Datahorses
Black horse in turquoise armor in front of a castle

We guard your company from the outside.

We watch for the signs of the most serious threats on your behalf: stolen logins and leaked data, extortion, identity theft and impersonation of your management, social engineering, fake invoices in your name, fake login pages, a hacked website, break-in attempts and malware spreading through your site. Nothing to install, no access needed, and at the first sign we alert you with clear next steps.

  • ForbesCEO honored
    30 Under 30
  • MicrosoftPartner
  • IntelSoftware Partner

Reviewed by the latest AI models

What we know about you from outside is also assessed by the newest models, the same kind attackers work with today.

  • Your external attack surface, reviewed by current AI models

    Attackers look at your company from outside, and more and more often AI helps them do it. We have the newest models assess the same picture, so you know about a weak spot first.

    What we check
    The results of the checks in this list (domains, DNS, certificates, subdomains, website headers, software versions, services visible from outside) are assessed by a current AI model. It looks for connections a single check cannot see and suggests what to fix first. It sends nothing to your systems and tries nothing.
    Source
    Results of our checks, assessed by selected AI models in a controlled environment.
    How often
    Once a week.
    All good
    The model found no connection that turns minor findings into a way in.
    We alert you when
    The model links several findings into a weak spot that should be fixed first.

    AI models get better every month and attackers already use them. So we look at your external attack surface for you through the eyes of the current models, in a controlled environment, and we choose the models. We do not enter your systems and we attack nothing: the models only assess what we collect about you from outside.

What we guard

Everything we guard for you, in one list.

85 items in 9 areas. Core checks run twice a day, morning and evening, without entering your systems. Expand any item to see exactly what we check, which source we use and how often.

  • Critical
  • Medium
  • Low

Servers, software and website

21 items

  • Website compromise

    A compromised website can quietly redirect visitors, change text or host a fraudulent page. The company often finds out only from a customer.

    What we check
    Fraudulent addresses on your domain in phishing lists, changes to the home page text, redirects to a third-party domain, and changes to the website technologies. We also track browser warnings.
    Source
    OpenPhish, PhishTank, an ordinary website visit.
    How often
    Twice a day, morning and evening.
    All good
    The website is the same as last time and no list has flagged it.
    We alert you when
    An unexpected change or a list entry occurs.
  • Signs of a break-in attempt

    We do not see intrusion attempts themselves, because we do not enter your systems. But we do see which doors are visible from outside, and we alert you to those.

    What we check
    Remote access and databases that an index of internet services records on your IP addresses, website administration and sensitive file addresses in the web archive, and known vulnerabilities by software version.
    Source
    Shodan InternetDB (we do not scan ports ourselves), Wayback Machine.
    How often
    Once a day.
    All good
    No sensitive doors are visible from outside.
    We alert you when
    A source shows an open service, a known vulnerability or a sensitive address.
  • Website content change

    A change of text on your website without your knowledge may be an attacker’s doing: a substituted account number, link or notice.

    What we check
    The home page text (without scripts and styles) compared with the previous check, the response code and its speed.
    Source
    An ordinary home page visit.
    How often
    Twice a day, morning and evening.
    All good
    The text is the same as last time.
    We alert you when
    The text has changed. You check whether it was your edit.
  • Unexpected HTTP 301/302 redirect

    A redirect sends a visitor from one address to another. If it leads to a third-party domain or somewhere unexpected, the website may have been tampered with.

    What we check
    Where the http:// address of your domain leads, step by step, whether it ends at https:// on your domain, and whether the target has changed since the previous check.
    Source
    An ordinary visit to the http:// and https:// address.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    It redirects to https:// on your domain, the same as last time.
    We alert you when
    It leads to a third-party domain, stays on unencrypted http://, or the target has changed.
  • Known CVEs by service version

    A CVE is a public identifier of a known security flaw. If the software version on your server has one, it is time to update.

    What we check
    CVE identifiers that an index of internet services assigns to your IP addresses based on the detected software version. It is a signal to verify: the index goes by version, not by testing the flaw.
    Source
    Shodan InternetDB.
    How often
    Once a day.
    All good
    The index assigns no CVE to your servers.
    We alert you when
    The index assigns a known vulnerability.
  • Admin panels (cPanel, phpMyAdmin) listed in public indexes

    The login address of website administration is a target for password guessing. If web archives know it, an attacker does not have to look for it.

    What we check
    Website administration addresses (for example wp-admin, cPanel, phpMyAdmin) stored by the web archive. We do not open or try these addresses.
    Source
    Wayback Machine.
    How often
    Once a week.
    All good
    The archive knows no such address.
    We alert you when
    The archive knows a website administration address.
  • Publicly reachable .zip, .sql, .bak backups

    A website or database backup uploaded to a public address may contain all company data and passwords.

    What we check
    Addresses of backup files (.zip, .sql, .bak, .tar) stored by the web archive. We check whether they are reachable today only with your written authorization.
    Source
    Wayback Machine.
    How often
    Once a week.
    All good
    The archive knows no such address.
    We alert you when
    The archive has stored the address of a backup file.
  • Published .git, .env, .htaccess and phpinfo files

    .git, .env and phpinfo files are often published by mistake when a website is deployed. They contain source code, database passwords or server settings.

    What we check
    Addresses of these files (.git, .env, .htaccess, phpinfo, CMS configuration) stored by the web archive. We do not open the files; we check whether they are reachable today only with written authorization.
    Source
    Wayback Machine.
    How often
    Once a week.
    All good
    The archive knows no such address.
    We alert you when
    The archive has stored the address of a sensitive file.
  • A new vulnerability in your software

    New flaws in common software are published every week. If your website or server has them, it needs updating.

    What we check
    The website system and server version revealed by the home page and headers, and known vulnerabilities (CVE) that an index assigns to your servers by software version.
    Source
    An ordinary website visit, Shodan InternetDB.
    How often
    Once a day.
    All good
    No known vulnerability and the software receives updates.
    We alert you when
    The version no longer receives updates or the index assigns a known vulnerability.
  • A weakness caught before it is exploited

    Most attacks exploit flaws that could have been fixed in advance. We find them from outside first and send you the remediation steps.

