Know the moment
your site is cloned
Most organizations find out their site was cloned when a customer falls victim to it. With Site Canaries, you find out first.
How it works
Find phishing clones
before they reach your users
Set up in two minutes with no effect on page speed. Once your hostnames are listed, false positives are near zero, and you get an early warning every time your page turns up somewhere it shouldn't.
Two-minute setup
Add one tiny script to your website. That's it.
Cloned, tripwires and all
Phishing kits and attacker-in-the-middle proxies typically copy entire pages, including the Site Canary you set up.
Beacon fires
Get alerted the moment your page's Site Canary loads on a domain you haven't configured, often before a victim ever sees the attacker's page.
Response
Respond,
preemptively
A flagged malicious domain raises an alert with the clone's address and the evidence behind it. No triage queue, no guesswork.
Alert Splunk, push an expiring indicator to Sentinel, block the domain in Cloudflare Zero Trust or Zscaler, or request a Takedown.
Explore ConnectorsFAQ
Frequently asked questions
Abusive infrastructure,
disrupted
Have I Been Squatted helps security teams detect infrastructure targeting their organization, investigate it with evidence, and coordinate takedowns.