Overview

PhishEye is a web and API service for detecting phishing, typosquat and lookalike domains, brand abuse, and impersonation, with workflows for coordinating takedowns. It suits security, fraud, and brand teams that need monitoring alongside response tools, particularly organizations managing several brands or client workspaces. Its free tier is a one-time, single-brand scan; ongoing monitoring and takedown capacity require a paid plan, and third parties are not guaranteed to act on reports.

Key features

PhishEye combines domain, DNS, certificate, hosting, redirect, and live-page signals to identify active brand impersonation. That mix makes the service relevant to teams looking beyond domain-name matches alone. Monitoring spans domains, social, ads, search, and app stores; the service also offers dark web monitoring, credential leak alerts, impersonation monitoring, and takedown workflows.

Paid plans include automated takedowns through GoDaddy and Cloudflare abuse APIs. This can connect detection with a response process, but it does not ensure that a provider will accept a report or act by any particular time. Plans also include STIX 2.1 / TAXII 2.1 threat-feed export. Pro adds nine SIEM/SOAR connectors: Slack, Teams, Splunk, Sumo, Sentinel, Defender, ThreatConnect, Tines, and XSOAR, a stronger fit for teams routing alerts into established security workflows.

PhishEye says web and API connections use TLS 1.2 or higher, supported primary data stores are encrypted at rest, and administrative and production-facing accounts require MFA. Formal certifications such as SOC 2 Type II or ISO 27001 may be pursued as customer demand and company scale require. Support aims to keep the service available during UK business hours; Pro includes priority email support, while Business includes dedicated support and an SLA.

Pricing

The Free plan costs 0.00 USD per free. It covers one monitored brand, one single-run typosquat scan, and 30-day scan history, with no takedown cases or requests. That makes it useful for a limited initial check, not recurring protection or remediation.

Starter has custom pricing and includes one monitored brand, daily typosquat scans, 10 takedown cases, and 60-day scan history. It is the step up for a single-brand team that needs repeat scans and a modest response allowance.

Pro has custom pricing and covers three monitored brands, 50 takedown cases, 90-day scan history, up to five child workspaces, and up to five team members. Its connectors and priority email support make it the more suitable tier for small security teams and MSPs that need integrations or client separation.

Business has custom pricing, with 10 monitored brands, unlimited takedown cases, one-year scan history, up to 25 child workspaces, dedicated support, and an SLA. It is the clearest fit for larger operations with more client workspaces or sustained case volume. The stated 14-day trial does not specify which plan or features it covers.

Platforms

PhishEye is available through web and API access, serving both direct browser use and integration into other systems.

Who it's for

PhishEye is aimed at security, fraud, and brand teams handling impersonation risks across multiple channels. Starter can suit a single-brand operation with regular scanning; Pro and Business add monitored brands, takedown capacity, and child workspaces for MSP-style use. The free plan is too restricted for teams that need daily monitoring or takedown requests. The company is incorporated in England and Wales, with a registered office in London, and says it is built and run by founder Mohamed Hamed.

Pros and cons

Pros: Multiple detection signals and monitoring across domains, social, ads, search, and app stores give teams a broader impersonation-monitoring remit.
Pros: Paid takedown workflows, threat-feed export, and Pro's nine SIEM/SOAR connectors can link detection to response and existing security processes.
Pros: Child workspaces and higher brand and case allowances support MSP and multi-brand operations.
Cons: The free tier allows only one single-run scan for one brand and excludes takedowns, so it cannot serve as ongoing protection.
Cons: Starter, Pro, and Business have custom pricing, making cost comparisons difficult before engaging the company.
Cons: Third-party providers may decline or delay takedown reports, so the workflow cannot promise removal.
Cons: Pro and Business support commitments differ: priority email is reserved for Pro, while dedicated support and an SLA appear only on Business.

Alternatives

SOCRadar Extended Threat Intelligence Platform is worth comparing for buyers who want published monthly prices for its Advanced Dark Web Monitoring tiers: Essential is 600.00 USD per month, billed monthly, for one domain and one seat; Business is 1145.00 USD per month.

CTM360 is another freemium, web-based option to compare.

Constella Hunter+ is a paid web and API option with pricing available by demo request.

Flare offers a 0.00 USD per free, 14-day trial with no payment information required, though it requires an identity verification call and is scoped to your domain.

Allure Brand Protection may suit buyers seeking flat-rate pricing without per-incident fees or takedown limits; coverage varies by plan and organization needs.

Axur Platform, Bolster Automated Digital Risk Protection, and Doppel Digital Risk Protection are also web-based alternatives.

For broader comparisons, see Digital Risk Protection Software and Dark Web Monitoring Services.

Verdict

Choose PhishEye if your security, fraud, or brand team needs multi-channel impersonation monitoring tied to takedown workflows, threat feeds, and—on Pro—security-platform integrations. Its free plan is only an initial scan, and custom pricing makes paid-tier budgeting less direct. Look elsewhere if you need a substantial free monitoring tier, guaranteed third-party removals, or a clear published price before speaking with a vendor.

	CTM360	PhishEye
Free plan	Yes	Yes
Free trial	No	Yes
Paid from	$416.67/mo	Free
Open source	No	No
Platforms	api, Web	api, Web
Free plan	Yes	Yes
Dark web monitoring	—	Yes
Credential leak alerts	—	Yes
Impersonation monitoring	—	Yes
Takedown workflows	—	Yes
API access	—	Yes

CTM360 vs PhishEye

CTM360

PhishEye