Watching Certificate Transparency logs in real time
Weard checks every new certificate on the internet for lookalikes of your brand, visits each site, and only alerts you when it is actually phishing.
No account, no card. Enter your website, or just your brand name. We check likely lookalike names live and visit the ones that exist.
- acme-secure-login.comCombosquatting · 4m agoPhishing
- acrne.comHomograph · 21m agoNeeds review
- acme-billing.helpCombosquatting · 1h agoPhishing
- àcme.comIDN lookalike · 2h agoWatching
- acmg.comBitsquatting · 5h agoWatching
- acme.devTLD squatting · 9h agoNot a threat
acme-secure-login.com
Copies the Acme sign-in page and sends passwords to a third-party host.
What we saw on the site
- Page title: "Acme | Sign in"
- Asks for a password
- Looks 91% like the official site acme.com
- Loads the logo from acme.com
- Can receive email (mail server configured)
How it works
Most lookalikes are harmless. We find the ones that are not.
A popular brand gets hundreds of similar registrations a month. Alerting on all of them is noise. Weard looks at what each site actually does before it bothers you.
01
Collect everything
Every certificate from public CT logs and every newly registered domain lands in our index, unfiltered. Add a keyword and we search its full history in seconds.
02
Match the name
Eight detection methods find typos, lookalike characters, extra words and swapped extensions, including internationalized domains that render as your name.
03
Inspect the site
We visit each match like a visitor would. It is phishing only if it claims to be you and asks for passwords, cards or personal data. Parked domains are re-checked until they go live.
Eight ways to fake a domain
Examples for a brand called acme. Each method has a page in the docs explaining how it is detected and scored.
Your domain
- TyposquattingSwapped, missing or doubled lettersamce.com
- HomographCharacters that look alike, rn for macrne.com
- IDN lookalikeAccented and non-Latin lettersàcme.com
- CombosquattingYour name plus a convincing wordacme-login.com
- TLD squattingSame name, different extensionacme.shop
- HyphenationHyphens inserted into the nameac-me.com
- BitsquattingOne flipped bit away from yoursacmg.com
- Subdomain squattingYour domain as a subdomainacme.com.verify-id.io
Campaigns
See the attacker, not just the domain.
Attackers register in batches. Weard groups lookalikes that share servers, name servers, registrars and naming patterns, so six alerts become one campaign with one abuse report.
Credential harvest via shared mail host
First seen 3 days ago, active 12 minutes ago
- Domains
- 6
- Shared IPs
- 2
- Keywords
- 2
- acme-secure-login.com185.199.110.7
- acme-billing.help185.199.110.8
- acmepay-verify.net185.199.110.9
- login-acme.co185.199.110.10
Pricing
Start with a 14 day trial.
3 keywords and every notification channel. No card needed.
Starter
For a single brand.
$19 /month
- 5 keywords
- Email notifications
- Real-time detection
- Keyword changes at billing cycle end
- Email support
Pro
Most popularFor product portfolios.
$49 /month
- 20 keywords
- Email, Slack and Telegram
- Keyword changes at billing cycle end
- Priority support
Enterprise
For security teams.
$149 /month
- 100 keywords
- All channels plus webhooks
- Up to 10 instant keyword changes a month
- SSO with OIDC
- Dedicated support