New Registrations

24-72h lead time

Operators register lookalike domains hours before campaign launch — catching them here precedes the active feed.

Brand-keyword match

Filtered against the tracked-brand list, with allowlists for each brand's own legitimate infrastructure.

Wave indicator

A volume spike on a single brand signals an active campaign before victims land on the kits.