    What we check
    A summary of all checks of the website, mail, domain and certificates. For each finding your developer receives remediation steps and a link to the source it is based on.
    Source
    All sources listed with the items.
    How often
    Twice a day, morning and evening.
    All good
    No open finding.
    We alert you when
    A new finding appears. You receive it with remediation steps.
  • Technology fingerprint and its changes

    A fingerprint is a list of the technologies a website runs on. If it changes without a planned update, someone may have modified the website.

    What we check
    The website system, its version, the server and the libraries used, from the home page and headers. We compare the fingerprint with the previous check.
    Source
    An ordinary home page visit.
    How often
    Twice a day, morning and evening.
    All good
    The fingerprint is the same as last time.
    We alert you when
    The technologies have changed.
  • Server discloses its version (Apache, nginx, PHP)

    When a server reveals the exact software version, an attacker can look up known flaws for it. Hiding the version makes their work harder.

    What we check
    Response headers that reveal software and version (Server, X-Powered-By and similar).
    Source
    An ordinary website visit.
    How often
    Twice a day, morning and evening.
    All good
    The headers do not reveal the version.
    We alert you when
    The version is visible, especially when it no longer receives security updates.
  • Outdated software (WordPress, Magento)

    Software past its end of support no longer receives bug fixes. Every new flaw in it stays open permanently.

    What we check
    The website system and its version (for example WordPress), and the PHP and server versions from the headers. We compare them with the publicly known end of support.
    Source
    An ordinary website visit.
    How often
    Twice a day, morning and evening.
    All good
    The version receives updates.
    We alert you when
    The version is past its end of support.
  • CMS or plugins with a known flaw

    Content management systems such as WordPress and their plugins are the most common entry point into company websites. What matters is whether the version is current.

    What we check
    The system and its version from the home page, and known vulnerabilities that an index assigns to the server. We also check individual plugins.
    Source
    An ordinary website visit, Shodan InternetDB.
    How often
    Twice a day, morning and evening.
    All good
    The system is on a supported version and has no known vulnerability.
    We alert you when
    The system is outdated or has a known vulnerability.
  • Open RDP, SSH, Telnet, VNC, FTP, SMB services

    Remote desktop, SSH or file sharing reachable from the whole internet are frequent targets of password guessing. They should be hidden behind a VPN.

    What we check
    Which services (RDP, SSH, Telnet, VNC, FTP, SMB) an index records on the IP addresses of your website and mail. We do not scan ports ourselves; we use what is already recorded.
    Source
    Shodan InternetDB.
    How often
    Once a day.
    All good
    The index records no such service on your IP addresses.
    We alert you when
    The index records an open remote access service.
  • Database ports exposed (MySQL, PostgreSQL, Redis, MongoDB)

    A database reachable directly from the internet is one of the most common causes of large breaches. It should be reachable only by your servers.

    What we check
    Whether an index records databases on your IP addresses (MySQL, PostgreSQL, Redis, MongoDB, MS SQL and others). We do not scan ports ourselves and do not connect to the database.
    Source
    Shodan InternetDB.
    How often
    Once a day.
    All good
    No database is recorded from outside.
    We alert you when
    The index records a database reachable from the internet.
  • Missing security headers (CSP, HSTS, X-Frame-Options)

    Security headers are instructions with which a website tells the browser how to protect itself. They protect visitors from injected third-party code and eavesdropping.

    What we check
    The HSTS, Content-Security-Policy, X-Frame-Options (or frame-ancestors), X-Content-Type-Options and Referrer-Policy headers on an ordinary visit to the home page.
    Source
    An ordinary website visit.
    How often
    Twice a day, morning and evening.
    All good
    All headers are set.
    We alert you when
    One is missing, or the website redirects from https:// to http://.
  • Cookies missing Secure, HttpOnly, SameSite

    Cookies remember a visitor’s login. Without protective flags they are easier to steal or misuse from a third-party site.

    What we check
    Cookies that the home page sets on the first visit, and whether they have the Secure, HttpOnly and SameSite flags.
    Source
    An ordinary website visit.
    How often
    Twice a day, morning and evening.
    All good
    All cookies have the flags, or the page sets none.
    We alert you when
    A cookie is missing a flag.
  • Mixed HTTP content inside HTTPS

    When a secure page loads files over insecure http://, the browser blocks them or shows a warning, and they can be spoofed on the way.

    What we check
    Images, scripts and styles on the home page that load over http://.
    Source
    An ordinary website visit.
    How often
    Twice a day, morning and evening.
    All good
    Everything loads over https://.
    We alert you when
    A file loads over http://.
  • Availability and latency from multiple countries

    A website can work from your office and yet be unavailable or slow for customers in another country.

    What we check
    We measure the response and speed of your home page from several countries and compare them.
    Source
    An ordinary website visit.
    How often
    Twice a day, morning and evening.
    All good
    The website responds normally in every country we measure from.
    We alert you when
    The website is unreachable from a country or much slower there than elsewhere.
  • Old site versions in the archive (Wayback)

    The web archive remembers old versions of your website and pages you deleted long ago. They may reveal things you no longer want public.

    What we check
    How many addresses of your website the archive knows, since when, and whether they include sensitive files or website administration.
    Source
    Wayback Machine (CDX).
    How often
    Once a week.
    All good
    Nothing sensitive among the archived addresses.
    We alert you when
    The archive contains a sensitive address.

Data leaks and company accounts

10 items

  • Signs of stolen login credentials

    An attacker who obtains an employee’s password can log in as that employee. We look for signs that someone is going after your login credentials.

    What we check
    We combine several checks: fraudulent login pages on lookalike domains, your addresses in phishing lists, and known breaches whose source was your website. We also check specific company addresses in breaches.
    Source
    OpenPhish, PhishTank, Have I Been Pwned (breach list), DNS of lookalike domains.
    How often
    Twice a day, morning and evening.
    All good
    No fraudulent login page in your name and no breach from your website.
    We alert you when
    A page imitating your login appears, or a record of a breach that concerns you.
  • Signs of a data leak

    When data leaks from a company, it is often discussed in public places first, and the company only learns about it later. We watch those places for you.

