Frequently asked questions
Straight answers about what we do, how we do it, and what we cannot promise.
What does "unlimited takedowns" mean?
There is no charge per takedown. Your monthly fee covers the takedowns we run for the brands and regions in your agreement. The scope is set out in your contract, so there are no surprises.
What is the difference between a URL takedown and an infrastructure takedown?
A URL takedown removes one page. An infrastructure takedown goes after everything behind it as well: the hosting account, the domains and registrar account, the DNS, the certificates, the redirectors and the collection points. That is what stops the same attack from returning on the next name.
Which attacks do you handle?
Phishing and malware attacks that impersonate your brands or target your customers, and the infrastructure that supports them, such as redirectors, senders and collection points.
How fast do you work?
Speed depends on how quickly each provider responds. We report to every responsible party in parallel, follow up, and escalate when a provider does not act. We will agree reporting and follow-up targets with you.
Can you guarantee removal?
No one can. Providers decide. We raise the chance by reporting to every layer, with strong evidence, and by escalating. We also ask security vendors to block while the takedown runs, so that your customers are protected in the meantime.
How do you handle evidence?
Captures are stored unchanged with cryptographic hashes. Every report states what was seen, when, and how, so that providers and investigators can rely on it.
Do you touch the attackers' servers?
We only view what an ordinary visitor can see, from controlled connections. We never enter data into attacker pages, interact with their control panels, or defeat access controls. Attacker code is read as text and is never run on a machine that matters.
What do you do with what you learn?
We turn it into fingerprints and indicators for our detection systems, and use them to find adjacent infrastructure. Where it is lawful and appropriate, we share indicators with the organisations that protect the wider internet.
Can you work with the police or national CERTs?
We can prepare evidence packages suitable for police and national CERTs, and pass cases on when you want that. Whether and when to involve them is your decision.
How do we get started?
Request a briefing. We will walk you through the service and how it would apply to your brands, regions and current process.
Which languages do you work in?
The service and this site are available in English and Japanese. Reports to providers are written in the language each provider's abuse desk works in.
Let us show you how deep we go.
Request a briefing and we will walk you through the service, the process, and how it would apply to your brands.