How a third-party exploit gets caught in under 12 minutes.
Eight stages between a malicious script appearing on your site and a forensic alert landing in your inbox. Each stage is logged, timestamped, and reproducible.
Initiation
A headless Chromium worker leases your domain from our distributed scheduler every 300 seconds. Each scan uses a fresh browser context with cleared cookies, cache, and storage so we always observe what a brand new visitor would see.
Full Page Render
We execute every script on the page exactly the way a real customer's browser would — synchronous tags, async modules, deferred bundles, tag-manager-injected partners, lazy-loaded iframes, and service workers. Server-side cloaking cannot hide from a real renderer.
Network Interception
Every outbound request — XHR, fetch, WebSocket, image beacon, script src, font, stylesheet, iframe, and prefetch — is captured into a HAR-style ledger with method, headers, response size, MIME type, initiator stack, and timing.
Blocklist Cross-Check
Each unique third-party domain is normalized and matched in parallel against 500+ blocklist feeds: Spamhaus, URLhaus, OpenPhish, PhishTank, abuse.ch, MalwareBazaar, Feodo Tracker, ThreatFox, Maltrail, Quad9, and dozens of community and vendor sources, refreshed hourly.
Forensic Alert
If a hit is found, we dispatch an email within seconds containing the offending domain, the initiator script and line number, the full request/response, a screenshot of the rendered page, the HAR file, and a one-click reproduction URL.
Engineering details
Each scan worker is an isolated containerized Chromium instance with no shared state between executions. Workers are leased from a regional pool (US-East, EU-West, AP-Southeast) so we can detect geo-targeted payloads that fire only for specific visitor regions.
Network interception happens at the CDP (Chrome DevTools Protocol) layer, capturing every request before it leaves the sandbox: full URL, method, request headers, response headers, MIME type, byte size, initiator stack, and high-resolution timing. The result is a HAR file richer than what your DevTools tab would show.
Domain matching is performed against an in-memory bloom-filter index of 500+ deduplicated blocklists, with secondary exact-string verification on hits to eliminate false positives from incidental hash collisions. The full feed catalog is refreshed hourly and tracked with a content-addressable manifest you can audit.
Alerts are dispatched within seconds of detection, retried on failure, and mirrored to webhook endpoints (Slack, Teams, PagerDuty, Opsgenie, generic HTTP). Every alert carries a stable replay_url that re-runs the exact scan in a sandbox so your developers can validate the fix without waiting for the next 5-minute cycle.