FAQ
Frequently asked questions
- What exactly do you detect?
- Registered lookalike domains derived from your brand names (English and Bangla spellings), newly registered domains from a public daily list that resemble your brand, certificates issued to lookalike names, live pages on those hosts that show phishing or impersonation signals, and any URL your team submits. Findings carry a risk score, a confidence score, the signals and the captured evidence.
- Do you monitor Facebook, Instagram or TikTok automatically?
- No. There is no lawful API for searching public Pages at scale, and we do not scrape behind logins or bypass platform protections. We assess links you or your customers submit and help you prepare reports to the platforms. We say this plainly on every report.
- How often do you scan?
- Weekly on the Free plan, daily on Starter, every 12 hours on Growth, every 6 hours on Business, and as contracted on Enterprise. On every plan, the daily list of newly registered domains is matched against your brand each morning and new matches are checked the same day when capacity allows. Every brand page shows the last and next scheduled scan time.
- Does a finding mean the site is a scam?
- No. A finding is a suspicion with evidence and a confidence level. Your team confirms or dismisses it. We never label a third party a scammer publicly, and we recommend you do not either; use the evidence pack in your report to the registrar, host or platform.
- Can you get a site taken down?
- We prepare the evidence and guide you through registrar, hosting and platform reporting. Providers decide; we cannot and do not guarantee outcomes. Assisted takedown support is included in Business and Enterprise plans.
- Will I get false positives?
- Yes, some. A bank with a similar name or an authorised reseller can look like impersonation to a machine. Mark it a false positive once; the host is allow-listed and never alerts again, and your feedback improves our rules.
- How do you fetch suspicious pages safely?
- With a hardened fetcher that blocks private networks, validates every redirect, pins the connection to the checked IP, caps size and time and never executes scripts. Pages are never rendered in a browser.
- Where is my data stored and who can see it?
- In a managed Postgres database with per-organisation isolation enforced on the server. Only members of your workspace can see your brands and findings. All changes are audit-logged.
- How do I pay?
- We invoice manually and accept bank transfer, bKash and Nagad. There is no automatic card billing yet. After we verify payment your plan is upgraded and the change appears in your audit log.
- Can I cancel?
- Yes. Monthly plans end at the end of the paid period; annual plans are refunded pro-rata for unused full months on request.
- Do you use AI?
- The detection engine is deterministic rules and public data, so it runs without any paid AI service and every score is reproducible. We may add optional AI-assisted summaries later, always labelled as such.
See what is already using your brand name
Run a limited, real check of lookalike domains and certificate logs. Results in minutes, with sources and limitations stated plainly.