Attackers do not need to breach your network to hurt your customers. A domain one letter off from yours, a cloned login page, a fake app in a regional store or a fake support account is enough to steal passwords and payments in your name. Executives face the same problem: fake profiles, spoofed messages asking finance teams for urgent transfers, and personal details traded on the dark web.
ACID covers both sides. ACID DIP (Digital Identity Protection) monitors your digital footprint — websites, DNS, domains and apps — for impersonation and tampering. ACID Intelligence monitors dark web, deep web and messaging sources for threats against your brand and key people.
What impersonation monitoring covers
Lookalike domains and phishing sites
DIP hunts for near-identical domains that differ from yours by as little as one character, swap top-level domains, or combine your brand with words like “login”, “support” or “secure”. That reduces the need to defensively register endless variants. DIP also searches for phishing sites that reuse your branding to harvest credentials, checking whether a site is live, whether it uses your branding and whether it asks for user details.
Website defacement and DNS hijacking
DIP checks that your own sites stay available and alerts immediately if they are taken down or defaced, or start linking to unauthorized destinations. It also checks DNS integrity so users are not silently redirected to a different IP address.
Imposter apps
DIP scans app stores, including regional catalogs that differ by market, for imposter, phishing or confusingly similar apps.
Fake accounts and channels
ACID watches for imposter support accounts, fake brand channels on messaging platforms and scam groups using your name. See Telegram and messaging monitoring.
Executive targeting
ACID Intelligence uses keywords for named executives and key personnel to detect leaked personal data, doxxing, fake profiles and planning chatter that mention them.
Why it matters
Impersonation attacks rely on trust in your brand. When they work, customers lose money, support teams handle the fallout, and your reputation takes the hit, even though your systems were never breached. Sophos named malicious email and phishing among the leading root causes of ransomware attacks in 2026, and many of those campaigns start with a lookalike domain.
Finding a phishing domain the day it goes live, rather than after the first customer complaint, is the difference between a takedown request and an incident.
How it works
- Monitor. DIP continuously checks domain registrations, DNS records, websites and app stores; ACID Intelligence watches dark web and messaging sources.
- Detect. Matching on your brands, domains, logos, product names and executives, with multi-language (UTF-8) keywords and regular expressions.
- Alert. Real-time alerts to designated contacts by email, through your SIEM/SOAR or via RESTful API.
- Mitigate. Block the domain, warn customers and staff, and request takedown through the registrar, host or app store using the evidence in the alert.
Example alerts
- High: lookalike domain live. A domain one character off from the client’s customer portal was registered yesterday and now hosts a copy of the login page.
- High: imposter app. A banking app using the client’s logo appears in a regional app store under a different developer name.
- High: fake support account. A messaging account named after the client’s support team is contacting customers and asking for one-time passcodes.
- Medium: executive data posted. A forum post shares the home address and personal phone number of the client’s CFO alongside a list of other executives.
Who needs it
Any organization whose customers log in, pay or download an app is a target, especially banks and financial services, e-commerce, retail, gambling and hotels.
Get started
Talk to an analyst about ACID DIP, or request a free dark web scan to see what is already circulating about your brand. For a full view of ACID’s coverage, see the dark web monitoring service.
“The earlier you see planning-stage activity, the more options you have—foil the attack, close the gap, or contain the blast radius before public disclosure.”