    What we check
    Whether Have I Been Pwned lists a breach whose source is your website, and whether your domain or company name appears in indexed mentions of breaches and on ransomware victim lists.
    Source
    Have I Been Pwned, ransomware.live, Ahmia (index of .onion sites).
    How often
    Once a day.
    All good
    No recorded breach and no mention of your company.
    We alert you when
    A source records a breach from your website or a mention of your company alongside leaked data.
  • Extortion (ransomware leak sites)

    Groups that encrypt company data publish victims’ names on their sites to pressure them into paying. We want you to know about such a listing right away.

    What we check
    Whether your domain or company name is on a victim list compiled from these groups’ leak sites, and whether it appears in the index of .onion sites. We store only the name, the group and the date; we never download leaked data.
    Source
    ransomware.live, Ahmia.
    How often
    Once a week.
    All good
    Your company is neither on the victim list nor in the index.
    We alert you when
    Your domain or a similar company name appears on the list.
  • Misuse of customer data

    Your customers’ data can leak from your website, or someone can misuse it on a fraudulent site in your name. We watch for both.

    What we check
    Whether Have I Been Pwned lists a breach from your website, whether your company is on a ransomware victim list, and whether there is a fraudulent site impersonating you that could ask customers for their details.
    Source
    Have I Been Pwned, ransomware.live, OpenPhish, PhishTank, lookalike domains.
    How often
    Once a day.
    All good
    No breach from your website and no fraudulent site in your name.
    We alert you when
    A source shows a breach or a site that may collect data from your customers.
  • Login credentials in published breaches

    When a company email address leaks together with its password from a third-party service, an attacker will try it on your systems too. You should change the password for every such address.

    What we check
    We check the email addresses you have published on your website against the Have I Been Pwned breach database. We check the whole domain once you confirm that you own it. We store only the address, the breach name, the date and the data types, never passwords.
    Source
    Have I Been Pwned.
    How often
    Once a week.
    All good
    None of your addresses is in a known breach.
    We alert you when
    A company address appears in a new or older breach.
  • Company in published breach databases

    If data has ever leaked directly from your website or online shop, you should know about it and know what leaked.

    What we check
    Whether your website is recorded as the source of a known breach: breach name, date, number of accounts and data types (for example emails, passwords, addresses).
    Source
    Have I Been Pwned, list of breaches by domain.
    How often
    Once a day.
    All good
    Have I Been Pwned records no breach from your website.
    We alert you when
    Your website is recorded as the source of a breach, even an older one.
  • API keys and tokens in public repositories

    An access key placed in public code on GitHub can be found by anyone. The company often does not know, because the code was published by a supplier.

    What we check
    We search public code repositories for your domain and company names and look for access keys, passwords and internal system addresses next to them. We do not run the code and we do not try the keys.
    Source
    Code search on GitHub.
    How often
    Once a day.
    All good
    Nothing in public code reveals your access details.
    We alert you when
    Code with your domain and a key, password or internal address appears in a public repository.
  • Keys leaking into public code

    Developers sometimes accidentally publish passwords and access keys together with code or website settings. Such a key opens the door without a password.

    What we check
    We search the web archive for addresses of files where keys are usually kept (.env, .git, CMS configuration). We do not open the files, we only alert you that the archive knows about them. We also search public code repositories.
    Source
    Internet Archive (Wayback Machine).
    How often
    Once a week.
    All good
    The archive knows no address of a sensitive file on your website.
    We alert you when
    The archive has stored the address of a file that may contain keys or passwords.
  • Dark web mentions

    Stolen data and access are traded on the dark web. We only look where access is legal.

    What we check
    We search for your domain and company name in the index of .onion sites and on the ransomware victim list. We do not log in to forums and do not download anything, so we only see indexed mentions.
    Source
    Ahmia, ransomware.live.
    How often
    Once a week.
    All good
    No mention of your domain or company.
    We alert you when
    The index or the victim list contains your domain or company name.
  • Metadata in public documents

    PDF or Word documents on a website carry hidden data: author names, usernames and software versions. This helps an attacker prepare a targeted email.

    What we check
    We check the metadata of documents a search engine returns about you: authors, user names and software versions. We do not crawl your website.
    Source
    Search engine index.
    How often
    Once a week.
    All good
    Your documents reveal no names, user accounts or internal paths.
    We alert you when
    A document on your website carries an employee name, a user account or a software version an attacker could misuse.

Fraud in your name and identity theft

11 items

  • Company identity theft

    A fraudster registers a domain similar to yours and poses as you to customers and suppliers. The sooner you know about it, the less damage it does.

    What we check
    Registered domains similar to yours, whether they receive mail, whether a page with your name, logo or title runs on them, and whether they are on phishing lists. We also watch for fake profiles and listings.
    Source
    DNS, OpenPhish, PhishTank, the home page of a lookalike domain opened as an ordinary visitor.
    How often
    Once a day.
    All good
    No third-party lookalike domain impersonating you.
    We alert you when
    We find a third-party lookalike domain with mail or with a page in your name.
  • Signs of a social engineering attempt

    Social engineering is fraud in which the attacker persuades a person, not a computer: a fake email from the boss, the bank or a supplier. We look for signs that someone is laying the groundwork.

    What we check
    Lookalike domains that have mail set up, and your domain’s protection against spoofed emails (SPF and DMARC). Where protection is weak, a fraudulent email from your address gets through more easily.
    Source
    DNS (MX, TXT, _dmarc records).
    How often
    Once a day.
    All good
    No third-party lookalike domain with mail, and your mail is protected.
    We alert you when
    A lookalike domain starts receiving mail, or your domain allows the sender to be spoofed.
  • Impersonation of your executives

    A fraudster writes to your accountant as the managing director and asks for an urgent payment. Such an email comes from an address that only looks like yours.

