Campaign intelligence Enterprise

See the operation, not just the symptom.

Attackers reuse certificates and hosting. We link the lookalike domains that share them into one operation, so you see the campaign behind each alert.

Scan your domain Book a demo
Illustrative Fictional brand, example domains
Four lookalike domains linked into one operation Illustrative graph. Acme-login, acme-pay and acmw share one certificate. Acmw and acme-help share hosting. Because the two shared items overlap on acmw, all four domains are linked into one operation. acme-login.example acme-pay.example acmw.example acme-help.example Shared certificate Shared hosting One operation
Four lookalike domains, linked through a shared certificate and shared hosting, resolve to one operation.
active operations
2,900+
threats tracked
1.2M+

How we count each number

How it works

Record, link, name.

Domains get taken down and new ones appear. The certificates and hosting behind them are slower to change, and that reuse is the signal.

  1. Record

    Every new threat is recorded with the hosting and certificate details we can observe.

    acme-login.example Recorded Hosting and certificate details recorded
    acme-pay.example Recorded Hosting and certificate details recorded

  2. Link

    Threats that share certificates or hosting are connected into one operation, instead of being logged as unrelated.

    acme-login.example Linked Shares a certificate with acme-pay.example
    acmw.example Linked Shares hosting with acme-help.example
    four domains, one operation

  3. Name

    Where public reporting names the actor behind infrastructure we've clustered, we link it. If the evidence doesn't support a name, we don't give one.

    Operation 4821 Public report An actor named in public reporting

Record

Every new threat is recorded with the hosting and certificate details we can observe.

acme-login.example Recorded Hosting and certificate details recorded
acme-pay.example Recorded Hosting and certificate details recorded

Link

Threats that share certificates or hosting are connected into one operation, instead of being logged as unrelated.

acme-login.example Linked Shares a certificate with acme-pay.example
acmw.example Linked Shares hosting with acme-help.example
four domains, one operation

Name

Where public reporting names the actor behind infrastructure we've clustered, we link it. If the evidence doesn't support a name, we don't give one.

Operation 4821 Public report An actor named in public reporting
What you get

Alerts and a campaign on every threat.

You don't learn a new dashboard. The campaign shows up where your team already works, and the alerts reach you when it matters.

Illustrative Fictional brand, example domains
A significant campaign is targeting Acme Campaign alert Alert, with the campaign it belongs to
A known threat actor is targeting Acme Actor alert Alert, with the actor from public reporting
acme-login.example Campaign 4821 Shows the campaign this threat belongs to
  • Alerts that matter. You're alerted when a significant campaign or a known threat actor targets your brand.
  • The campaign on each threat. Every linked threat shows the campaign it belongs to.
  • Actors from public reporting. Where reporting names the actor, we show it. We don't guess.
From pattern to action

Takedowns, under your authorization.

Takedowns for lookalike domains and phishing URLs run under an authorization you sign and control, within limits you set, at the automation level you choose: Off, Semi-auto or Auto. Nothing is filed without your approval or your signed rules, and you can revoke the authorization at any time. See how takedowns work.

Scope

What's covered, and what isn't.

Every claim on this page has a limit. These are the limits.

Campaign intelligence: covered and not covered
Area Covered Not covered
Which threats Lookalike domains and other domain and IP threats against your brand. Social accounts, apps, leak-site mentions and executive findings are not linked into operations.
How they're linked Shared certificates and hosting. A guarantee that every related domain is found. Infrastructure we can't see isn't linked.
Alerts You are alerted when a significant campaign or a known threat actor targets your brand. An alert for every campaign. Only significant ones, or ones tied to a known actor, reach you.
On each threat The campaign it belongs to, shown with the threat. A full operation map in the console. Today you see the campaign link on each threat.
Actors Where public reporting names the actor behind clustered infrastructure, we link it. Naming who is behind an operation when public reporting doesn't.
Removal Takedowns for lookalike domains and phishing URLs, under an authorization you sign. Filing anything without your approval or your signed rules.

Which threats
Covered
Lookalike domains and other domain and IP threats against your brand.
Not covered
Social accounts, apps, leak-site mentions and executive findings are not linked into operations.

How they're linked
Covered
Shared certificates and hosting.
Not covered
A guarantee that every related domain is found. Infrastructure we can't see isn't linked.

Alerts
Covered
You are alerted when a significant campaign or a known threat actor targets your brand.
Not covered
An alert for every campaign. Only significant ones, or ones tied to a known actor, reach you.

On each threat
Covered
The campaign it belongs to, shown with the threat.
Not covered
A full operation map in the console. Today you see the campaign link on each threat.

Actors
Covered
Where public reporting names the actor behind clustered infrastructure, we link it.
Not covered
Naming who is behind an operation when public reporting doesn't.

Removal
Covered
Takedowns for lookalike domains and phishing URLs, under an authorization you sign.
Not covered
Filing anything without your approval or your signed rules.
Related

Campaign intelligence builds on the rest of the platform

See the operation behind your alerts.

Campaign intelligence is part of the Enterprise plan. Book a demo and we'll show it running against your own brand.

Scan your domain Book a demo