Company and basics
What is IntelFinder?
IntelFinder is a digital risk protection platform that monitors the internet for threats to a company's brands, employee accounts, suppliers and AI tools. It combines brand protection, infostealer log monitoring, supply chain intelligence and agentic AI intelligence in one subscription. IntelFinder is built by Inteller Ltd, an Israeli company founded in 2015, and sells directly and through MSSP partners.
Who is IntelFinder for?
IntelFinder is designed for small and mid-size enterprises that usually cannot afford external threat intelligence, and for MSSPs that resell protection to them. Larger organizations use it to cover more external exposure for less budget. Typical customers have 100 employees or more and do not need a dedicated threat intelligence team.
How is IntelFinder different from a threat intelligence feed?
A threat intelligence feed lists indicators about the world in general; IntelFinder reports only findings tied to your named brands, domains, accounts and suppliers. Every alert carries the source, the observed content and the connection to your monitored asset, so a non-specialist can act on it. All of IntelFinder's alerts are customer-specific and actionable.
Is IntelFinder fully automated, or are analysts involved?
IntelFinder's collection, matching and prioritization are fully automated, and takedowns run through an agentic AI operations center called the Fraud Defense Center. A built-in Virtual Analyst reviews each alert with AI and flags false positives before you see them. No human analysts sit between the data and your dashboard, which is what keeps the price low.
Where is IntelFinder based and where is data stored?
IntelFinder is headquartered in Israel and its platform and infrastructure run in data centers in Europe and on the US East Coast. Customer data is stored in Europe and North America, and the company is GDPR-ready.
How long does setup take?
A new IntelFinder account produces its first findings within hours of adding your domains, brand names and email domains. Setup is a web form or a single API call per asset; there is no agent to install and nothing to deploy inside your network.
Does IntelFinder offer a free trial or a demo?
IntelFinder offers a 14-day free trial at intelfinder.io/contact. Partners can provision trial accounts for their own customers through the partner API.
Pricing and packaging
How much does IntelFinder cost?
IntelFinder costs $3,600 per brand per year on an annual subscription, which includes brand protection, infostealer log monitoring, supply chain intelligence and agentic AI monitoring. There are no per-alert, per-user or per-seat charges. Takedowns through the Fraud Defense Center are priced separately at $100 per takedown. These are list prices; volume discounts are available.
What counts as a "brand" or a "license" in IntelFinder pricing?
One IntelFinder license covers one organization's brand names, its domains, its email domains and its social handles. A company with two subsidiaries trading under different names needs two licenses; a company with one brand and twenty domains needs one. For pricing purposes, a brand is any company, subsidiary or division with its own name or logo. Product brands, name variations and regional brands (for example HSBC US and HSBC UK) are not counted as separate brands.
How does IntelFinder pricing compare with ZeroFox, Netcraft or Recorded Future?
IntelFinder is priced at a fraction of what other services on the market charge: a typical subscription is $3,600 per brand per year, while enterprise digital risk protection suites commonly start in the tens of thousands of dollars per year and often exceed $100,000. The difference comes from full automation and no analyst services bundled into the price. Customers who need a managed service add it through an IntelFinder MSSP partner.
Do I pay for takedowns separately?
Phishing site, impersonating website and email scam domain takedowns run through IntelFinder's Fraud Defense Center at $100 per case. The cost per takedown falls as more credits are bought in a single purchase, down to $40 per takedown.
Can I pay monthly, and by credit card?
IntelFinder accepts credit card payment online and invoicing for annual and monthly contracts. Partners are invoiced monthly for all their customer licenses in one statement.
Is there a discount for MSSPs or multiple brands?
IntelFinder partner pricing is lower than list price so MSSPs can resell with margin; the exact rate depends on committed volume and is agreed at onboarding. Multi-brand customers pay per brand.
What happens when my subscription ends?
Monitoring stops at the end of the paid period and the account keeps read access to its historical alerts for 14 days. Data can be exported through the REST API or CSV before then. There is no cancellation fee.
Brand protection, lookalike domains and phishing
How does IntelFinder detect lookalike domains?
IntelFinder checks newly registered and updated domains against your brand names on an ongoing basis. A match becomes an alert with the registration date, registrar, DNS records, screenshot and the risk indicators found on the site. Coverage is comparable to that of the major competing vendors.
Can IntelFinder tell whether a lookalike domain is actually malicious?
IntelFinder scores each lookalike domain on live indicators: MX records set up to send mail, a website that copies your content, a valid certificate, tracking IDs shared with other malicious sites and reputation hits. Parked or defensively registered domains are reported at low priority so your team can focus on domains being weaponized.
