Daily scans for fake sites of your brand. Takedown requests you approve.

Thicket watches for lookalike and phishing domains of your brand, keeps records and screenshots with dates, and sends takedown requests you approve. $900 a year per brand, sub-brands included. A takedown credit is used only if a notice you approve is filed and the site or domain goes offline within 30 days.

Brand-protection monitoring software by Rubus Labs, founded by Nathan Dunn, CISSP.

The problem

One letter off is all it takes.

Anyone can register a domain one letter off from yours, copy your storefront, and start taking your customers' money or passwords. Enterprise brand-protection tools exist, at enterprise prices. Thicket brings the same playbook to brands and firms that don't have an enterprise budget.

How it works

Find, record, and send requests you approve.

Find

Every day, Thicket checks typo variants of your domain, other TLDs, and certificate transparency logs for new lookalikes.

Verify

Each suspect is screenshotted next to your real site and scored by AI. It only counts as a match if it uses your brand and carries harmful content.

Record

Every case gets a SHA-256 hash of each capture, screenshots with dates, and a log of each notice.

Notify

AI suggests the right basis (abuse, trademark, or copyright). A Rubus Labs reviewer checks every case, and nothing is sent without your approval. We file within 1 business day of your approval. Notices go to the registrar, host, CDN, and blocklists (Netcraft, APWG, Google, Microsoft), with DMCA notices for copyright.

Escalate

If the site is still up after 24 hours, we prepare follow-ups, such as second notices, a registry report, or an ICANN complaint. A Rubus Labs reviewer checks every case, and nothing is sent without your approval. C&D, URS, and UDRP documents are drafts for your attorney. Nothing legal is ever sent automatically.

Stay informed

You get an email for every action and a monthly report. Replies are verified, so an impersonator can't pretend to be you and call off the takedown.

For law firms

Built for brand-impersonation matters.

  • Notices signed by you, on behalf of your client
  • One login across all your clients
  • Records and screenshots with dates you can share with your client
Talk to us about your clients →

For brands

Someone watching, so you don't have to.

  • Set up in 6 steps, no sales call required
  • Know when a fake version of your store appears
  • We chase registrars, hosts, and blocklists so you don't have to
  • One plan covers your brand and all its sub-brands
Start monitoring →

Pricing

One flat price. Credits used only on Successful Takedowns.

No enterprise contract, no seat counts. One plan per brand, with its sub-brands included.

Law firms: one Thicket Annual plan per client brand. Your firm can pay, or you can arrange for the client to pay. Manage every client from one login.

Thicket Annual

$900/year

per brand, sub-brands included

  • Covers one brand, including its sub-brands
  • Daily scans for new lookalike domains
  • A SHA-256 hash of each capture, with records and screenshots with dates
  • 4 takedown credits included
  • $200 per additional Successful Takedown
  • Email on every action + monthly report

A takedown credit, or the $200 fee once credits run out, applies only to a Successful Takedown: a notice you approved is filed and, within 30 days, the site or domain is suspended, removed, disabled, or no longer resolves, for any reason.

Start monitoring →

FAQ

Questions, answered.

What does one plan cover?

One brand, including its sub-brands (for example, a parent brand and its product lines). A separate, unrelated brand needs its own plan.

What counts as a takedown?

A Successful Takedown: a notice you approved is filed and, within 30 days after it is filed, the target site or domain is suspended, removed, disabled, or no longer resolves, for any reason. A notice that doesn't lead to a Successful Takedown within that period uses no credit and costs nothing.

Will you send legal letters without my approval?

No. C&D, URS, and UDRP documents are drafted for an attorney and never sent automatically. A Rubus Labs reviewer checks every case, and nothing is sent without your approval. We file within 1 business day of your approval.

How do you avoid false alarms?

A suspect only becomes a match if it shows your brand and harmful content. A parked or unrelated lookalike domain isn't flagged as a match.

What records does Thicket keep?

A SHA-256 hash of each capture, screenshots with dates, and a log of each notice.

Who do notices go to?

The registrar, host, and CDN, plus blocklists including Netcraft, APWG, Google, and Microsoft. Copyright cases get DMCA notices. If the site is still up after 24 hours, we prepare follow-ups, such as a registry report or an ICANN complaint. A Rubus Labs reviewer checks every case, and nothing is sent without your approval. We file within 1 business day of your approval.

Can the scammer stop the process by replying?

No. Replies are verified, so an impersonator can't call off a takedown.

I'm an attorney. Can notices go out under my name?

Yes. Notices can be signed by the client's attorney, and one attorney account can manage multiple clients. Each client brand is one Thicket Annual plan ($900/yr, sub-brands included), paid by your firm or arranged for your client to pay.

How long does setup take?

Onboarding is 6 self-serve steps at dashboard.rubuslabs.com/onboarding.

How is this different from Netcraft, Bolster, ZeroFox, and others?

They're built and priced for large enterprises. Thicket finds lookalikes, keeps records and screenshots with dates, and sends takedown requests you approve, at a flat annual price.

Someone may already be using your name. Find out.