01
A look-alike domain registers
A fraudster registers a convincing fake — minutes old, built to fool your customers.
$ whois secure-bank-login.com
registered: just now
registrar: NameCheap
● age < 1 hour
External threat protection for banks & fintech
We protect your name, not your network.
SENTLOCK finds the look-alike domains, cloned sites and spoofed SMS sender IDs impersonating your brand. An 8-layer radar checks each one the way your customers would see it, and confirmed threats are taken down.
Free instant check
8-layer radar · cloaking bypass · takedown to offline
01 / 06 ·The problem
Scattered signals.
A look-alike domain registered overnight. A cloned login page. An SMS sent under your name. On its own, each one looks like noise.
02 / 06 ·Layers 01–03
Read from the outside.
Registration records, certificates and DNS show who set a domain up, how, and where it is hosted. Nothing is installed inside your network.
- 01 WHOIS Analysis
- 02 TLS Certificate
- 03 DNS Records
03 / 06 ·Layer 04
Seen the way a victim sees it.
Phishing kits show security scanners a harmless decoy. SENTLOCK loads the page the way a real customer would and inspects what actually comes back.
- 04 Cloaking Bypass
04 / 06 ·Layers 05–07
Cross- examined.
Threat-intelligence feeds, visual similarity to your real brand, and what the page is built to do. Each layer reaches its own conclusion.
- 05 Threat Intelligence
- 06 Visual Similarity
- 07 Intent Analysis
05 / 06 ·Layer 08
One verdict.
Eight independent results fuse into one calibrated verdict, so the alerts that reach your team are the ones worth acting on.
- 08 Final Verdict
06 / 06 ·Takedown
Locked.
Once a threat is confirmed, SENTLOCK sends abuse reports to the registrar, the host and global blocklists, and keeps the case open until the site is offline.
Attackers don't breach your walls. They wear your face.
Impersonation and fraud happen on the open internet, not inside your firewall — look-alike domains, cloned login pages, spoofed SMS. SENTLOCK hunts them down out there and shuts them down, so your customers never meet the fake.
How it works
Detection to takedown, end to end
01
Monitor
Continuously watch the open internet for new domains and look-alikes targeting your brand.
02
Detect
Run each candidate through the 8-layer radar for a single, calibrated risk verdict.
03
Verify
Brand-aware verification strips out the noise, so every alert you get is a real one.
04
Take down
Once a threat is confirmed, send formal abuse reports and track the domain until it is offline.
The radar
One domain. Eight independent verdicts.
No single layer decides — they corroborate, so a confident verdict is hard to fool and easy to trust.
01
WHOIS Analysis
Surfaces the tell-tale registration patterns that separate a throwaway look-alike from a legitimate domain.
02
TLS Certificate
Reads a domain's certificate posture for the signs of a site built to deceive, not to last.
03
DNS Records
Maps the hosting and mail infrastructure behind a domain to expose impersonation set-ups.
04 Crown jewel
Cloaking Bypass
Sees the page your customers would actually be shown — defeating the cloaking that hides phishing from ordinary scanners.
05
Threat Intelligence
Corroborates every finding against global threat-intelligence feeds.
06
Visual Similarity
Compares how a page looks against your real brand to catch pixel-perfect clones.
07
Intent Analysis
Judges what a page is actually built to do — harvest credentials, impersonate, defraud.
08
Final Verdict
Fuses every layer into one calibrated verdict and routes only the real threats to you.
The threat journey
One fake domain, from birth to blackout
02
SENTLOCK's radar catches it
SENTLOCK is already watching the open internet — it surfaces the look-alike the moment it appears, often minutes after registration.
03
Eight layers evaluate it
Each layer scores the domain independently, then corroborates into one verdict.
WHOIS
TLS Cert
DNS
Cloaking Bypass
Threat Intel
Visual Match
Intent
Verdict
04
The crown jewel: cloaking bypass
Phishing kits show security scanners a harmless decoy. SENTLOCK sees the page your customers would actually be shown — defeating that cloaking.
Datacenter scanner
Welcome 👋
Nothing to see here.
→ sees a decoy · marked safe
SENTLOCK · customer view
Bank login
→ sees the real phishing page
05
Verdict
The layers corroborate into one confident verdict, ready for confirmation.
Verdict
PHISHING
risk score 95 / 100
06
The takedown is dispatched
Once the threat is confirmed, formal abuse reports go to every relevant desk at once.
Registrar abuse desk report sent
Hosting provider report sent
Browser safe-browsing report sent
Anti-phishing networks report sent
07
The domain goes dark
The fake is suspended and blocklisted, and the case stays open until it is offline.
secure-bank-login.com
OFFLINE · threat neutralized
Why SENTLOCK catches what others miss
Sees what your customers see
Phishing kits show security scanners a harmless decoy and real victims the actual attack. SENTLOCK defeats that cloaking and inspects the page your customers would actually be shown — the attacks ordinary scanners miss entirely.
Brand-aware, low false-positives
SENTLOCK knows your real domains and brand identity, so it suppresses alarms on your own infrastructure and surfaces only genuine look-alikes — signal, not noise.
Detect → Destroy
Once a threat is confirmed, formal abuse reports go to the right registrars, hosts and global blocklists, closing the loop from detection to takedown.
Protects your name, not your network
SENTLOCK is external by design. No agents, no integration into your stack — it watches the open internet for anyone wearing your brand.
Guides
Learn how impersonation works
Plain answers about look-alike domains, cloaking and how SENTLOCK decides what is real.
01 What is a look-alike domain? How attackers imitate a bank's web address, and the signs that give them away. 02 How the eight layers work Eight independent checks, from registration records to what the page shows a customer. 03 Cloaking in phishing Why phishing kits show scanners a decoy, and how to judge the page victims actually see. 04 FAQ Short answers on setup, false positives, takedown and SMS.
Put SENTLOCK on look-alikes of your brand.
Join the early-access list — we'll be in touch to set SENTLOCK loose on impersonations of your own domain.
