Security & coverage
Security practices, stated without certificates we do not hold
We do not claim certifications we have not earned. What follows is what we actually do.
Tenant isolation
Every brand, finding, case, alert and report row carries an organisation id, and every query is scoped by the signed-in member's organisation on the server. Cross-tenant access is covered by automated tests.
Authentication
Email and password with strong hashing, session cookies that are HttpOnly, Secure and SameSite, rate-limited sign-in and reset endpoints, and account recovery by emailed link (or assisted recovery when email is not configured).
Roles
Owner, admin and member roles per organisation. Platform administration is a separate role and is audit-logged.
Safe fetching
Submitted and discovered URLs are fetched with private-network blocking, DNS-rebinding protection (connections pinned to the validated IP), redirect validation, size and time limits, identity encoding and no script execution.
Audit logs
Sign-ins, brand changes, finding and case decisions, plan changes, exports and administrative actions are logged with actor, time and hashed IP.
Secrets and transport
All traffic is TLS. Secrets live in the hosting provider's encrypted environment, never in the repository. Audit log data is redacted for sensitive keys.
Backups
The managed database keeps point-in-time history; we test restores as part of our operations checklist and document the procedure.
Responsible disclosure
Found a vulnerability? Email hello@scamblockai.com with details. We acknowledge within two business days, do not pursue good-faith researchers, and credit fixes if you wish.
Coverage
- Lookalike domain candidates generated from your brand names (typos, homoglyphs, keyword combinations, alternative extensions) and checked against public DNS.
- Certificate Transparency logs (crt.sh) searched for certificates issued to names containing your brand (best effort; the public service is rate-limited and sometimes unavailable).
- Publicly served web content of suspicious hosts fetched safely (no scripts executed) and analysed for login forms, payment keywords and brand mentions.
- Registration dates via RDAP for generic domains (.com, .net ...). Not available for .bd domains.
- Newly registered domains: a free public daily list (WhoisDS, about 70,000 new generic-TLD names a day) is matched against your brand names; new matches are checked the same day when capacity allows, otherwise at the next scheduled scan. It is a sample, not every registration, and has no .bd names.
- Links your team submits (including Facebook, Instagram, Telegram, app-store links) assessed individually.
Limitations
- Facebook, Instagram and other social platforms are NOT scanned automatically; only links you submit are assessed.
- Candidate generation is bounded by your plan's budget; not every possible lookalike is checked on every scan.
- A finding is a suspicion with a confidence level, not a legal determination of fraud.
- Sites that hide content from automated visitors may not be fully analysed.
- Registration data for .bd domains is unavailable (no public RDAP/WHOIS).
Responsible use
We only read publicly served pages, identify our scanner in the User-Agent header, respect rate limits of public data sources, and never bypass CAPTCHAs, logins or anti-bot protections. We do not scrape private data and we do not perform exploit or vulnerability scanning against third parties.
See what is already using your brand name
Run a limited, real check of lookalike domains and certificate logs. Results in minutes, with sources and limitations stated plainly.