    What we check
    Third-party domains similar to yours that receive or send mail, and your SPF and DMARC records, which decide whether the recipient rejects an email spoofed directly from your domain. We also watch for fake management profiles.
    Source
    DNS.
    How often
    Once a day.
    All good
    No lookalike domain with mail, and your domain’s DMARC rejects spoofed emails.
    We alert you when
    A lookalike domain with mail appears, or your domain’s protection is not sufficient.
  • Signs of fraudulent invoices in your name

    A customer receives an invoice "from you" with a different account number. The money then ends up with the fraudster.

    What we check
    Lookalike domains with mail, changes to your domain’s mail servers, and protection against a spoofed sender (SPF, DKIM, DMARC).
    Source
    DNS.
    How often
    Once a day.
    All good
    Your domain’s mail is protected and no third party has a lookalike domain with mail.
    We alert you when
    A lookalike domain with mail appears, or your mail servers change unexpectedly.
  • Redirecting your customers to a scam

    A customer clicks a link or types an address with a typo and ends up on a fraudulent site. We watch whether this could be happening with your brand.

    What we check
    Phishing lists (your domain and similar names), home pages of third-party lookalike domains, and where your own http:// address redirects.
    Source
    OpenPhish, PhishTank, DNS, an ordinary page visit.
    How often
    Several times a day, whenever the lists are refreshed.
    All good
    No fraudulent site in your name, and your website redirects only to your domain.
    We alert you when
    A phishing list records a fraudulent site similar to yours, or your website sends visitors to a third-party domain.
  • Fake login page

    A fake login page looks like yours and collects the passwords of employees or customers. It is the most common start of an attack.

    What we check
    Phishing lists for your domain and similar names. We open the home page of a third-party lookalike domain once as an ordinary visitor, fill in and submit nothing, and check whether it has a login form with your name, logo or title.
    Source
    OpenPhish, PhishTank, an ordinary page visit.
    How often
    Several times a day, whenever the lists are refreshed.
    All good
    Phishing lists contain no fraudulent site in your name and lookalike domains do not carry your login.
    We alert you when
    A lookalike domain has a login form with your name or look, or a phishing list records it.
  • Abuse of your brand online

    Someone can use your name and logo on their own website and profit from your reputation. We look for where this happens.

    What we check
    Lookalike domains, pages with your name, logo or a similar title, and entries in phishing lists. We also monitor social networks, listings and search results.
    Source
    DNS, OpenPhish, PhishTank, an ordinary page visit.
    How often
    Once a day.
    All good
    No third party uses your name or look on a lookalike domain.
    We alert you when
    We find a page that refers to your company or imitates your website.
  • Signs of fraud being planned

    Fraud is often prepared weeks in advance: someone buys a lookalike domain and sets up mail on it. This is the moment when you can still step in before any damage.

    What we check
    Whether lookalike domains are registered, who controls their nameservers (you, a domain reseller or a third party), whether they have mail set up, and whether a page with your name already runs on them.
    Source
    DNS, an ordinary page visit.
    How often
    Once a day.
    All good
    Lookalike domains are unregistered, owned by you, or parked for sale.
    We alert you when
    A third-party lookalike domain gets mail or a page with your name.
  • Typosquatting and lookalike domains

    A domain with a single typo (for example a missing letter) is easy to overlook in an email or web address. That is why fraudsters register them.

    What we check
    We generate variants of your domain: typos, adjacent keys, swaps of similar characters (o and 0), hyphens and other extensions. For each variant we check DNS to see whether it is registered, whether it belongs to you or is for sale, and whether it receives mail.
    Source
    DNS.
    How often
    Once a day.
    All good
    No variant has a third-party owner.
    We alert you when
    A third party owns a variant of your domain, especially when mail runs on it.
  • Fake social media profiles

    A fake profile of your company on a social network can ask your customers for payments or personal details.

    What we check
    We search Facebook, Instagram, LinkedIn and other networks for profiles with your name that are not linked from your website.
    Source
    Search engine.
    How often
    Once a day.
    All good
    The only profiles on social networks are the ones your website links to.
    We alert you when
    A profile with your name or logo appears that is not linked from your website.
  • Fake listings and ads

    A fraudulent listing with your name or product lures people to a fake offer.

    What we check
    We search classifieds and listing portals for ads with your name or product.
    Source
    Search engine.
    How often
    Once a day.
    All good
    No listing misuses your name.
    We alert you when
    An ad appears that offers your products or services under your name and does not come from you.

Blocklists and browser warnings

6 items

  • Spreading of malicious code

    A compromised website can, without the company knowing, serve malicious code or fraudulent pages to visitors.

    What we check
    Whether phishing lists record an address directly on your domain and whether the domain is on a list of dangerous domains. We also track Google Safe Browsing warnings.
    Source
    OpenPhish, PhishTank, Spamhaus DBL, SURBL.
    How often
    Several times a day, whenever the lists are refreshed.
    All good
    No address on your domain is reported as malicious.
    We alert you when
    A list records a malicious or fraudulent address on your domain. In that case the website or part of it is usually compromised.
  • IPs and domains on DNSBL blocklists

    DNSBLs are lists of IP addresses that send spam. Mail servers around the world use them to decide whether to accept an email.

    What we check
    The IP addresses of your website and mail servers on anti-spam lists. A listing of a mail IP is serious, because emails do not get delivered. A listing of a website IP on shared hosting is reported more mildly, because the hosting provider handles it.
    Source
    Spamhaus ZEN, SpamCop (queries via DNS).
    How often
    Twice a day, morning and evening.
    All good
    None of your IP addresses is on a list.
    We alert you when
    A mail or website IP address is on a list.
  • Domain on anti-spam lists

    Besides IP addresses, there are also lists of domains. When your domain is on them, emails with a link to your website get blocked.

    What we check
    Your domain on domain lists used by mail and security filters.
    Source
    Spamhaus DBL, SURBL.
    How often
    Twice a day, morning and evening.
    All good
    The domain is on no list.
    We alert you when
    The domain is on a list.
  • Google Safe Browsing warning

    When Google marks a website as dangerous, Chrome and other browsers warn visitors with a red screen.