Does IntelFinder monitor for domain hijacking and expiring domains?
Yes. IntelFinder watches your own domains for registrar, nameserver and DNS changes that indicate hijacking, and warns before domains and certificates expire. It also checks SPF, DKIM and DMARC configuration and reports gaps that let attackers spoof your email.
Does IntelFinder find exposed subdomains and misconfigured services?
IntelFinder discovers subdomains of your monitored domains from a variety of sources and reports those that expose development, staging or admin interfaces. It also flags exposed CMS admin panels and other services that were not meant to be public. This is attack-surface discovery, not vulnerability scanning: IntelFinder does not probe or exploit hosts.
Does IntelFinder monitor code repositories and documents for leaks?
Yes. IntelFinder searches GitHub, Gists and public document repositories for keywords taken from your source code to identify cases where that code has leaked. Leaked internal documents are reported as well. Each alert includes the file, the matched content and whether the exposure appears intentional.
Does IntelFinder monitor rogue mobile apps?
IntelFinder monitors Google Play, Apple's App Store and dozens of third-party Android app stores for apps that use your brand name without authorization. Alerts include the store listing, developer and download link, and a takedown letter template is provided for the store's abuse process.
Does IntelFinder cover trademarks and counterfeit marketplaces?
IntelFinder monitors trademark filings in more than 120 countries that copy your mark and reports marketplace and website misuse of your brand. It does not run a counterfeit test-purchase or marketplace enforcement program; for high-volume counterfeit enforcement, pair IntelFinder with an IP-enforcement vendor.
Infostealer logs and leaked credentials
What is an infostealer log and why does it matter?
An infostealer log is the data package that malware such as Lumma, RedLine or Vidar steals from an infected computer: saved browser passwords, session cookies, autofill data and system details. Criminals sell these logs in bulk, and a single log with a valid corporate session cookie bypasses passwords and MFA. IntelFinder matches these logs to your organization so you can reset the affected accounts before they are used.
How does IntelFinder find leaked employee credentials?
IntelFinder maintains its own repository of more than 1.5 billion infostealer and breach records and matches new records against your email domains, login URLs and employee identities daily. Alerts show the masked account, the source, the date observed and whether a session cookie or only a password was exposed.
Does IntelFinder show the actual leaked password?
IntelFinder shows the actual leaked password for the customer's own employees. If the monitored organization is a supplier, the credential is masked, with enough context to confirm which account and service are affected. Full values are available to the supplier's representative on request.
Does IntelFinder detect customer credentials, not just employee ones?
Not at the moment. IntelFinder currently reports exposed employee credentials only.
How fast does IntelFinder report a new credential leak?
IntelFinder ingests new infostealer logs continuously and reports matches within 24 hours of the log reaching the repository.
Will IntelFinder reset passwords or clean the infected device?
No. IntelFinder reports the exposure and the evidence; your IT team resets the credential, revokes sessions and investigates the device in your own systems. Findings can be pushed to Jira, Slack, Splunk or a SOAR via webhook so the reset becomes a ticket automatically.
Social media impersonation and takedowns
Which social networks does IntelFinder monitor for impersonation?
IntelFinder searches Facebook, Instagram, X, YouTube, Bluesky, LinkedIn, TikTok and Telegram for profiles and pages that use your brand name, logo or executive names. Each alert shows the profile, the match reason and the linked accounts and link-in-bio destinations so your team can judge whether it is impersonation or a legitimate mention.
Does IntelFinder monitor executives for impersonation?
No. IntelFinder currently monitors impersonation of the company's brands only.
How does IntelFinder take down a phishing site?
IntelFinder's Fraud Defense Center gathers the evidence (screenshot, page content, hosting, registrar, abuse contacts) and files the abuse report with the host, registrar and blocklists automatically, then re-checks the site until it is offline. Cases that need a human response from a provider are followed up automatically.
What can the Fraud Defense Center take down?
The Fraud Defense Center handles phishing sites, websites impersonating your brand, domains used for email scams such as BEC, and rogue mobile applications. Social media profiles and leaked documents come with a ready-made takedown letter for your team to file through the platform's own abuse process. IntelFinder does not pursue court orders or UDRP filings.
Does IntelFinder guarantee a takedown?
No vendor can guarantee removal, because the host or registrar decides. IntelFinder's pricing is per case, not per hour, so a slow case does not cost more. The success rate depends heavily on the threat type (over 95% for phishing sites), the hosting provider, the domain registrar and other factors.
Does IntelFinder monitor the dark web and Telegram?
IntelFinder monitors Telegram channels and groups where infostealer logs, phishing kits and brand data are traded. IntelFinder does not provide a traditional dark web monitoring service.
