Status tracking
Requested, in progress, completed — every transition recorded on the case.
TAKEDOWN Takedown requests tracked with the case
Takedown Management
A takedown request opens from the finding itself; requested, in progress and completed states are tracked with the registrar. A playbook can start one automatically on a new finding.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
The hard part of a takedown is not starting it but following it: which request is waiting at which registrar, which domain came back as a new variant after removal? Open takedowns are counted on the command screen and each request is tied to its case, which stays open until the domain is suspended.
What it does
Automatic start
The "Phishing — automatic takedown on finding" playbook triggers a request on each new finding.
Evidence pack
Screenshot, DNS records, certificate and registrar details are attached to the request.
What you get
- No request is forgotten in an inbox.
- Returning variants attach to the same case.
- Time to takedown becomes measurable per finding.
Scenarios featuring this module
Typosquatted domain with a fake login page
Shortly after appearing in certificate transparency logs, the freshly registered domain began serving a copy of the organisation's login page that posted credentials to a third-party server.
3 modules
Impersonation account targeting an executive
An account copying the profile photo and title began direct-messaging employees and business partners.
3 modules
Other modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.