Case studies · Prevention by deception

A legal services firm

Nearly five years of continuous protection with deception technology. Dozens of lookalike domains detected and flagged. Zero successful attacks.

Clients are anonymised.

Results

  • Zero successful attacks
  • Nearly five years of continuous protection with deception technology
  • Dozens of lookalike domains detected and flagged

At a glance

ClientA legal services firm
AdvisoryAmon Dîn advised and guided the client's cyber journey and helped them get 24/7 monitoring in place
FocusDeception technology, plus monthly brand-impersonation, dark-web and attack-surface monitoring
DurationNearly five years
ResultNo successful attacks

The outcome

In the nearly five years that deception technology has been in place through this engagement, the client has not suffered a single successful attack.

A recent monthly monitoring report shows how the engagement keeps watch beyond the network: dozens of lookalike domains imitating the client's domains (almost all domain-ending swaps), a handful with live websites or a mail server flagged for priority review, no threat-intelligence matches across monitored assets that month, and no dark-web exposures listed in the report.

Recommended next steps were to review lookalike domains with websites or mail servers and report or block them where justified, consider registering the most valuable domain variants defensively, and keep monitoring for changes.

The challenge

Like many small and medium-sized organisations, the client needed strong protection against cyber attacks without the budget or headcount of a large enterprise security team.

The firm also needed to know if anyone was setting up lookalike domains that could be used to impersonate it, for example in fake emails.

How Amon Dîn helped

Amon Dîn advised the firm on prevention by deception, guided their cyber journey, and helped them get 24/7 monitoring in place. Through this engagement, deception technology was deployed: decoys and traps inside the environment so that attackers who probe the network reveal themselves before they reach genuine systems and data.

The engagement also monitors the client's external footprint and reports monthly, covering internet-facing assets, subdomains and exposed services, plus lookalike domain checks. The deception platform has been operated and supported at the firm for nearly five years.