Product

Every capability, with its limits written down.

Each section below states what the component does, what it deliberately does not do, where its data comes from, what it produces, and its state today.

Discovery engine

Operational

What it does: Continuously reads Certificate Transparency logs and supporting sources to find newly issued certificates whose names relate to the brands you monitor.
What it does not do: Does not crawl the open web, does not scan your network, and does not detect malware or pirated software.
Data source: 9 active Certificate Transparency logs, crt.sh, Censys. The active log set is refreshed by the system itself.
Output: Raw domain observations with source and first-seen timestamp.

Candidate scoring

Operational

What it does: Turns a raw observation into a scored candidate using string distance, substitution patterns, keyword placement and certificate newness.
What it does not do: Does not decide that a domain is malicious. The score orders a review queue; it is not a verdict.
Data source: Discovery engine output plus the brand's declared legitimate domains.
Output: A candidate record carrying a pre-score and the signals that produced it.

Domain evasion detection

Operational

What it does: Resolves homograph characters, leetspeak substitutions, punycode and internationalized domain forms before comparison, so visually similar names are not missed.
What it does not do: Does not claim exhaustive coverage of every possible evasion technique.
Data source: Normalization and scoring modules in the discovery pipeline.
Output: A normalized comparable form plus the specific evasion signals detected.

Sentinel

Available

What it does: A small script placed on your own site. If the page is copied and served from another domain, it shows the visitor a notice pointing to your real address. The notice renders before any network request completes.
What it does not do: Does not block the copied page, does not redirect silently, and does not collect visitor identity.
Data source: Runs in the visitor's browser on the copied page.
Output: A visible notice, and optionally an anonymous observation if the observation channel is enabled.

T0 observations

Disabled by default

What it does: When explicitly enabled, records anonymous reports from a copied page, including a bot-or-human classification derived from browser signals.
What it does not do: Does not accept identity fields, does not accept a trust claim from the client, and does not produce an enforcement decision. Every record is stored as unverified.
Data source: The Sentinel script on a copied page, resolved to a tenant server-side through a site token.
Output: An anonymous, unverified observation scoped to one tenant.

Evidence

Internal

What it does: Assembles the source, timestamp, certificate reference and contributing signals of a finding into a package suitable for a registrar or hosting complaint.
What it does not do: There is currently no public download interface for evidence packages.
Data source: Stored candidate and observation records.
Output: An evidence package. Available through the operations team today.

Tenant isolation

Operational

What it does: Separates every brand, candidate and observation by tenant at the database level, so one customer's data cannot be read from another customer's session.
What it does not do: Does not rely on the application layer alone. Ownership is part of the data model, not a filter added afterwards.
Data source: Row-level security policies and ownership columns verified with a second tenant.
Output: Queries return only the calling tenant's rows.

System health

Operational

What it does: Reports live worker instances, their age, the active source count and the freshness of the numbers shown.
What it does not do: Does not display an uptime percentage, because uptime is not currently measured.
Data source: Worker heartbeats and the summary endpoint.
Output: Live instance list with per-instance age in seconds.

Sample report →