We’re shipping mesh-aware evil twin detection.
A fake access point wearing your network’s name is one of the hardest attacks to notice. Our second detector catches it — without crying wolf at your own mesh.
After ARP spoofing, we’re excited to announce the detector for the attack that lures you onto the attacker’s hardware in the first place: evil twin detection. It’s two-tier and mesh-aware — and it’s live now, on Windows, free.
The name on your screen is the one thing an attacker can copy perfectly. So we stopped trusting it.
The lure that starts a man-in-the-middle
An evil twin is a rogue access point broadcasting a network name you trust, often with a stronger signal so nearby devices prefer it. Once you land on it, the attacker is your gateway — free to read unencrypted traffic, run a man-in-the-middle, serve fake login pages, and tamper with DNS, all while your device shows a normal connection.
Two tiers: nearby, and the moment you land
The detector works on two layers. A rolling environmental scan enumerates every access point advertising your network’s name and flags any that sits outside your network’s legitimate vendor space — escalating when it out-signals your real router. And a connection-state monitor checks your current association against a saved baseline on three axes: BSSID, gateway MAC, and DNS resolver. A hard mismatch on the first two means you may now be on the fake AP.
It knows your eero from an impostor
The hard part isn’t spotting many radios under one name — a mesh does that on purpose. The hard part is telling your radios from a stranger’s. Detection recognizes legitimate mesh systems — eero, Orbi, Nest WiFi, Deco, AiMesh, Plume — by hardware prefix and manufacturer, so it only flags a radio that genuinely doesn’t belong. That’s the difference between a tool you keep on and one you switch off after the third false alarm.
De-duplicated with ARP
An evil twin and a gateway ARP spoof can be the same attack seen by two different detectors. Rather than alarm you twice, we correlate them into a single verified alert — the same full-screen, critical-severity event, deduplicated so you act once.
Detection is free
Mesh-aware evil-twin detection ships in the free version and always will. Knowing you’ve landed on a fake access point is exactly the kind of thing that shouldn’t be paywalled. (Breaking the attacker’s hold — the Active Defense response — is the part a subscription covers.)
Read more: how evil twins work · how to detect one yourself · the ARP detector before it