Evidence pack
URL, timestamps, DNS and RDAP when collected, the hosting map, abuse contacts, and the notice text. An empty or degraded lookup is not attribution.
Product
A takedown system, with the hosting map attached.
Category: digital risk protection, brand protection, and threat takedown. For any company whose name is reused on phishing sites, in app stores, and in support chats. Finance, e-commerce, SaaS, and retail are examples.
What the console covers
- Lookalike and lure domains. Typosquat, homoglyph, keyword, and lure domains, with DNS, RDAP, and hosting attribution.
- Hijacked legitimate sites. Redirect chains and page titles are recorded. An analyst confirms a hijacked legitimate site before a case proceeds.
- Social impersonation. Handle patterns for X, Telegram, Discord, YouTube, Facebook, and Instagram. Live checks use public APIs.
- Fake apps and extensions. Fake apps and extensions are logged as leads and taken through the same case.
- Cloaking and redirects. CDN hints, one-hop redirects, and analyst notes for cloaking or geo-fencing.
- Infrastructure clustering. Candidates that share an ASN, registrar, nameserver suffix, or certificate name are grouped.
Parties, not a single email
Registrar, host, CDN, and platform each have a status: prepared, held, sent, acknowledged, removed, refused, or follow-up due. The case rolls up from those rows. A missing fact is named in the notice.
APAC and everywhere else
Notices render in Chinese or English from the same facts. The directory can hold a regional abuse desk next to a global one. The console does not assume a single registry culture.
Clustering
Candidates that share an ASN, registrar, nameserver suffix, or certificate name are grouped when at least two match. That is a hint for the analyst, not a criminal attribution.