Questions to settle before you request access.
Short answers. Where we have not measured something, we say so instead of guessing.
Takedowns and billing
What counts as a takedown?
The page is no longer served to an ordinary visitor, our own re-check confirms it, and it stays that way for seven days. A registrar or registry hold on the domain counts if it lasts seven days.
When are we charged?
Only for a verified removal that follows our notice: $295 with a monitoring plan, $425 without, or one credit from a prepaid pack. A card must be saved before you request a takedown, and nothing is charged when you do.
Do we need a monitoring plan?
No. A single takedown is $425 with no subscription. Monitoring starts at $49 per brand per month and brings each takedown to $295.
What if the page comes back?
A removal that reverses within seven days is not billed. A page that comes back after that is a new case, billed the same way.
Do you charge for a browser warning?
No. Safe Browsing or SmartScreen blocklisting leaves the page live, so we report it and never charge for it.
How long does a takedown take?
We do not publish a time. We have no measured case history yet, and we will not quote a figure we have not measured.
Can you promise removal?
No. Some registrars ignore notices, some hosts require a court order, and attackers re-register. A takedown is charged only when the removal is verified.
Notices and approval
Who do you send the notice to?
The party that can act: the host first, and the registrar if the host does not. Behind a proxy, we first ask it to disclose the host. An unidentified host gets no notice.
Who approves a notice?
Your request for a takedown is your go-ahead. A person on our side then approves each notice before it is sent, and a notice with a blank field cannot be sent at all.
Do we have to sign anything?
Yes, for copyright and trademark notices, because they assert that you own the rights. We never sign one for you. Phishing and malware reports state what we observed and need no signature.
Will the attacker know we found them?
They can. When we check a suspected page, its operator can see the visit. That is one reason the timing of action is yours to control.
What we need from you
What do you need from us to start?
Your domain, the other domains you own, and any partners or resellers we should never flag. We work out the lookalike names to watch from your domain.
How does access work?
There is no self-signup. You request access, a person reviews the request, and we check that you control the domain and own the brand before we open an account.
Coverage
What do you watch?
Certificate logs, within minutes of a certificate being issued; new .com, .net and .xyz registrations, within about 24 hours; and feeds of confirmed-malicious domains, within hours.
What can't you see?
Country-code domains before they get a certificate, dormant domains with no certificate, subdomains behind wildcard certificates, and impersonation on social media, app stores, ads, marketplaces and messaging. We catch some compromised sites, and only after someone reports them.
Do you get past CAPTCHAs or cloaking?
No. We do not bypass CAPTCHAs or bot checks. A page that looks harmless to us is marked inconclusive, never clean.