Services / #2 Defend
We find what your company has exposed on the internet: abandoned servers, risky services and newly registered lookalike domains. Then we help get impersonating sites and accounts taken down.
What you get
01
A test server left over from a 2021 migration. A subdomain pointing at a vendor you no longer use. Attackers look for systems nobody maintains, so we look for them first.
02
Lookalike domains are often registered days or weeks before they are used. Found early, they can be blocked before any phishing email is sent.
03
Fake login pages and fake support accounts. We document them in the format registrars and platforms require, and follow each takedown through.
04
Every finding is ranked by risk with a plain fix, so your team knows what to do first and what can wait.
What’s included
How it works
An inventory of everything you have facing the internet, including what isn’t on your own list.
Each exposure gets a risk rating and a fix written for whoever has to make it.
Every month we look again for new exposures and new lookalike domains.
When we find impersonation, we prepare the evidence and help file the takedowns.
Case study
A healthcare group had grown through acquisitions and wasn't sure what it had on the internet. A lookalike patient-portal domain showed up two weeks into monitoring.
Example engagement. The client is fictional and details are illustrative, to show how this work typically goes.
23
internet-facing systems the IT team didn't have listed
4
high-risk exposures fixed in the first month
2 days
from spotting a fake portal domain to takedown request
The group had bought three smaller practices over five years. Each came with its own websites, email setups and vendors. The IT team knew their main systems but suspected there was more out there.
We built an inventory of everything tied to the group on the internet: domains, subdomains, IP ranges, cloud services and third-party portals. We compared it with the IT team’s own list, rated each exposure and wrote a plain fix for each one.
After the initial review, we moved to monthly monitoring for new exposures and lookalike domains.
We found 23 systems the IT team didn’t have on their list. Most were harmless, but four were serious: an old practice-management server open to the internet, a file share left from an acquired clinic, and two remote-access services with known vulnerabilities.
Two weeks into monitoring, a domain one letter off from the patient portal was registered and set up to receive email.
The four high-risk exposures were fixed within the month. We documented the lookalike domain and helped file a takedown request two days after it appeared, before any patient emails went out. The IT team now has an up-to-date inventory, refreshed every month.
Related services
Tell us about your situation. We’ll confirm whether this service fits and agree on scope and price before any work starts.