    What we check
    We check your domain and lookalike domains against the Google list of dangerous sites that Chrome and other browsers use for their warnings.
    Source
    Google Web Risk.
    How often
    Several times a day, whenever the lists are refreshed.
    All good
    Neither your domain nor lookalike domains are flagged as dangerous.
    We alert you when
    Google flags your domain or a lookalike domain as fraudulent or harmful.
  • Damage to your credibility

    When an anti-spam list flags your domain or server, partners stop receiving your emails and some filters block links to your website.

    What we check
    The IP addresses of your mail and website on anti-spam lists, your domain on lists of dangerous domains, and entries in phishing lists. We also track browser warnings (Google Safe Browsing).
    Source
    Spamhaus ZEN, SpamCop, Spamhaus DBL, SURBL, OpenPhish, PhishTank.
    How often
    Twice a day, morning and evening.
    All good
    You are not on any list.
    We alert you when
    Your IP address or domain appears on one of the lists.
  • Harm to your reputation

    A blocklist entry or a fraudulent page under your name damages your reputation before you notice.

    What we check
    Anti-spam lists for IP addresses and the domain, phishing lists, and lookalike domains with a page in your name. We also track search results and AI answers.
    Source
    Spamhaus, SpamCop, SURBL, OpenPhish, PhishTank, DNS.
    How often
    Twice a day, morning and evening.
    All good
    Nothing that publicly marks you as dangerous.
    We alert you when
    An entry or page appears that links your name to fraud or spam.

Domains, DNS and certificates

15 items

  • Signs of an attack in progress

    Some changes seen from outside mean an attack is happening right now: the domain suddenly points elsewhere, mail goes to a third-party server, or a certificate appears that you did not order. Here we alert you immediately.

    What we check
    Sudden changes of nameservers, mail servers and website addresses, a certificate from an authority that has not issued for you before, a fraudulent address on your domain in phishing lists, and a listing of your company on a ransomware victim list.
    Source
    DNS, Certificate Transparency logs (crt.sh), OpenPhish, PhishTank, ransomware.live.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    Nothing has changed without explanation.
    We alert you when
    Any of these changes occurs. We alert you immediately by email and SMS.
  • A new TLS certificate you did not request

    A certificate is the credential a website presents to the browser. If someone else has one issued in your name, they can impersonate your website.

    What we check
    All certificates for your domain in Certificate Transparency logs, where authorities must record them. We watch whether an authority that has not issued for you before has appeared, and whether you have a CAA record specifying who may issue a certificate.
    Source
    crt.sh (Certificate Transparency logs), DNS (CAA).
    How often
    Twice a day, morning and evening.
    All good
    New certificates are issued only by your existing authorities.
    We alert you when
    A new authority has issued a certificate. You check whether your administrator ordered it.
  • Interruption of operations

    Your website and mail can stop working even without an attack: the domain or certificate expires, or a setting breaks. We alert you in advance.

    What we check
    The domain expiry date, certificate validity and trust, whether the domain and mail servers respond, and whether the website can be opened over https.
    Source
    Registry WHOIS, a TLS connection like a browser, DNS.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    Both the domain and the certificate are valid and everything responds.
    We alert you when
    Expiry is approaching or something stops responding.
  • NS server changes

    Nameservers determine who controls the whole domain: website, mail and everything else. A change without your knowledge is one of the most serious signals.

    What we check
    Your domain’s NS records compared with the previous check.
    Source
    DNS.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    The nameservers are the same as last time.
    We alert you when
    The nameservers change.
  • Registrar change

    The registrar is the company with which your domain is registered. A transfer to another registrar without your knowledge may mean the domain has been stolen.

    What we check
    The registrar in WHOIS records compared with the previous check, and the domain’s transfer protection. We do not store registrant contacts.
    Source
    Domain registry WHOIS.
    How often
    Once a day.
    All good
    The registrar is the same as last time.
    We alert you when
    The domain has moved to another registrar.
  • A, AAAA and CNAME record changes

    A, AAAA and CNAME records determine which server a visitor reaches. If someone changes them, customers see a third-party page even though they type the correct address.

    What we check
    The IPv4 and IPv6 addresses of your domain and www, and the CNAME record, compared with the previous check.
    Source
    DNS.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    The addresses are the same as last time.
    We alert you when
    An address or CNAME changes.
  • Domain expiring in 30 / 14 / 3 days

    When a domain expires, the website and emails disappear and anyone can buy the domain. A forgotten invoice is enough.

    What we check
    The domain registration expiry date in the registry.
    Source
    Domain registry WHOIS.
    How often
    Once a day.
    All good
    More than 30 days remain until the registration expires.
    We alert you when
    30, 14 and 3 days remain, or the domain has expired.
  • Certificate expiry

    After a certificate expires, the browser shows a warning and most people leave. Renewal can be arranged in advance.

    What we check
    The expiry date of the certificate the website presents on an ordinary connection, as to a browser.
    Source
    A TLS connection like an ordinary browser.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    The certificate is valid and far from expiry.
    We alert you when
    The certificate is nearing expiry or has already expired.
  • Broken certificate chain

    A certificate needs a chain of trust up to an authority the browser knows. If a link is missing, some devices will not open the website.

    What we check
    Whether the certificate can be verified the way an ordinary browser verifies it, and how many chain certificates the server sends.
    Source
    A TLS connection like an ordinary browser.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    The chain is complete and verification succeeds.
    We alert you when
    Verification fails because of a missing or untrusted link in the chain.
  • Self-signed or internal certificate

    Browsers do not accept a certificate the server signed itself, and the visitor sees a warning. It is often a sign of a forgotten or test server.

    What we check
    Who issued the certificate and whether it matches your domain name.
    Source
    A TLS connection like an ordinary browser.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    A certificate from a recognized authority for the correct name.
    We alert you when
    The certificate is self-signed, internal or issued for a different name.
  • Wildcard certificate shared across services

    A wildcard certificate (*.yourcompany.com) is valid for all subdomains at once. If it leaks from one server, it puts all of them at risk.

