The work a DRP analyst does
we do automatically
A brand-protection team at a $40K/year vendor runs the same loop every day: discover candidate impersonation domains, triage the noisy ones out, verify the real threats, send the takedown, check if it worked, escalate if it didn't. We do the whole loop for you, detect, triage, verify, take down, re-verify, archive, and surface only the findings that need a human decision.
The loop runs 24/7. You get the outcome.
Most DRP platforms dump findings into a dashboard and expect a human analyst to clear the queue. We automate the whole case lifecycle and escalate to you only when a decision actually needs to be made.
Detect
NOD zone-file ingest across 10 gTLDs (~35M domains/day), 13 typosquat generation techniques, CT log monitoring, dark-web scanners, credential breach feeds, brand-keyword substring matching, social & app-store monitors.
Triage
Auto-prioritise with a transparent 0-100 risk score (eight published signals), infrastructure clustering (shared IPs, NS, registrar, SSL, favicon), and a confidence threshold that filters out the long tail of false positives.
Verify
Fetch the page in parallel via headless browser + curl, capture a screenshot, run six phishing signals (SSL impersonation, login form, favicon hash, brand keyword, OG meta, iframe) and a perceptual hash against your real site. Only confirmed threats proceed.
Take down
Auto-generate a registrar abuse complaint with the evidence pack, submit on your behalf via Postmark to the WHOIS abuse contact, dedupe re-submissions, and record the case ID.
Re-verify
Daily cron checks DNS, HTTP, WHOIS, and marketplace signals on every open takedown. Confirms resolution automatically or escalates to the next registrar if the takedown stalls.
Archive
Closed cases preserved with full evidence chain, screenshots, and timeline. Findings flow into your SIEM via STIX 2.1 / TAXII 2.1 feed or MISP endpoint for long-term intel correlation.
You only see the findings that actually need a human, new threats that clear the verification bar, and takedowns that stall past an SLA. Everything else closes itself.
Enterprise DRP (Bolster · Doppel · Outtake · PhishLabs)
- Custom pricing, annual contracts, sales cycle
- Agentic positioning often means "the analyst uses AI tools", you still pay per-seat
- Separate from your monitoring stack
- Black-box risk scoring
- Uptime & status aggregation not included
- Incident management not included
ServiceAlert Agentic DRP
- Sign up today, scanning tonight
- Detect→triage→verify→takedown→re-verify loop runs without you
- Bundled with uptime monitoring, status aggregation, cert lifecycle, vuln scanning, incident management
- Transparent, published risk scoring rubric (see it)
- 2,300+ vendor status pages + outage map included
- STIX 2.1 / TAXII 2.1 + MISP feed for SIEM ingest
What's included
Every feature listed here is live today. Not a roadmap, these are running in production, protecting brands right now.
Typosquat Detection
Generates hundreds of lookalike variants of your domain (homoglyphs, bit-flips, TLD swaps, keyword additions) and monitors registration status across all major TLDs. Catches impersonation domains before they go live.
Newly Observed Domain Scanning
Ingests daily zone files from 12 gTLDs via ICANN CZDS (.com, .net, .org, .info, .biz, .club, and more). Matches new registrations against your brand within hours of creation, before attackers can weaponize them.
Visual Similarity & Screenshots
Captures screenshots of suspected phishing sites and compares them against your legitimate pages using visual similarity analysis. Tracks visual changes over time with dated screenshot history.
SSL & Infrastructure Probing
Checks SSL certificates, DNS records, MX configuration, WHOIS registration, and hosting infrastructure for every finding. Clusters related domains by shared infrastructure (IPs, name servers, registrars).
Dark Web & Credential Monitoring
Monitors dark web sources for mentions of your brand, leaked credentials, and data exposure. Alerts when employee or customer credentials appear in breach databases.
Domain Risk Scoring
Transparent 0-100 risk score with A-F grades. Eight weighted signals, every weight published. Audit any score from the signals we show you. See the full rubric.
Social Media & App Store Monitoring
Scans social platforms and app stores for unauthorized use of your brand name, logos, and assets. Catches fake accounts and fraudulent apps impersonating your organization.
Takedown Management
One-click abuse complaint generation to domain registrars. Tracks submission status, prevents duplicate filings, and maintains a full audit trail through resolution.
WHOIS History & Passive DNS
Historical WHOIS snapshots with change-tracking across registrar, name servers, and registration dates. Multi-provider passive DNS (OTX + VirusTotal) with persistent data store. Try the free WHOIS tool.
Threat Intel Feeds (TAXII & MISP)
Export your brand findings as structured threat intelligence via TAXII 2.1 and MISP formats. Feed directly into your SIEM, SOAR, or threat intel platform for automated response.
Maltego Transforms
Five transforms for Maltego CE: domain-to-risk-score, domain-to-whois, domain-to-threat-intel, domain-to-passive-dns, domain-to-status. Pivot through ServiceAlert data in your investigation workflow.
Favicon Hash & Infrastructure Clustering
Calculates favicon hashes to identify domains reusing the same assets. Clusters findings by shared IP ranges, name servers, and registrars to reveal coordinated campaigns.
Plus everything else in ServiceAlert
DRP is one part of the platform. Every plan also includes:
Uptime Monitoring
HTTP, ping, TCP, SSL, DNS, and heartbeat checks for your own infrastructure. Up to 100 monitors on Enterprise.
Status Page Aggregation
Track 2,336+ vendor status pages in one dashboard. Know when AWS, Stripe, or Slack goes down before your users tell you.
Early Signals
Crowd-sourced outage detection catches issues before the vendor's status page updates. Reddit, Hacker News, and Bluesky scanning.
10 Alert Channels
Email, Slack, Teams, Discord, Google Chat, SMS, webhooks, PagerDuty, Opsgenie, and browser push.
By the numbers
Frequently asked
Start protecting your brand tonight
Sign up, add your domains, and the first scan runs automatically. No procurement, no annual contracts, no sales calls required.
See plans & pricing