Phishing protection
Checks a link before you open it and warns about lookalike domains.
- Available
- 03
- Limited
- 01
- Not released
- 02
- Coming
- 02
How the attack works
Phishing copies a page you trust — a bank login, a delivery-tracking page, a webmail screen — and puts it on a domain that is almost right. The page collects what you type and often forwards it to the real site in real time, so even one-time codes can be relayed.
- STAGE 01
Lure
An email, text or social-media message with a link: a failed delivery, an expiring password, an invoice, a shared document.
- STAGE 02
Lookalike
A domain one character off, a brand name inside a subdomain (brand.example-login.net), or Unicode letters that look identical to Latin ones.
- STAGE 03
Harvest
A copied login form collects the username, password and often the OTP.
- STAGE 04
Relay
Credentials are replayed against the real site within minutes, before the page is reported and taken down.
- Webmail and cloud-storage users
- Bank and payment-app customers
- Employees with access to finance or HR systems
- Anyone whose email address appeared in an earlier breach
A common pattern: a short-lived domain that copies a well-known brand is registered, used in a burst of messages for a few hours, and abandoned once it starts appearing on blocklists. This is why a static blocklist alone misses much of it, and why the domain itself is worth reading.
Phishing pages copy a brand you trust and live on a domain that is one letter off. They exist for hours, which is why a static blocklist alone misses most of them.
Sensor, rule, evidence, action
Each step carries its own state. A step that is not built is shown as coming, not skipped.
You paste or share a link
Nothing watches your browsing. A check starts only when you submit a link.
AvailableAndroid 4.50, desktopLocal heuristics
Lookalike characters, brand names in the wrong place, and suspicious structure, checked on the device.
AvailableAndroid 4.50Named reputation, when one exists
The design admits a reputation verdict only from a named provider, with an expiry. Today the desktop provider only knows reserved test domains.
Not releasedDesktop (unsigned pre-release)Verdict with reasons
Suspicious or unknown, with the reasons shown. An unknown link is never reported as trusted. Nothing is blocked.
Not released
Local heuristics first: lookalike characters, brand names in the wrong domain, very new domains where known.
Only the verdict and the hostname leave the device, and only if you turned on cloud reporting. The full URL never does (privacy spec §2).
We say "suspicious" with reasons, never "safe forever".
What works today, and what is coming
What works today
04In production or in the current download.
- Paste-a-link checkAvailable
Heuristic check of a pasted or shared URL with the reasons shown.
Android app 4.50
- Lookalike domain and fake-login warningsAvailable
Homograph and brand-in-subdomain detection.
Android app 4.50
- Signed blocklist on the phoneLimited
The hub signs a list of known-bad sites; the phone downloads it and matches on the device. Coverage depends on the lists we ingest; it is not a full reputation service.
Android app 4.50
- Link historyAvailable
Links you checked and their verdicts, kept on the phone.
Android app 4.50
Built, not yet released
02The code exists and is tested in the repository; it has not shipped to users.
- Desktop link checkNot released
The desktop app has the check wired, but today it only knows test domains.
Sentinel desktop (unsigned pre-release)
- Reviewed web categoriesNot released
Signed category lists, local DNS choices, allow-lists and block reasons. Needs VPN consent. Encrypted DNS, fixed addresses and unsupported traffic can bypass filtering; it cannot replace another browser’s HTTPS page.
Coming
02Not built yet. Nothing on this list runs today.
- Domain reputation and redirect-chain analysisComing
A shared reputation service and following redirects to the final page.
- Email phishing and business-email-compromise detectionComing
Needs a mail integration that does not exist yet.
Enterprise XDR
4 attack families map to this capability
Copied row by row from our engineering register. A family counts as detected only when a rule, a sensor that feeds it and a test that makes it fire all exist.
Feature states above and register statuses measure different things: a feature can be built while the family it addresses stays unobserved, because the register counts sensors and rules, not screens.
| # | Attack family | Status | What the register says |
|---|---|---|---|
| 033 | Phishing | Partial | The desktop link check gives a verdict with reasons, but today it only recognises reserved test domains. Repository only; no browser or DNS interception.Repository only |
| 034 | Spear Phishing / Whaling | No sensor | No email or message telemetryNothing runs |
| 038 | Business Email Compromise | No sensor | No mailbox or payment-workflow telemetryNothing runs |
| 097 | Domain Typosquatting / Homograph | No sensor | No homograph or look-alike comparisonNothing runs |
What runs where, and what never leaves
Classification happens on the device before anything is queued. Cloud reporting is off by default on consumer devices and turning it off also stops events already queued.
Runs on the device
- The full URL you pasted
- Heuristic checks and the reasons they produce
- Your history of checked links and verdicts
May reach the cloud
- Only with cloud reporting on: the verdict, the hostname and the reason
Never leaves
- The full URL
- Your browsing history
- Page contents or anything you typed into a page
Editions that include it
Android protection you can install today.
> Android phone owners
Local-first protection for your own computer and phone.
> One person, 1–3 devices
Provider interfaces for chosen-media checks and email exposure monitoring.
> Individuals who want the advanced checks
A shared timeline of security events across endpoints, servers and phones.
> Security teams and MSPs
Each feature above names the platform or edition it runs on. An edition's own page lists the full state of that edition.
What to do if…
Practical steps that work whether or not you use our products.
You typed a password into a page you now doubt
- 1.Change that password now, from the real site or app, not from the link.
- 2.Change it anywhere else you reused it.
- 3.Turn on two-step verification and review recent sign-ins and connected devices.
You are not sure about a link
- 1.Read the domain right to left from the first single slash: the part just before .com/.in/.net is who owns it.
- 2.Open the site yourself from a bookmark or the official app instead of the link.
- 3.Paste the link into the link check to see the reasons (Android 4.2, not yet released).
A work email asks for an urgent payment change
- 1.Do not reply to the email. Call the requester on a number you already have.
- 2.Follow your organisation's payment-change procedure, even under time pressure.
Limits and known gaps
- GAP-01There is no live reputation service. The desktop link check recognises only reserved test domains today; everything else is "unknown".
- GAP-02No browser or DNS interception: a link you open without checking is not seen.
- GAP-03The register counts phishing as partial (a desktop rule with a test, repository only) and spear phishing, typosquatting/homograph and business email compromise as not observable.
- GAP-04Email phishing and BEC detection need a mail integration that does not exist yet.
- GAP-05The Android local link check is available with limits. New reviewed web-category work is separately marked Not released.
Frequently asked
Do you see the websites I visit?
Will it block a phishing page?
Why does it say "unknown" instead of "safe"?
Capabilities that work alongside it
Decodes a QR code and checks where it really points before you pay or open it.
DNS filtering and your own blocked and allowed lists on the phone; page-level browser protection is not built.
Checks a message, payment request or caller against known scam patterns, on the device.
Password exposure checks, account sign-in safety and hacked-account help today; verified-address monitoring interfaces need a configured provider for results.