decloak.dev

Decloak finished October as the #1 deal across all of AppSumo Radar 🏆 AI agents are making attacks faster and cheaper. Defenders need to see what attackers see, first. Thank you to everyone who backed us 🙏 Lifetime deal: appsumo.com/pl/PPMtkEdMGS/

What about from the outside, like a real attacker? Thats what we're for 😀

Thank you!

5/ How it works, and what to do when you find one: decloak.dev/journal/lookalik… How did you find out about the last lookalike of your domain?

4/ What it isn't: phishing detection. "Live" means a page answered, not that it's malicious. Many lookalikes are parked or defensive registrations. It doesn't read page content yet, catch every variation or take anything down.

3/ For each one that's registered, we record whether it serves a live site, redirects or has no website, whether it can send email, and when it was registered. A week-old domain with a live page and mail records deserves a closer look.

2/ Decloak now watches for copies of your domain: - typos and swapped letters - look-alike characters, like rn for m, or Cyrillic letters - your name on other TLDs - added words like -login Up to about 250 variations, checked every day.

1/ The phishing site imitating your brand isn't on your domain. It's on exarnple.com, on someone else's servers, and nothing in your logs will ever see it. Most companies find out when a customer forwards the email.

Onwards and upwards from here @noahkagan!

5/ The full setup guide, with suggested cadences by site type: decloak.dev/journal/set-it-o… How often does your team actually rescan production today?

4/ The honest limit: scheduled isn't real-time. A weekly scan can leave a problem unseen for up to six days. For payment pages, pair it with client-side protection like a strict CSP.

3/ For everything else, webhooks. Send findings to Jira, Linear, PagerDuty or your own endpoint, with per-endpoint event selection and a delivery log. Every payload is HMAC-signed. Verify the signature, or anyone who learns the URL can page your on-call.

2/ Decloak can do the remembering: - Scheduled scans: weekly, monthly or quarterly - Email alerts when a scan finishes or a new critical or high finding appears - New criticals posted to Slack within minutes

1/ Yesterday's clean scan can be wrong today without anyone touching your site. A CVE lands against software you already run. A tag gets published. A plugin updates itself. So stop relying on remembering to scan.

5/ The full guide, plus five things to do this week: decloak.dev/journal/your-tag… When did anyone last read every Custom HTML tag in your container?

4/ What it can't see: A tag that only fires for some visitors may not fire during our scan. Server-side GTM never reaches the browser. And who has Publish access is only visible inside GTM. A scan is a snapshot, so schedule it.

3/ What Decloak checks: - Every GTM container on the page, with its tags and triggers (free) - Tags sending data to unrecognised or newly registered domains (free) - The full contents of Custom HTML tags (Starter)

2/ This isn't theoretical. Recorded Future found 569 shops infected with skimmers, 314 confirmed delivered through GTM. Infections that were cleaned up had run for 3.5 months on average.

1/ Anyone who can publish in Google Tag Manager can put JavaScript on your checkout page. No pull request. No review. No deploy. Nothing in your repo. That's why card skimmers love hiding there.

5/ The full guide, including how it runs behind a passkey login: decloak.dev/journal/active-t… What's the oddest file you've found still publicly reachable on a production site?