Thicket watches for lookalike and phishing domains of your brand, seals tamper-proof evidence on every one, and sends takedown notices until the site is gone. $900 a year per brand, sub-brands included. A takedown credit is used only when the site comes down.
By Rubus Labs, an evidence-grade investigations firm working with law firms. CISSP-led.
The problem
Anyone can register a domain one letter off from yours, copy your storefront, and start taking your customers' money or passwords. Enterprise brand-protection tools exist, at enterprise prices. Thicket brings the same playbook to brands and firms that don't have an enterprise budget.
How it works
Every day, Thicket checks typo variants of your domain, other TLDs, and certificate transparency logs for new lookalikes.
Each suspect is screenshotted next to your real site and scored by AI. It only counts as a match if it uses your brand and carries harmful content.
Every case gets file hashes, an independent timestamp, timestamped screenshots, WHOIS records, and a PDF report.
AI suggests the right basis (abuse, trademark, or copyright). A person approves it, or you turn on auto-approval above a confidence level you choose. Notices go to the registrar, host, CDN, and blocklists (Netcraft, APWG, Google, Microsoft), with DMCA notices for copyright.
We check every 15 minutes. After 24 hours: second notices, the registry, and a prepared ICANN complaint. After another 24 hours: C&D, URS, or UDRP drafts for your attorney. Nothing legal is ever sent automatically.
You get an email for every action and a monthly report. Replies are verified, so an impersonator can't pretend to be you and call off the takedown.
For law firms
For brands
Pricing
No enterprise contract, no seat counts. One plan per brand, with its sub-brands included.
Law firms: one Thicket Annual plan per client brand. Your firm can pay, or you can arrange for the client to pay. Manage every client from one login.
per brand, sub-brands included
You're only charged a takedown credit when the site comes down after a real notice.
Start monitoring →FAQ
One brand, including its sub-brands (for example, a parent brand and its product lines). A separate, unrelated brand needs its own plan.
A credit is used only when a site comes down after we've sent a real notice. Sites that go offline on their own don't use one.
No. C&D, URS, and UDRP documents are drafted for an attorney and never sent automatically. Abuse notices are approved by a person unless you opt into auto-approval above a confidence threshold you set.
A suspect only becomes a match if it shows your brand and harmful content. A parked or unrelated lookalike domain isn't flagged as a match.
File hashes, an independent timestamp, timestamped screenshots of the suspect next to your real site, WHOIS records, and a PDF report for each case.
The registrar, host, and CDN, plus blocklists including Netcraft, APWG, Google, and Microsoft. Copyright cases get DMCA notices. If the site is still up after 24 hours, we escalate to the registry and prepare an ICANN complaint.
No. Replies are verified, so an impersonator can't halt the escalation.
Yes. Notices can be signed by the client's attorney, and one attorney account can manage multiple clients. Each client brand is one Thicket Annual plan ($900/yr, sub-brands included), paid by your firm or arranged for your client to pay.
Onboarding is 6 self-serve steps at dashboard.rubuslabs.com/onboarding.
They're built and priced for large enterprises. Thicket covers the same core job (find, prove, take down, escalate) at a flat annual price, with takedown credits used only on success.