Supply chain and agentic AI monitoring
Can IntelFinder monitor my suppliers?
Yes. IntelFinder lets you monitor suppliers with the same coverage as your own brands, including domain impersonation, credential exposure, leaked documents and claimed breaches affecting them, in the same view as your own findings. This gives supplier-risk reviews external evidence to go with questionnaires. Each supplier counts as a separate brand. Volume discounts apply; for example, 50 brands (customer plus suppliers) cost $75,000 per year.
What is "agentic AI intelligence" in IntelFinder?
Agentic AI intelligence is IntelFinder's monitoring of the MCP servers, packages and tools that your AI agents depend on. It matches your declared components against malicious-package reports and software advisories, snapshots public MCP endpoints and flags changes in tool descriptions, schemas and declared capabilities, and highlights suspicious instruction patterns. IntelFinder launched this capability in 2026 as part of the standard subscription.
Does IntelFinder detect malicious packages on npm, PyPI and GitHub?
Yes. IntelFinder monitors GitHub advisories, PyPI and npm malicious-package reports, Exploit-DB and the CISA Known Exploited Vulnerabilities list, and alerts when a package or product you have registered is affected. It also tracks publisher and release-hook changes on packages you depend on, which is how supply chain compromises such as the 2026 LiteLLM incident surface.
Does IntelFinder monitor container images and CI pipelines?
IntelFinder checks the provenance of container images you register against known-bad digests and publisher changes, and reports when an image's source or signer changes. It does not scan image contents for vulnerabilities; use a container scanner for that and IntelFinder for the external signal.
Integrations, API and Virtual Analyst
What integrations does IntelFinder have?
IntelFinder has native integrations with Jira, Slack, Splunk, ThreatConnect, ThreatQ, OpenCTI, Zapier and generic webhooks, plus a REST API and an MCP server. Alerts can be pushed as tickets, messages or indicators the moment they are created.
Does IntelFinder have an API and an MCP server?
Yes. The IntelFinder REST API covers accounts, monitored assets, subscriptions, alerts and takedown requests, and is documented inside the platform. The MCP server exposes the same capabilities to Claude, ChatGPT and other MCP-capable assistants so an analyst can ask "what new phishing sites target us this week" in their AI client. Both use the same API key and respect the account's permissions.
What is the IntelFinder Virtual Analyst?
The Virtual Analyst is an AI reviewer built into IntelFinder that reads every new alert, decides whether it is a true positive, and writes a short analyst note explaining why. It cuts false positives sharply and takes the full alert content into account. It is included at no extra cost and can be switched off per alert type.
Can I export alerts and reports?
Yes. IntelFinder generates PDF and CSV reports per account and per period, and every alert is retrievable through the API with its evidence attached. MSSPs can produce branded reports for each customer from the partner portal.
MSSP and partners
Does IntelFinder have an MSSP partner program?
Yes. IntelFinder MSSP partners get a white-label portal, separate customer environments, a partner API to create and manage customer accounts, and partner pricing below list so the service can be resold with margin. The partner owns the customer relationship; IntelFinder provides the platform and the automated takedowns. There is no minimum commitment.
Can MSSPs white-label IntelFinder?
Yes. The partner portal, alert emails and reports carry the partner's name and logo, and customers log in through the partner's own domain. IntelFinder is not named to the end customer unless the partner chooses to.
Can I embed IntelFinder in my own product?
Yes. Technology partners use the REST API and MCP access to surface IntelFinder findings inside their own product, with coverage and findings tied to each of their customers rather than a generic feed. Partner pricing is per customer license and agreed at onboarding.
Choosing and comparing vendors
What is the best digital risk protection tool for a small or mid-size enterprise?
For a company without a threat intelligence team, the practical choice is a fully automated platform that reports only findings tied to its own brands and accounts and prices per brand rather than per engagement. IntelFinder fits that profile; ZeroFox, Recorded Future and Netcraft are built for enterprises with analysts to consume a wider feed and are priced accordingly. Shortlist on three things: does it match findings to your assets, does it include takedowns, and can you afford it for every brand you own.
How does IntelFinder compare with ZeroFox, Netcraft, Bolster, CloudSEK and Flare?
IntelFinder covers the same core as these vendors (lookalike domains, phishing takedown, social impersonation, infostealer credentials) at mid-market pricing, and adds supplier and agentic AI monitoring that most of them do not offer. ZeroFox and Netcraft bring larger analyst and takedown operations for enterprise programs. Bolster focuses on takedown speed, CloudSEK on attack-surface breadth, Flare on dark web and infostealer depth.