Watch the sources
Newly registered domains and Certificate Transparency logs, checked continuously. A phishing site shows up here before it goes live.
NRD feed · CT logsHow it works
From signal to takedown, without the noise.
Veylum watches the sources where impersonation is born, generates the look-alikes a fraudster would register, scores every match with evidence and prepares the takedown for you. Four stages, all automatic.
Generate the look-alikes
Typosquat, homoglyph, TLD swap, prefix/suffix and bitsquat engines build every variant of your brand and match it against what was just registered.
aurorabank-secure.exampleScore and explain
Deterministic rules score the risk. Ekos AI reads the site capture, labels the finding and writes why, so every verdict is traceable.
87.0 · phishing · 96%One-click takedown request
The notice is prepared with the evidence and addressed to the registrar or host's abuse contact. Veylum sends the request; the registrar or host decides on the removal. You follow the case from the dashboard until it closes.
notice sent · case openWhat Veylum does
Two places impersonation shows up first. One verdict. One click to take it down.
Pick a capability to see what it detects and what lands in your dashboard.
Look-alike domains, before they go live
From your brand name, Veylum generates the variants a fraudster would register and checks newly registered domains for each of them, every day.
- Typosquat, homoglyph, TLD swap, prefix/suffix, bitsquat
- NRD feed: new registrations mentioning your brand
- Screenshot, registrar and DNS on every match
Your brand
aurorabank.com
Variants generated
- aur0rabank.comTyposquat
- аurorabank.comHomoglyph
- aurorabank.coTLD swap
- aurorabank-secure.examplePrefix/Suffix
- auroracank.comBitsquat
- login-aurorabank.netNRD match
Every day the variants are checked against the newly registered domains feed. A hit becomes a finding with a screenshot in your queue.
TLS certificates issued for your name
Every public certificate is logged in Certificate Transparency. When one is issued for a look-alike of your brand, Veylum sees it, often hours before the phishing site opens.
- CT logs matched against your variants
- Issuer, subject names and issue time recorded
- Certificates view in the dashboard, linked to each finding
aurorabank-secure.exampleLet's Encrypt3 days agoHigh
*.aurorabank-login.netZeroSSL5 days agoMedium
aurorabank.coLet's Encrypt9 days agoMedium
mail.aurorabank.comDigiCert12 days agoOwn
SignalCert issued
ThenSite captured
ThenFinding scored
A verdict you can read, not just a score
Rules give the authoritative threat score. Ekos AI, models fine-tuned for cybersecurity tasks, reads the capture and explains what it sees: fewer false positives, traceable decisions.
- Label, confidence and written explanation
- Score breakdown by rule
- AI is an opinion; you confirm before takedown
Threat score · rules
87.0
brand_in_domain · recently_registered
High
Ekos AI analysis
Phishing · 96% confidence
Cloned login page detected: the site reproduces Aurora Bank's sign-in form and brand palette on a domain registered 3 days ago. Credential capture is the most likely objective.
This is an AI opinion, not a human review. The rule-based threat score above remains the authoritative signal.
Why this was flagged
Brand in domain
+45
Recently registered
+30
Login form detected
+12
Takedown request in one click, tracked to the end
Veylum prepares the abuse notice with the finding's evidence and addresses it to the registrar's or hosting provider's abuse contact. Removal is up to the registrar or host; Veylum keeps the case open until they act or you close it.
- Evidence package: screenshot, WHOIS, DNS, verdict
- Abuse contact resolved automatically
- Case timeline and activity log
- Evidence packagedScreenshot, registrar, DNS records, first seen and the Ekos AI verdict, attached to the notice.
- Notice sent to the registrar's abuse contactAddressed to Example Registrar LLC. One click from the finding, no template to fill.
- Awaiting provider responseStatus and every re-detection are logged. You get the timeline, not an inbox.
- Site down · case closedVeylum keeps re-checking the domain after closure and reopens the case if it comes back.
Inside your account
What a Tier 1 subscriber gets, day one.
One brand onboarded by our team, then everything below runs on its own. Nothing here is a roadmap item: it is what the dashboard does today.
A findings queue with real triage
Every look-alike lands in one queue, sorted by score. Filter by variant, severity, status or age; confirm, monitor, escalate or dismiss in place.
aurorabank-secure.exampleHigh87.0
aur0rabank.comMedium74.5
aurorabank.coMedium61.0
Evidence on every finding
Screenshot of the site, registrar, DNS and A record, first and last seen. Ready to attach, ready to argue.
