Documentation
How to use OpenBait, from setting up your report page to alerts and excluding false positives.
OpenBait is a phishing report desk that runs under your brand's name. You put one link where you used to put a phishing@ address. When a customer pastes a URL there, they get an answer within seconds. Anything confirmed as phishing goes to browser blocklists and threat-intelligence lists, and on paid plans we also file takedowns with hosting providers and registrars. Every step is recorded as a case.
To set it up, create your report page and put the link where customers will see it. No DNS changes, no script on your site.
After a report comes in
| Stage | What happens |
|---|---|
| Intake | A customer pastes a URL into your report page. They don't need an account |
| Verdict | We fetch and analyze the page and answer on the spot. If it's your real site, we tell them right away |
| Confirmation | Anything that looks like phishing shows up in your console as a case |
| Reporting | We send submissions to browser blocklists automatically. On paid plans (or as a single $199 takedown on the Free plan), we also file takedown reports with hosting providers and registrars, but only after you confirm the site |
| Record | The case keeps what was sent, to whom and when, and when the site stopped responding |
The full flow is in From report to takedown.
Other things the product does
- Lookalike domain monitoring finds domains that may be posing as you, using CT logs, newly registered domain lists, DNS lookalike variants, and search. You can try part of it now with the free lookalike domain checker.
- Canary tokens are decoy assets. You get an alert the moment a copied page loads one.
Support
- Email: contact@openbait.com