    What we check
    Whether the certificate the website presents contains a wildcard name, and which other names it covers.
    Source
    A TLS connection like an ordinary browser, crt.sh.
    How often
    Twice a day, morning and evening.
    All good
    No wildcard, or used only where it is intended.
    We alert you when
    The website uses a wildcard certificate. This is a point to consider, not an error.
  • Domain history and ownership changes

    Domain age, registrar and protection status form the basic profile of your domain. A sudden change in them is often the first sign of a transfer or sale.

    What we check
    Registration date, last change, registrar and domain status (for example a transfer lock) from WHOIS records. We see a change of ownership through changes of registrar, nameservers and domain status. We do not store registrant contacts, as they are personal data.
    Source
    Domain registry WHOIS.
    How often
    Once a day.
    All good
    The data has not changed.
    We alert you when
    The registrar, nameservers or domain status change.
  • Changes no one reported

    Domains, DNS and websites are often managed by several people and suppliers. A change nobody knows about is either a mistake or outside interference.

    What we check
    At every check we store a snapshot: DNS records, registrar, where the redirect leads, home page text, website technologies and certificate issuers. The next check compares against it.
    Source
    DNS, WHOIS, crt.sh, an ordinary website visit.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    The snapshot is the same as last time.
    We alert you when
    Something has changed. We tell you what and when, and you check whether your administrator did it.
  • IP address history of your domain

    Address history shows where the domain pointed in the past. It helps tell a planned change from a suspicious one and trace since when something has been happening.

    What we check
    Every day we store a snapshot of A, AAAA, NS and MX records, and from certificate logs we add when each name under the domain first appeared. The history starts with the first check.
    Source
    Our own daily snapshots of DNS, crt.sh.
    How often
    Once a day.
    All good
    A timeline without unexplained changes.
    We alert you when
    An NS or MX record has changed in recent days.
  • Missing DANE and DNSSEC

    DNSSEC signs DNS answers so that nobody can spoof them on the way. DANE allows a mail server’s certificate to be verified directly via DNS.

    What we check
    Whether the zone is signed (DNSKEY) and the registry holds its fingerprint (DS), and whether your mail servers publish a TLSA record.
    Source
    DNS.
    How often
    Twice a day, morning and evening.
    All good
    DNSSEC is enabled and verifiable.
    We alert you when
    DNSSEC is missing or the registry does not hold the fingerprint. This is a recommendation, not an error.

Email

9 items

  • Misuse of your name in email

    Without the right settings, anyone can send an email that looks like it came from your address. The recipient cannot tell it from the real one.

    What we check
    3 DNS records through which a domain tells recipients how to verify its mail: SPF (who may send), DKIM (email signature) and DMARC (what to do with an email that fails verification).
    Source
    DNS (TXT, _dmarc, _domainkey).
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    SPF ends with ~all or -all and DMARC is in quarantine or reject mode.
    We alert you when
    SPF or DMARC is missing, or they are set so that a spoofed email is not rejected.
  • Failure of email protection

    Email protection can break even without an attack, for example when you change provider. We make sure it does not weaken silently.

    What we check
    We compare SPF, DMARC and MX records with the previous check. Plus MTA-STS and TLS-RPT, which protect mail encryption in transit.
    Source
    DNS, the MTA-STS policy from the address defined by RFC 8461.
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    Protection is in place and has not changed since the previous check.
    We alert you when
    A record disappears, weakens or changes unexpectedly.
  • Email falling into spam

    When your emails end up in spam, customers do not reply and invoices go unread. The cause is usually in the domain settings or a blocklist.

    What we check
    Whether the domain has exactly 1 valid SPF record, whether a DKIM key is found, whether it has DMARC, and whether the IP address of your mail server is on an anti-spam list.
    Source
    DNS, Spamhaus ZEN, SpamCop.
    How often
    Twice a day, morning and evening.
    All good
    Mail authentication is complete and the mail server is on no list.
    We alert you when
    Something from the above is missing or the mail server is on a list.
  • SPF with ?all or +all

    SPF is a list of servers allowed to send mail for your domain. The ending ?all or +all means the list rejects no one.

    What we check
    The TXT record starting with v=spf1: whether it exists, whether there is only 1, and how the all rule ends (including via a redirect).
    Source
    DNS (TXT).
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    Exactly 1 SPF record ending with ~all or -all.
    We alert you when
    SPF is missing, there are several at once, or it ends with ?all, +all or has no all rule at all.
  • Missing DKIM signature

    DKIM is a digital signature on every email. It lets the recipient know the email really came from you and was not altered on the way.

    What we check
    The public DKIM key in DNS under the common names (selectors) used by major mail providers. A selector can have a different name, so we report a missing key only as a notice: without access to your mail we cannot rule it out with certainty.
    Source
    DNS (_domainkey).
    How often
    Twice a day, morning and evening.
    All good
    We found a DKIM key.
    We alert you when
    There is no key under the common selectors. You can verify this with one look at your mail settings.
  • DMARC p=none without enforcement

    DMARC tells recipients what to do with an email impersonating you. The p=none mode only monitors it and does not reject it.

    What we check
    The TXT record at the _dmarc address of your domain and its p rule.
    Source
    DNS (_dmarc).
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    p=quarantine or p=reject.
    We alert you when
    DMARC is missing or is only p=none.
  • MX pointing to unknown servers

    The MX record determines which server receives your mail. If it changes without your knowledge, your mail may flow to someone else.

    What we check
    Which servers receive mail for your domain, whether they all really exist, and whether they have changed since the previous check.
    Source
    DNS (MX).
    How often
    Continuously during the day, every few minutes in the client overview, and in the full check twice a day.
    All good
    The mail servers exist and are the same as last time.
    We alert you when
    MX changes, or points to a name that does not exist and that anyone could register.
  • Missing MTA-STS and TLS-RPT

    MTA-STS ensures that mail to you is always sent encrypted. TLS-RPT sends you a report when encryption fails somewhere.

    What we check
    The _mta-sts record and the policy at the address defined by RFC 8461 (only if the domain itself announces it), whether it is in enforce mode, and the TLS-RPT record at _smtp._tls.
    Source
    DNS, MTA-STS policy.
    How often
    Twice a day, morning and evening.
    All good
    MTA-STS in enforce mode and TLS-RPT set up.
    We alert you when
    They are missing, the policy is unavailable or it is only in testing mode. This is a recommendation, not an error.
  • Missing BIMI

    BIMI displays your verified logo next to your emails in mail clients. It is not protection, but it increases recipients’ trust.

