alesian.security

Resources

How it works, in plain words

Somebody who wants to trick your customers buys a web address that looks like yours. They use it to send mail, or to show a page that looks like your page. These articles tell you how we find those addresses and what we do about them. Each article is about one product. The research is here.

See the plans and prices →

Lookalike monitoring

We find the web addresses that copy your name, check which ones are live, and tell you which ones are dangerous. About Lookalike Monitoring.

  1. 01 How we find the names that copy yours What a lookalike domain is, the patterns people use to make one, and how to find them before they are used.
  2. 02 How we know a name is live One question to the internet often gives the wrong answer. How we get the right answer before we alert you.
  3. 03 How the risk score works What makes a score go up, what makes it go down, and why a score is about what a name can do today.
  4. 04 I have a suspicious lookalike. Now what? From a name that looks wrong to a decision: how to gather evidence without touching the site, how to judge it, and when to block or take it down.

Blocking

When a lookalike is dangerous, we put it on the lists that browsers and mail filters read. A block acts in minutes. About Block Listing.

  1. 01 Why we block first An attack from a lookalike does its damage in hours. A block acts in minutes. How blocking works, and what it does not do.
  2. 02 What is a blocklist? The lists that mail filters, browsers and DNS resolvers read before they let something through. Who runs them, how a name gets on one, and how to check.

Sender Security

How mail proves it came from your domain, who sends as you, and what the reports about your domain say. About Sender Security.

  1. 01 Anatomy of an email attack An attack told backward, from the inbox to the attacker: what they want, the identity they choose, how the message gets there, and how they chose you.
  2. 02 A crash course in email security How mail proves who sent it, what it cannot prove, and which tool answers which threat: SMTP, SPF, DKIM, DMARC, ARC, BIMI, MTA-STS and TLS-RPT.
  3. 03 What is DMARC, and why should I care? Why SPF and DKIM do not stop somebody using your domain in the From address, what DMARC adds, and what its reports tell you.
  4. 04 DMARC policy: none, quarantine and reject What each policy does to mail that fails DMARC, what the other tags of the record mean, and how to move from none to reject without losing mail.
  5. 05 What is a DMARC aggregate report? The daily XML file that Microsoft, Google and Yahoo send about your domain: what is in it, why it arrived, and how to read it.
  6. 06 DMARC forensic reports, with an example The per-message failure reports that ruf= asks for: what one looks like, why few receivers send them, and what they show that aggregate reports do not.
  7. 07 Application based mail authentication DMARC reports name IP addresses. To reach reject you fix applications. How to get from one to the other, and what to change so each application passes.
  8. 08 Who sends mail as you, and what DMARC does not stop Spoofing, lookalike domains, display names and borrowed accounts. Which of them DMARC stops, which it only shows you, and which it never sees.