While testing the detection engine against a live phishing feed, we attributed a set of active clone pages to well-known brands. Then we went back to preserve the evidence, and every single page was already gone — not taken down, moved.
That reframed the whole product. If clone infrastructure lives for hours, a monitoring service that emails you a report the next morning is describing something that no longer exists. It is not wrong. It is just too late to be worth anything.
So the thing we sell is the clock: evidence sealed before the page disappears, notices out to every authority in parallel within the hour, and verification that the URL is actually dead rather than that a ticket was acknowledged.