From one report to the whole operation
Every case follows the same five steps. What differs is how far each step goes. We do not stop when the first page disappears.
Detect
Reports reach us from your own channels, such as abuse mailboxes, customer reports and fraud desks, and from our monitoring of attacks against your brands. Every report becomes a case.
- What we need from you: your brands and logos, the places where customers report attacks, and one authorised contact.
- Before anything is sent, we confirm that the page really impersonates you.
Investigate and map
We capture the page as a victim would see it, because attack pages often show different content to different visitors, and we store the evidence unchanged with cryptographic hashes. We read the attacker's code as text; it is never run on a machine that matters. Then we map every domain, address, host, redirector, name server and certificate it points to.
- Sibling infrastructure: other names registered in the same pattern, other servers running the same kit.
- Collection points: where the stolen data is sent.
Report to every responsible party at once
We match each part of the infrastructure to the provider that can act, using a maintained registry of providers and the channels each one accepts. Each recipient gets a report written for them, with the evidence they need. Reports go out in parallel, not one after the other.
- Hosts and cloud providers, registrars and registries, DNS providers, certificate authorities, link services.
- Browser and security vendors, so that users are protected while takedowns are still running.
Escalate and verify
We follow up on every report. When a provider does not act, we escalate through the next channel, up to the registrar, the registry or another responsible party. We verify that the content is really gone, not just that a ticket was closed.
- Outcomes are tracked per layer, so nothing is forgotten once the page itself is down.
Stay down and learn
We keep watching the whole infrastructure for reappearance and report again if it returns. Everything we learn goes into our detection systems as fingerprints and indicators.
- Findings can be turned into detection rules, so adjacent infrastructure can be found early.
What you receive
Nothing is a black box.
Status for every case
What was reported, to whom, when, and what happened.
An evidence file
The captures, hashes and findings behind each report.
Outcome verification
A check that the content is gone, not only a closed ticket.
Intelligence
Indicators and fingerprints from your cases that you can use in your own systems.
Rules of engagement
Investigating attackers carefully is part of the job.
We keep to a few firm rules.
We look, we do not touch
We only view what an ordinary visitor can see, from controlled connections. We never enter data into attacker pages or interact with their control panels.
We never defeat access controls
Logins, challenges and other barriers are not bypassed.
We read attacker code as text
Attacker code is read as text and is never run on a machine that matters.
We name infrastructure and behaviour, not people
Our reports describe what a resource does. We do not accuse individuals.
Let us show you how deep we go.
Request a briefing and we will walk you through the service, the process, and how it would apply to your brands.