Brand Impersonation Protection
Catch Fake Brands Before Customers Do.
Brand impersonation is anything built to pass as you: a lookalike domain hosting your login page, an account posing as your support team, an app under your name, a search result that sends people somewhere else.
Brand Risk Protection watches for it, your team confirms what is abusive, and Managed Takedown files for removal.
acrne.example
“rn” reads as “m”
-
Match:
rule “acme” · fuzzy · found 2026-09-14
-
Resolution:
resolves
dns(on) -
Mail:
MX configured
dns_mx(on) -
Certificate:
serves SSL
ssl(on) -
Web:
answers, with page content
http(on) -
Risk score:
timeline
Then: Confirmed · to Managed Takedown
Impersonation Needs Very Little to Work.
Most of what an impersonator needs is cheap, fast to set up and easy to replace. What it borrows is your customers’ trust.
Domains
A Name One Letter Off
Registering a lookalike domain costs little. Letters from other alphabets can make it read exactly like yours in an address bar.
Accounts
A Logo and a Reply
A fake support account needs no infrastructure at all, only a customer who asks for help in public.
Timing
Your Calendar, Copied
Campaigns follow your calendar: launches, promotions, renewal and filing deadlines, whenever customers expect to hear from you.
-
acme.example
-
acme-login.example
Confirmed · to Managed Takedown
-
аcme.example
Suspicious · in review
-
acrne.example
-
AcmeSupport
-
acmesupport
acrne-support.example/sign-in
All Channels Lead to One Takedown Desk.
Fraudulent Domain Monitoring is the engine: rules, match types, evidence and monitoring. The other channels extend the watch to places customers meet your brand outside the domains you run.
Fraudulent Domain Monitoring
Rules pair a brand keyword with a match type, from exact to fuzzy, and each match type has a confusable form. Confirmed lookalikes are watched for DNS, mail, certificate and web activity, with a risk-score timeline.
Social Media Monitoring
Accounts on social platforms that present themselves as your brand, your support team or your executives.
App Store Monitoring
Apps listed in app stores under your brand name that your organization did not publish.
Search Engine Monitoring
Results on search engines that use your brand to send people somewhere you don’t control.
Managed Takedown
Deepinfo’s takedown team files the request with the party that can act, follows it up and checks the result.
Each Lookalike Keeps Its Own Record.
A takedown request is only as strong as its evidence. Each confirmed lookalike domain is monitored like an asset, and its history stays on record.
| Evidence | What it shows |
|---|---|
| Match | The rule and match type that found the name, and when |
| Resolution | Whether the name resolves in DNS |
| Whether a mail exchanger is configured, so replies to a phishing message can reach it | |
| Certificate | Whether it serves an SSL certificate |
| Web | Whether it answers on the web, with its page content and technologies |
| History | DNS, SSL, WHOIS, web data and port scan history for the name |
| Risk score | The current score and a timeline of how it has moved |
From Brand Keyword to Confirmed Removal.
-
01
Define
Write rules for your brand and product names, choose match types, and list your own domains so they are never reported.
-
02
Review
Matches arrive as suspicious domains with the rule that found them. Approve or ignore them in bulk, or let a trusted rule approve its own matches.
-
03
Watch
Approved names are monitored. A new fraudulent domain can trigger a notification the moment it is detected.
-
04
Remove
Confirmed abuse goes to Managed Takedown. The next scan shows whether the name still resolves, still takes mail or still answers on the web.
Use This Data in Your Tools
The domains the index sees each day are also a stream and a search API, for teams that run their own lookalike matching or enrich alerts in a SIEM.
Questions About Brand Impersonation Protection
What counts as brand impersonation?
Anything that presents itself as your organization without being yours: lookalike domains and the sites and mail servers built on them, accounts that pose as your brand or staff, apps published under your name, and search results that route people to someone else.
Where do the lookalike domains come from?
From Deepinfo’s own index, the one behind all the platform’s modules: 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates. Rules match names as they come into it.
What are confusable match types?
They catch names that use letters from other alphabets which look identical to Latin ones, such as a Cyrillic “а” in place of a Latin “a”. Each base match type (exact, contains, fuzzy and fuzzy contains) has a confusable version.
What is the difference between a suspicious and a fraudulent domain?
A suspicious domain is a candidate a rule matched, waiting for review. A fraudulent domain is one your team approved, or one a rule with auto-approval approved for you, and it stays under watch from then on.
Can a new rule check names registered before it existed?
Yes. Turn on include_ and the rule also runs against domains already in the index, so the first review covers what is out there today.
Can we file takedowns ourselves?
Yes. Every lookalike record carries the evidence a registrar or host asks for, and your team can file directly. Managed Takedown is for teams that would rather hand the filing and the follow-up to Deepinfo.
Which social platforms and app stores are covered?
Coverage for social platforms, app stores and search engines is scoped with each customer. Tell us which channels matter to your brand and we’ll walk through them in a demo.
See Who Is Using Your Name.
Book a demo and we’ll run brand rules against your names with your team.