    What we check
    The BIMI record at default._bimi of your domain.
    Source
    DNS.
    How often
    Twice a day, morning and evening.
    All good
    BIMI is set up.
    We alert you when
    BIMI is missing. We mention it for information only, it is optional.

Subdomains and forgotten services

6 items

  • Exposed internal and test machines

    Test and internal servers are usually less protected than the main website. When their names are public, an attacker knows where to look.

    What we check
    Subdomain names in certificate logs that look like development, test or internal ones (for example dev, test, staging, intranet).
    Source
    crt.sh.
    How often
    Twice a day, morning and evening.
    All good
    No such names.
    We alert you when
    We find such a name. You check whether it should be reachable from the internet.
  • CNAMEs to third-party services

    A subdomain can point to a service with another provider (cloud, website hosting). If you cancel the service there and the record remains, a hole opens up.

    What we check
    CNAME records of subdomains that lead to third-party cloud and hosting services, and whether their target still exists.
    Source
    crt.sh, DNS.
    How often
    Twice a day, morning and evening.
    All good
    The target of every CNAME exists.
    We alert you when
    The target of a CNAME on a third-party service no longer exists.
  • Orphaned DNS records

    An orphaned DNS record points to something that no longer exists. Whoever obtains that name can take over your subdomain or mail.

    What we check
    CNAME and MX records whose target does not exist in DNS.
    Source
    DNS.
    How often
    Twice a day, morning and evening.
    All good
    All targets exist.
    We alert you when
    We find a record with a non-existent target.
  • Internal names leaked via DNS

    Names such as vpn, intranet or git reveal which systems a company uses. It is a map for an attacker.

    What we check
    Internal and technical names that are publicly visible in certificate logs and in DNS.
    Source
    crt.sh, DNS.
    How often
    Twice a day, morning and evening.
    All good
    No internal names are publicly visible.
    We alert you when
    A record in DNS or in a certificate log reveals an internal name.
  • Forgotten and orphaned services

    A forgotten subdomain that still points to a cancelled service can be taken over. Third-party content can then run on it under your name.

    What we check
    Subdomains whose CNAME record points to a service or name that no longer exists (for example a cancelled page on a cloud service).
    Source
    crt.sh, DNS.
    How often
    Twice a day, morning and evening.
    All good
    All subdomains point to existing services.
    We alert you when
    A subdomain points to a name that anyone can register.
  • Subdomains from Certificate Transparency logs

    Every certificate for a subdomain is recorded in a certificate log. From it we build a complete list of what you have under your domain, including what you have forgotten.

    What we check
    All names under your domain from Certificate Transparency logs. For the most important ones we check in DNS where they point, and with a single ordinary visit over https whether they respond.
    Source
    crt.sh, DNS.
    How often
    Twice a day, morning and evening.
    All good
    The list contains no forgotten or orphaned names.
    We alert you when
    A new name appears or one points to a cancelled service.

Your reputation online

6 items

  • What the internet says about your company

    People form their first impression of a company from what they find in a search engine and what AI tells them. We want you to see it before they do.

    What we check
    We monitor search results for your name and what AI assistants say about your company.
    Source
    Search engine and AI models.
    How often
    Once a day.
    All good
    Nothing fraudulent or untrue appears in the results or in AI answers.
    We alert you when
    A fraudulent page appears among the top results or an AI states something untrue about you.
  • Reputation risk through AI

    People increasingly ask ChatGPT and other assistants about companies. When AI claims something untrue about you, the customer believes it.

    What we check
    We regularly ask an AI model about your company and compare its answers with what your website says.
    Source
    AI models.
    How often
    Once a week.
    All good
    The AI gives details about you that match your website.
    We alert you when
    The AI gives a wrong contact, service or claim that your website does not confirm.
  • Reputation within your industry

    How your industry sees you is shaped by reviews, articles and AI answers. A decline can be caught before it shows in your orders.

    What we check
    We combine search results, mentions and AI answers into one picture of your reputation.
    Source
    Search engine and AI models.
    How often
    Once a day.
    All good
    The picture of your company is not getting worse.
    We alert you when
    New mentions link your name to fraud or complaints, or what AI says about you gets worse.
  • A worsening trend over time

    A single finding is not a problem, but when findings slowly accumulate, security is getting worse. We show the trend over time.

    What we check
    We store the result of every check with its date. The client overview shows how many checks are fine, how many have a finding, and how that changes.
    Source
    The history of our checks.
    How often
    Twice a day, morning and evening.
    All good
    The number of findings is falling or stable.
    We alert you when
    Findings are increasing or fixed ones are coming back.
  • Changes in search results

    When a fraudulent page or a negative article appears in search results for your name, customers will see it first.

    What we check
    We monitor the top search results for your name and report new pages that link your name to fraud or complaints.
    Source
    Search engine.
    How often
    Once a day.
    All good
    No fraudulent or new negative page is among the top results.
    We alert you when
    A new page linking your name to fraud or complaints appears among the top results.
  • What AI answers claim about your company

    AI assistants answer questions about companies based on what they found on the internet, and sometimes make things up. We want you to know what they say about you.

    What we check
    We regularly ask an AI model about your company and compare its answers with your website: contacts, services, untrue claims.
    Source
    AI models.
    How often
    Once a week.
    All good
    AI answers match your website.
    We alert you when
    The AI gives a wrong contact, a service that does not exist or an untrue claim about you.

And more are coming. What holds up today may not hold up next month, so we keep expanding the list.

During an incident

What happens when we find something

  1. We alert the person in charge immediately, by email and SMS.
  2. We send your developer a detailed report: what is happening, since when, which services are affected and what to do first.
  3. When all is quiet, we do not disturb you.

With every finding you get the source it is based on and fix steps for your developer.

Guarding VS Antivirus

We guard you from the outside. Antivirus from the inside.

