacy policy describes exactly what the extension sends.
• ImprovedRules show when they were added and by whom or what (an administrator, the Defender import, an MSSP feed, Cybereinforce analysts).
• ImprovedBrowser Endpoints show when each browser was first seen, next to when it was last seen.
• ImprovedRules imported from CSV or JSON files are always added to your own organisation in its data region, with their date and author.
• ImprovedTokens & Deployment leads with Company enrollment: the Windows script (cybereinforce-deploy.ps1) and macOS profile (cybereinforce-macos.mobileconfig), with a step-by-step guide for Intune, Defender for Endpoint, Group Policy and Mac management, each with its own download button. Manual enrollment options follow below.

Faster TLD blocking and a cleaner threat feed

• ImprovedTLD blocking decisions are faster thanks to cached region resolution.
• ImprovedThreat intelligence feed refreshed and cleaned of false positives.
• ImprovedThe public status page judges each day against the SLA target.

New browser detections and MSSP partner programme

• NewWordPress password-reset link abuse is detected and blocked in the browser.
• NewMachine-generated (DGA) domains on risky hosting are blocked, and suspected device-code lure pages are recognised by their content.
• NewThe .claim and .support TLDs are blocked by default, following their use by an active extortion group.
• ImprovedThe TLD coverage catalog was extended with .xyz and 13 more TLDs.
• ImprovedThe partner programme and portal are now the MSSP programme.
• SecurityEnrolled devices switch to their own long-lived credential on their first check-in and stay connected for good.
• SecurityEnrollment links and policies are checked strictly at every use.

Self-service account deletion

• NewOrganisations can delete their account and data themselves; contractual records are kept as required by law.
• ImprovedYour data region is fixed at sign-up and new regions are provisioned automatically.
• ImprovedSigning in with Microsoft recognises your organisation by its Microsoft Entra tenant.

Real-time brand-lookalike detection and TLD blocking

• NewBrand-lookalike and generic-hosting-abuse detection in the browser, in real time.
• NewSelf-service TLD blocking: block whole top-level domains for your organisation.
• NewPhishing pages hosted on Google Cloud Storage are blocked by pattern, and a curated list of high-risk TLDs is enforced.
• ImprovedBlocks name the exact indicator that matched.

Data regions, MITRE ATT&CK tagging and near-real-time Sentinel export

• NewChoose where your data lives: seven data regions, with your organisation's data kept in its region.
• NewMITRE ATT&CK tactic tagging for rules; Command & Control rules can never be exempted.
• NewException categories: manage one set of group and device exemptions for many rules.
• NewAction-aware Defender sync: Allow indicators become exemptions for the right Defender device groups.
• NewNear-real-time direct export to Microsoft Sentinel.
• NewArchitecture Reference for IT, security and SOC teams in the admin console.

MSSP portal, IOC submissions and the public status page

• NewMSSP portal: partners manage client organisations, threat intelligence and custom block pages, with partner credits and pay-as-you-go.
• NewEnterprise IOC submissions: send suspected domains and URLs to our analysts; confirmed threats are blocked for you and shared with every customer.
• NewPublic status page with synthetic end-to-end monitoring against the SLA.
• NewAvailable on the Microsoft Commercial Marketplace.
• ImprovedOne-click links and the deployment script name each device after its computer automatically.
• ImprovedDevices waiting for a seat are activated as soon as one is free.

Threat intelligence expansion

• ImprovedLarge update of the threat-intelligence corpus, with coverage-gap reporting.

Redesigned admin console

• NewThe admin console is organised into dedicated pages: dashboard, devices, rules, tokens and deployment, events, integrations.
• ImprovedNew Cybereinforce logo and refreshed branding.

Custom block pages

Organisation-branded block pages need extension 1.2.0 or later.

• NewCustomisable block page: your logo, title, message, help text and support contact.
• ImprovedEvery event exported to Sentinel uses one consistent format.

ISO/IEC 27001 certification and the Trust Center

• NewISO/IEC 27001 certified: independent certification of how the service is designed, built and operated.
• NewTrust Center and published information security policy.
• NewInsights: articles on browser threats and Microsoft security.
• ImprovedClearer sign-in flow, and better handling for invited administrators.
• SecurityHardened administration access.

Safari, multiple administrators and vendor comparison

• NewSafari support on macOS, iOS and iPadOS.
• NewSeveral administrators per organisation, with one organisation per company domain.
• NewPublic vendor comparison and browser extensions pages.

Cybereinforce Threat Intelligence and plan tiers

• NewCybereinforce Threat Intelligence: a curated feed of hundreds of thousands of malicious domains and URLs, switched on per organisation.
• NewPlan tiers from Standard to Enterprise, each with its own capacity and features.
• NewTerms acceptance and refreshed branding.

Defender and Sentinel deployment templates

• NewOne-click Azure templates for the Defender indicator sync Logic App and the Sentinel data collection resources.
• NewSentinel analytics rules and a workbook for Cybereinforce events.
• ImprovedLower ingestion cost for exported events.

Microsoft Defender indicator sync

• NewMicrosoft Defender for Endpoint indicators are synchronised into browser enforcement through a Logic App in your own tenant.
• NewSentinel export through a Data Collection Endpoint and Rule in your own subscription.
• NewPurchase orders and invoicing.

First release

• NewAdmin console with device inventory, enable/disable and renaming.
• NewDevice enrollment with enrollment tokens and one-click join links.
• NewBlock rules for URLs and domains, with validation and bulk import (including Microsoft Defender exports).
• NewBlock page and security events for every block; audit log of administrative changes.
• NewSeat licensing: devices beyond your licence wait on hold instead of running unprotected.
• NewIntegration tokens for Microsoft Sentinel event export.