Guide · The radar
How does SENTLOCK's eight-layer detection work?
By the SENTLOCK team · Updated
Short answer
SENTLOCK checks each suspicious domain with eight independent layers. Three read the domain from the outside (registration, certificate and DNS). One loads the page the way a real customer would, to get past cloaking. Three examine the page itself (threat intelligence, visual similarity to your brand, and intent). The last fuses every result into one calibrated verdict.
What does each layer check?
| Layer | What it checks |
|---|---|
| 01 · WHOIS analysis | Registration patterns that separate a throwaway look-alike from a legitimate domain. |
| 02 · TLS certificate | The certificate's posture, for the signs of a site built to deceive rather than to last. |
| 03 · DNS records | The hosting and mail infrastructure behind the domain, to expose impersonation set-ups. |
| 04 · Cloaking bypass | The page a customer would actually be shown, past the decoy that phishing kits show scanners. |
| 05 · Threat intelligence | Corroboration against global threat-intelligence feeds. |
| 06 · Visual similarity | How the page looks compared with your real brand, to catch pixel-perfect clones. |
| 07 · Intent analysis | What the page is built to do: harvest credentials, impersonate, defraud. |
| 08 · Final verdict | Every layer fused into one calibrated verdict, routing only real threats to you. |
Why use independent layers instead of one score?
Any single signal can be faked or missing. A new domain is not always malicious, a phishing page can sit on an old one, and a kit can hide its real page from scanners. When each layer reaches its own conclusion and they have to agree, a confident verdict is much harder to fool, and legitimate sites are far less likely to be flagged.
How does SENTLOCK keep false positives down?
SENTLOCK knows your real domains and brand identity. It suppresses alarms on your own infrastructure and surfaces only genuine look-alikes, so the alerts your team receives are the ones worth acting on.
What happens after a verdict?
Once a threat is confirmed, SENTLOCK sends formal abuse reports to the registrar, the hosting provider and global blocklists, and keeps the case open until the domain is offline.
Do you need to install anything?
No. SENTLOCK is external by design. There are no agents and no integration into your stack: it watches the open internet for anyone using your brand. You can try the free instant check on any domain first.
See which look-alikes target your brand
Run the free instant check on your domain, or request early access for continuous monitoring.