Antivirus and EDR/XDR, for example ESET, protect the computers, servers and network inside your company. What happens outside your devices cannot be seen from them. That is exactly what we guard, so Guarding is not a replacement but an addition.

Guarding by DatahorsesAntivirus and EDR/XDR
Where it worksON THE INTERNET, before an attacker gets into your PCPC, servers and internal network
What you installNOTHINGA list of your domains, subdomains and IPs is enough..EXE monitoring program on every device and server! Your device is monitored completely.
What it sees
  • Leaked company login credentials
  • Lookalike and typo domains
  • Fake login pages using your name
  • Fake invoices and emails in your name
  • Files on devices and servers
  • Running processes and applications
  • User sign-ins
  • Network traffic on devices
What it alerts you about
  • Signs an attack is being prepared
  • An attack in progress
  • Leaked login credentials
  • Identity theft and fake invoices in your name
  • Malware and ransomware
  • Suspicious behavior on a device
  • Threats it has just blocked
How they work togetherAdds the outside view, with no access neededKeeps protecting your devices

We compare types of protection, not specific products. The range of services differs from vendor to vendor. More in our article on attack surface monitoring vs. EDR and XDR.

Preview

This is what our Guarding service looks like in practice.

We do not watch single values in isolation, we watch combinations of indicators. One warning on its own is often harmless. When it lines up with others, we evaluate them together as a critical event and alert the person in charge by email and SMS right away. This is an illustrative demo, not the results of a specific company.

See a sample dashboard

Behind every alert is a real person.

We are not just an automated system. Every critical incident is also reviewed by a person, not just a machine. Then we get back to you with the next steps.

No installation. No access.

  • Nothing to installNo software or agent.
  • No access neededWe never ask for passwords, VPN or DNS access.
  • We guard from the outsideExactly the way attackers first look at you.

About us

Since 2020

We started as an elite team of developers specializing in security at Functu. Our team came together on December 4, 2020, and we kept making it stronger with the best experts. More and more clients came to us for security, so Datahorses became a company of its own, founded in the USA. Only then came an entity in Europe, and we keep expanding wherever our clients need us. Today, security is all we do.

How it all started →

Our founder, Juraj Andrascik, was named to the Forbes 30 Under 30 list.

Request a proposal

Design the scope of protection for your company

What should we guard

Domains, subdomains (for example shop.example.com) or IP addresses, one per row.

    We will reply personally by email. No phone call needed.

    Background

    We are part of the Functu group.

    Since 2004 · founded in Sydney, Australia

    The Functu team in a group photo
    The Functu team

    Microsoft Partner

    Exclusive partner for porting an app preinstalled on Microsoft devices.

    Intel Software Partner

    Software solutions built on Intel technologies.

    Forbes 30 Under 30

    Functu's CEO on the list of leaders under 30.

    Innovation award

    A travel app recognized by the Ministry of Transport of the Slovak Republic.

    Presidential campaign

    Involvement in Emmanuel Macron's campaign in 2022.

    Supplier to Disney

    Digital experiences for audiences around the world.

    Android Code, first place

    The Functu team won the Android Code competition.

    Developing since 2000

    More than 20 years of bespoke software. Today mainly AI, 3D and virtual reality.

    Forbes La République En Marche

    The references and logos shown belong to Functu. Trademarks are the property of their respective owners.

    Why there is no risk

    We look from the outside. We never try to break in.

    We track outside indicators

    Certificates, DNS, domain registries, blocklists and what your website shows to every visitor.

    We never try to break in

    We do not guess passwords, we do not attack and we do not put load on your server.

    No personal data

    We guard your company as a whole, not individual people. We work only with domains, certificates, mail and technical signals about your company.

    Nothing to install

    You install nothing and configure nothing. Your web developer or IT team does not need to do anything until there is something to fix.

    Frequently asked questions

    What you ask us most often.

    Do you need access to our systems?

    No. We do not need passwords, a VPN or any installation.

    How do you find problems without access to our systems?

    We guard everything about your company that is visible from the outside. We never enter your systems and never test anything on them.

    We already have antivirus or EDR/XDR (e.g. ESET). Do we still need you?

    Yes, the two complement each other. Antivirus and XDR protect the devices inside your company, while we watch what an attacker sees about you from the outside: lookalike domains, fraudulent pages using your name, data leaks, email settings, your website and servers. You change nothing, you just add us. See the comparison.

    What counts as 1 guarded asset?

    1 domain, subdomain, website or public IP address. For example, yourcompany.com, mail.yourcompany.com and shop.yourcompany.com are 3 assets. The number of assets is one of the factors that shape your proposal.

    How quickly will I find out about a problem?

    Immediately after detection, always by email and also by SMS if you turn it on. We remind you 30, 14 and 3 days before your domain or certificate expires.

    Can I choose what you alert me about?

    Yes. In the settings you choose separately for email and for SMS which incidents you want to receive: critical only, critical and medium, or all.

    Does a person review incidents too?

    Yes. Every critical incident is also checked manually by one of our specialists, who then gets back to you with the next steps.

    What does the output look like?

    You get your own dashboard with the progress of checks, findings and fix instructions. See a sample dashboard.

    Will you fix it for us?

    For every finding you get exact fix instructions for your developer, also as a download. The fix can be done by whoever manages the service, or you can order it from us as a separate service: we price it by scope, you give us access to your domain and DNS only for the duration of the fix, and we confirm the scope and the result in writing.

    When do you start guarding?

    After you accept the offer, we start guarding and prepare your dashboard within 72 hours.

    Can I end the subscription?

    Yes, anytime by email, effective at the end of the paid period. The subscription period is agreed in your individual proposal.

    Who is behind Datahorses?

    Our team of security specialists, led by our founder and CEO Juraj Andrascik. Learn more in About us; the operator details are in the page footer.

    Articles

    Practical notes on guarding a company from the outside.

    More Articles

    Contact

    Want us to guard your company?

    Send us a question, a technical problem or a finding as a ticket. Every ticket gets a number and we reply to you personally by email.

    How we handle your data is explained in our Privacy Policy.