Phishing & Impersonation Analysis
Where impersonation connects, and how far it reaches
Starting from one impersonation that has surfaced, we find the infrastructure behind it and how far it has spread.
We analyse which infrastructure the domains resembling your name, the impersonating sites, and the emails and texts connect to, and check whether there is impersonation not yet reported. We also look at the settings on your own domain that verify mail senders, keep what is confirmed apart from what still needs checking, and set out what to act on first.
What is behind the impersonation of us, and how far has it spread?
We set out the domains and infrastructure used and how they connect, keep what is confirmed apart from what needs checking, and show what to act on first.
Reviewed
When it fits
- Fake sites or texts in your name are going around
Customers or staff have reported sites or texts pretending to be you, and you want to know what they connect to and how far they have spread.
- A payment request went out in your CEO's name
A partner received an email in your CEO's name asking for a payment, and you want to know which domains and sending infrastructure were used.
- Domains resembling your name have appeared
A domain resembling your company name has been newly registered, and you want to check early whether it is actually being used for impersonation.
- Impersonation keeps coming back
Impersonation keeps recurring, and you want new cases checked for at an agreed interval.
What we look at
Starting from an impersonation that has surfaced, we look at the domains and infrastructure connected to it, and how far it has spread.
Impersonation that has surfaced
- Impersonating websites
- Impersonating emails and texts
- Messages using the names of your executives or staff
- Impersonating apps and social media accounts
Infrastructure behind it
- Domains resembling your company name
- Servers hosting the impersonating sites
- Infrastructure sending the emails and texts
- Other impersonation on the same infrastructure
Spread and your own settings
- When it first appeared and how far it has spread
- Your name, logo and pages copied for the impersonation
- Settings on your domain that verify mail senders
If a domain resembling your name has been newly registered and some of the settings that verify senders on your own domain are missing, we check whether that domain actually sends mail, and whether it could lead to phishing aimed at your staff.
How it runs
Agree the targets
We agree the company and brand names and domains, the executives' and staff names to watch for, the impersonation already reported, and the sources to use.
Follow the infrastructure
From the impersonation that has surfaced we follow the domains, servers and sending infrastructure, and check for other impersonation on the same infrastructure.
Expert review
Analysts review the connections and timing, and separate what is confirmed from what still needs checking and what is unrelated.
Report
We explain how things connect and how far they have spread, what to improve in your domain's settings, and what to act on first.
One reported case can be followed in depth as an in-depth investigation; where impersonation keeps recurring, it can run as monitoring at an agreed interval. See the three ways to run it
What you receive
The infrastructure and how it connects
How the domains, servers and sending infrastructure used for the impersonation connect to one another, with the evidence.
How far it has spread
Other impersonation found on the same infrastructure and when it appeared, with what is confirmed kept apart from what still needs checking.
What to improve in your domain's settings
What is missing or weak in the settings that verify mail senders.
What to act on first
Based on the likely impact, what to do first, such as alerting customers and staff or tightening your domain's settings.
This analysis looks at impersonation outside and the infrastructure behind it. Training people to notice and report impersonating messages is part of security awareness for all staff.