Attack-surface monitoring for your domain
Starting with the three signals that precede phishing and brand abuse: cloned copies of your site, lookalike certificates, and typosquat registrations. Verified domains only, up to five per account. More signals are being added.
What it watches — and how
Cloned copies of your site
A canary snippet — one line of CSS or HTML — sits in your page. If someone copies your HTML and serves it from another host, the snippet fires and we record the cloning hostname and the time. Heartbeat checks confirm the snippet is still on your own site.
Lookalike certificates
Every TLS certificate issued for any domain lands in public Certificate Transparency logs. A daily sweep looks for new certificates whose names resemble yours — the brand plus a hyphen, a swapped letter, a different TLD — before the site behind them goes live.
Typosquat registrations
A daily RDAP sweep checks whether common misspellings and TLD swaps of your domain have just been registered, and by which registrar. Newly registered lookalikes are the cheapest early warning of a coming phishing wave.
Each event — clone hit, matching certificate, new registration — is emailed to you once and kept in the monitor's event log. Platform hosts that legitimately serve your HTML (Shopify, Vercel previews) go on a whitelist so they never page you.
How it works
Create an account
Email and password. No card, no sales call.
Verify your domain
Add one DNS TXT record so only the real owner can monitor a domain. Up to 5 domains per account in the beta.
Paste the snippet
One line in your layout, CSS or theme — plain HTML, React/Next.js and Shopify variants included. Sweeps start the same day.
<!-- Example of the snippet shape — your account generates the real one -->
<style>.mss-c{background:url(https://mysecscan.com/c/<your-id>/pixel.gif)}</style>What it does not do
- No agent, no browser extension, no traffic interception.
- No port scanning and no probing of anyone else's servers — CT logs and RDAP are public records.
- No data about the people who visit a suspected clone: IP addresses and user agents are not stored.
- Not a full external attack-surface inventory yet — this is the brand/domain slice. The free checkers and the full scan cover headers, TLS, DNS and exposed files.
Data handling for the monitor is described in the Privacy Policy.
Pricing
Domain Monitor
Free during beta
- Up to 5 verified domains per account
- Clone, lookalike-certificate and typosquat alerts by email
- Daily sweeps, hourly heartbeat, event log and whitelist
Questions
- Does the monitor stop phishing or brand abuse?
- No — it tells you early. A cloned site, a lookalike certificate or a typosquat registration are the usual first steps before a phishing campaign against your customers or staff. The monitor surfaces those signals within a day (clones within minutes of the first visit) so you can start a takedown, warn customers, or register the domain yourself before it is used. Taking the clone down is still a human step; the monitor gives you the evidence and the timing.
- Does the canary snippet slow down my site or track my visitors?
- No. It is one static CSS or HTML line that references a tiny image on our servers. On your real domain the image loads once per page view and nothing else happens. Only when the same HTML is served from a different host — a clone — does the request tell us something. We do not collect data about who visits a suspected clone: no IP addresses or user agents are stored from those requests, only the cloning host and the time.
- I host on Shopify, Vercel or a similar platform — will preview URLs show up as clones?
- They can, which is why the monitor has a whitelist. Add patterns such as *.myshopify.com or *.vercel.app for platforms that legitimately serve your HTML from their own hostnames, and those hosts are ignored. The list is yours to edit at any time from the monitor page.
- What if I can't edit DNS to verify my domain?
- Verification requires a single TXT record so that only the real owner can monitor a domain — we won't relax that. Ask whoever manages your DNS (your registrar, hosting provider or agency) to add the record; it takes a minute and has no effect on your site or email. Until the domain is verified the monitor stays locked.
- How do alerts arrive?
- By email to the address on your account, once per new event, with duplicate hits on the same clone host collapsed into one notification per hour. Everything is also listed in the monitor page's event log, with the CT-log and typosquat sweeps running daily and heartbeat checks confirming the snippet is still present on your own site.
Already have an account?
Verify a domain in Settings and the monitor unlocks on your Checkers page.