<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Brand Impersonation Detection

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js scan-domains <domain>` | Scan for registered lookalike domains |
| `node agent.js monitor-ct <domain>` | Generate CT log monitoring commands |
| `node agent.js check-tlds --brand <name> --tlds <list>` | Check brand across TLDs |
| `node agent.js generate-takedown --domain <d>` | Generate takedown template |

### Examples

```bash
# Full lookalike domain scan
node agent.js scan-domains company.com

# Monitor certificate transparency for brand
node agent.js monitor-ct company.com

# Check brand across common TLDs
node agent.js check-tlds --brand mycompany --tlds com,net,org,io,xyz,top

# Generate abuse takedown report
node agent.js generate-takedown --domain fake-company.com --evidence /tmp/evidence/
```

## External Services

| Service | URL | Purpose |
|---|---|---|
| crt.sh | `https://crt.sh/` | Certificate Transparency search |
| dnstwist | CLI tool | Lookalike domain generation |
| PhishTank | `https://phishtank.org/` | Phishing URL reporting |
| Google Safe Browsing | `https://safebrowsing.google.com/` | Report phishing pages |
| APWG | `reportphishing@apwg.org` | Anti-phishing reporting |

## Takedown Process

| Step | Action | Timeline |
|---|---|---|
| 1 | Identify registrar and hosting | Immediate |
| 2 | Submit abuse report | Within 1 hour |
| 3 | Report to Google Safe Browsing | Within 1 hour |
| 4 | Report to PhishTank/APWG | Within 2 hours |
| 5 | Follow up with registrar | 24-48 hours |
| 6 | Escalate to ICANN if needed | 72 hours |