DNS existsYes
RegistrarExample LLC
First seen3 days ago
ScreenshotCaptured
Ekos AI on every capture
Label, confidence and a written explanation. The rules keep the final score; the AI tells you why it agrees or not.
Phishing96%
Scans that never stop
Always-on monitoring, re-detection of known domains and an activity log of every change, so you can prove what happened and when.
- Re-detected in a later scan (seen 3× total)2m
- First detected by domain pipeline9d
- Ekos AI labeled phishing · 96%9d
Reports for your team
PDF reports of findings and takedowns for your SOC, legal team or auditors. Dashboard in English or Spanish.
Anatomy of a finding
Everything you need to decide, on one screen.
Finding · Aurora Bank
aurorabank-secure.example
87.0
Threat score
Screenshot
Ekos AI · Phishing96% confidence
Cloned login page detected: reproduces Aurora Bank's sign-in form and palette on a domain registered 3 days ago.
RegistrarExample LLC
A recordYes
First seen2026-07-21
- 1Threat score, from rulesDeterministic and auditable: brand in domain, recently registered, login form found. This is the authoritative signal.
- 2Severity, status and variantWhich engine matched it and where it sits in your triage.
- 3Site captureA screenshot of what your customers would see. The evidence the abuse desk asks for first.
- 4Ekos AI analysisLabel, confidence and the reasoning in plain language. An opinion you confirm, never a black box.
- 5OSINT enrichmentRegistrar, DNS and A record, first and last seen: the who, where and since when.
- 6Act without leaving the pageRequest the takedown, confirm, keep monitoring or dismiss. Every action lands in the activity log.
Plan
One plan. Everything Veylum does today.
One plan, one price, one brand. Join the waitlist and we will let you know as soon as access opens; our team then gets in touch to activate the account and onboard your brand.
Tier 1
Active protection with Ekos AI.
$500 USD per month · 1 brand · launch price
- Domain detection via NRD (newly registered domains)
- Domain detection via Certificate Transparency
- Auto-classification and advanced Ekos AI features
- One-click site takedown request with case tracking
- Evidence, OSINT enrichment, reports and activity log
- Support by email
Billed monthly in advance, cancel anytime effective at the end of the paid period.
Request accessWhat is live, what is next
Included today
Look-alike domains (NRD)
TLS certificates (CT logs)
Ekos AI classification
One-click takedown request
In development
Data leak detection
Social media scam monitoring
Anonymous sector benchmarking
Modules in development are not included in Tier 1. Their plan and price will be announced at launch.
FAQ
What people usually ask us
Anything else? Join the waitlist and ask our team directly during onboarding.
What does Veylum detect?
Domains that mimic your brand (typosquatting, homoglyphs, TLD variations and keyword combinations), newly registered domains that mention it and TLS certificates issued for look-alike names. Every finding comes with a screenshot, registration data and a verdict.
What can't Veylum detect?
Veylum finds impersonation through your brand's name: domains and certificates that use it, imitate it or combine it with other words. A site whose domain and certificate have nothing to do with your brand (for example, a phishing page hosted at an unrelated address or on a compromised website) leaves no trace in those sources, so it will not appear in your dashboard. Fake social media profiles and data leaks are not covered yet either.
When can I start using Veylum?
Veylum is not open yet. Leave your email on the waitlist and we will write to you as soon as access opens; our team then gets in touch to activate your account and onboard your brand.
What is Ekos AI?
Ekos Cyber Labs' AI engine: models fine-tuned for cybersecurity tasks working alongside deterministic rules. Rules score the risk; the AI analyzes the evidence and explains the verdict, with fewer false positives and traceable decisions.
How does the one-click takedown request work?
Veylum prepares the notice with the finding's evidence and addresses it to the registrar's or hosting provider's abuse contact. The decision to remove the site is the provider's, so Veylum cannot guarantee the takedown; you track the case from the dashboard until it is closed.
Who is behind Veylum?
Ekos Cyber Labs, a cybersecurity company. The team behind Ekos Cyber Labs brings over a decade of experience serving clients in Mexico, Latin America and the United States. Veylum is its first platform Powered by Ekos AI.
How do I get support?
Support is provided by email. You receive the support address during onboarding, and the same team that activates your account answers your questions from there.
Ready to protect your brand?
Join the waitlist and we will let you know as soon as Veylum opens. Onboarding takes one conversation; the first scan runs the same day your account is active.