All use cases

Brand protection

Brand Monitoring and Phishing Detection

Phishing infrastructure is observable for days before it is activated. Create days of lead time by proactively monitoring for staged infrastructure.

Sign Up Book a Demo

Challenge

Four days pass before the first phishing email is sent

A phishing domain is rarely used the day it is registered. It is registered, it sits parked, it is issued a certificate, and only then does it begin serving a page. Each of those steps is visible from outside, and each is dated.
Registered Day 0 Certificate Day 2 Content live Day 4 Campaign sent Day 6 Reported Day 9 OBSERVABLE — 4 DAYS OF LEAD TIME FIRST ALERT

Approach

Name similarity is the first filter, not the verdict

A watchlist built on typo-squats catches the obvious registrations and misses deployments hosted on domains that bear no resemblance to your brand at all.

Matching on how a host responds closes that gap. The page body, the headers, the favicon, and the certificate identify a kit regardless of the domain serving it.

  • Track look-alike and typo-squatted registrations as they appear
  • Identify cloned pages by how they respond
  • Recover the remainder of a phishing kit deployment from a single URL
  • Use the full history to support takedown efforts
CANDIDATE NAME SIMILARITY STATE acme-login.example Serving a clone acmecorp.example Shared certificate acme-verify.example Parked acnne.example Parked sso-portal.example Serving a clone

Ranked by name similarity. Two of the closest matches are only parked, while the most distant name is serving a clone.

In practice

One reported URL uncovers thirty-two hosts

A single report, expanded by common fingerprints

  1. 01

    A customer forwards one link

    One domain, already live and targeting their organization.

  2. 02

    Response fingerprints match thirty-two hosts

    The same kit, deployed across unrelated domains and providers.

  3. 03

    Nine impersonate your brand

    The remaining twenty-three target other related organizations

  4. 04

    Continue monitoring the fingerprint

    Automatically identify later deployments of the same phishing kit

See how response matching works

The matching that identifies a cloned page also identifies the infrastructure behind it.

Explore the platform

Platform features behind this use case

Feature YARA Rules Develop, test, and execute YARA rules across global web infrastructure. Feature Active Scanning Analyze a website in real time from one or more geographic locations. Feature Lookalike Domains Find domains visually or structurally similar to your brand or keyword.

Explore other use cases

Enrichment Security Stack Enrichment Deliver context into the SIEM and SOAR so an analyst can judge an alert on the spot. Incident response Incident Triage See what a domain resolved to on the day of the incident, from DNS records captured at the time. Intelligence feeds Customized Threat Intelligence Build feeds shaped around the threats your organization and your customers actually face. Attribution Campaign Attribution Connect scattered domains, addresses, and hashes to one campaign, using overlaps across many independent data sources. Actor research Threat Actor Profiles Maintain a continuous picture of an adversary, drawn from many overlapping open source threat reports.

Get in touch

Contact us

Validin is the first tab I open every morning.
Senior Analyst, Financial Services IT Company