Digital risk protection · threat-actor intelligence
Brand protection that traces the operation.
Averrow finds lookalike domains, impersonation accounts and copycat apps aimed at your brand and executives, and files takedowns for lookalike domains and phishing URLs under your authorization. On the Enterprise plan, operation mapping groups phishing domains that share hosting or certificates into one operation, so you act on the operation, not one alert at a time.
Find the fakes, file takedowns, and on Enterprise, trace the operation.
Takedowns filed for each domain under your authorization; status updates as hosts act.
Fictional example · operation mapping is on the Enterprise plan
- Domain foundacme-payroll-login.example turns up in phishing intelligence and is matched to Acme.
- Infrastructure linkedShared hosting and one shared TLS certificate tie it to 13 more phishing domains.
- Operation mappedOn Enterprise, the cluster becomes one operation. A known actor is shown only where public reporting names one; this one is fictional. Related findings, shown dashed, are reviewed alongside.
- Takedowns filedTakedowns are filed for each domain under your authorization, at the automation level you choose. Status updates as registrars and hosts act.
- Lookalike domains
- TLS certificates
- Email authentication
- Social profiles
- Executive impersonation
- App stores
- Dark web
- Abuse mailbox
You set the rules. We do the filing.
Every finding arrives with its evidence. Sign an authorization, set your rules, and Averrow files abuse reports for lookalike domains and phishing URLs with registrars and hosting providers for you, within your rules. Registrar reports can go out automatically. Revoke the authorization any time.
- Foundacme-payroll-login.exampleHighlive login page
Lands in your queue with its severity and what it's serving.
- EvidenceCharacter-swap lookalike of acme.exampleLive web serverMail (MX) records set upResolves to 203.0.113.24
An evidence summary is assembled automatically for every draft.
- Your rulesDraft readyWaits for younothing goes out automaticallyWaiting for your approvalWithin your monthly limitlimit set by you
You approve each one, and our team files it.
Takedowns outside your rules wait until someone on your team approves them. You can make that all of them.
Filed automatically within your rules and any monthly limit you set.
- FiledReport sent to the registrarticket 48213 · awaiting response
Every submission, with the provider's response and ticket number where there is one.
- WatchedRemovedDownre-checked · alert if it returns
Removed domains are re-checked, and you're alerted if one comes back.
- FoundLands in your queue with its severity.
- EvidenceAssembled automatically.
- Your rulesOff, semi-auto or auto.
- FiledEvery submission, with the provider's response and ticket number where there is one.
- WatchedAlerted if a removed domain returns.
- Domains and phishing URLs Submitted under your authorization, at the level you choose. Our analysts file only what your rules allow or you’ve approved.
- Social profiles, apps and paste sites Drafted with evidence, ready to file with the platform. Paste sites on Business and up.
- How you hear In your console. On Business and Enterprise, also sent to your webhook or SIEM when an alert is raised, set up with our team.
Where attackers pretend to be you.
Eight places impersonation happens, watched continuously. Every finding lands in one queue.
-
Lookalike domains
Professional+Character-swap and brand-plus-keyword domains, checked when they appear and re-checked until they're gone.
acme-payroll-login.examplelive login pageHighacmw.exampleregistered · parkedMediumacme-support.examplenot registered · watchingWatch2,300+ registered lookalikes found in the last 30 days
-
TLS certificates
Professional+Certificate-transparency checks every hour for certificates issued to brand-like names.
acme-login.exampleNew certissued 2 hours ago -
Email authentication
Professional+SPF, DKIM and DMARC checked, with one grade for your domain.
OverallC- SPFpass
- DKIMpass
- DMARCmissing
-
Social profiles
Professional+Impersonation accounts and handle squatting on six major networks.
- X
- TikTok
- GitHub
- YouTube
@acme_supportInstagram · not your official accountLikely fake -
Executive impersonation
Professional+Accounts using your executives' names, flagged when they aren't their official handles.
J. Rivera, CFOReviewX · not their official handle -
App stores
Professional+Copycat apps using your name on the Apple App Store.
“Acme Pay”Copycatdeveloper is not Acme -
Dark web
Business+Mentions of your brand on paste sites and ransomware leak sites.
Paste site mentionReview“acme.example staff list”, 2 days ago -
Abuse mailbox
EnterpriseA branded inbox for suspicious emails, classified automatically and fed into your threat queue.
Reported by an employeePhishingadded to your threat queue
-
Lookalike domains
Professional+Character-swap and brand-plus-keyword domains, checked when they appear and re-checked until they're gone.
acme-payroll-login.examplelive login pageHighacmw.exampleregistered · parkedMediumacme-support.examplenot registered · watchingWatch2,300+ registered lookalikes found in the last 30 days
Learn more about lookalike domains → -
TLS certificates
Professional+Certificate-transparency checks every hour for certificates issued to brand-like names.
Learn more about tls certificates →acme-login.exampleNew certissued 2 hours ago -
Email authentication
Professional+SPF, DKIM and DMARC checked, with one grade for your domain.
OverallCLearn more about email authentication →- SPFpass
- DKIMpass
- DMARCmissing
-
Social profiles
Professional+Impersonation accounts and handle squatting on six major networks.
- X
- TikTok
- GitHub
- YouTube
Learn more about social profiles →@acme_supportInstagram · not your official accountLikely fake -
Executive impersonation
Professional+Accounts using your executives' names, flagged when they aren't their official handles.
Learn more about executive impersonation →J. Rivera, CFOReviewX · not their official handle -
App stores
Professional+Copycat apps using your name on the Apple App Store.
Learn more about app stores →“Acme Pay”Copycatdeveloper is not Acme -
Dark web
Business+Mentions of your brand on paste sites and ransomware leak sites.
Learn more about dark web →Paste site mentionReview“acme.example staff list”, 2 days ago -
Abuse mailbox
EnterpriseA branded inbox for suspicious emails, classified automatically and fed into your threat queue.
Learn more about abuse mailbox →Reported by an employeePhishingadded to your threat queue
What the platform sees, counted plainly.
Counts since launch. Hover or focus a bar for its share of classified threats.
- SOC 2 Type I in preparation
- Sub-processors listed in our DPA
- Customer data is never used in public numbers