<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-brand-impersonation-detection
description: >-
  Detect brand impersonation in phishing attacks through visual similarity
  analysis, lookalike domain monitoring, logo detection, certificate
  transparency log monitoring, and social media impersonation detection.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - brand-impersonation
  - lookalike-domains
  - visual-similarity
  - certificate-transparency
  - brand-protection
  - domain-monitoring
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1583.001"]
---

# Performing Brand Impersonation Detection

## Overview

Brand impersonation is a core phishing technique where attackers create convincing
replicas of legitimate organizations. This skill covers monitoring for lookalike
domains, certificate transparency log surveillance, visual similarity scoring of
phishing pages, logo abuse detection, and social media impersonation identification.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `dnstwist` | `pip install dnstwist` |
| `requests` | `pip install requests` |
| `ssdeep` | `pip install ssdeep` (fuzzy hashing) |
| Certificate Transparency API | crt.sh access |

## Key Concepts

### Impersonation Vectors

```
Brand Impersonation Channels:
├── Domain Impersonation
│   ├── Homograph attacks (IDN: mïcrosoft.com)
│   ├── Typosquatting (microsft.com, micosoft.com)
│   ├── Combosquatting (microsoft-login.com)
│   └── TLD squatting (microsoft.xyz)
├── Visual Impersonation
│   ├── Cloned login pages
│   ├── Stolen logos and brand assets
│   ├── Pixel-perfect replicas via reverse proxy
│   └── Fake mobile app interfaces
├── Certificate Abuse
│   ├── Free TLS certs for lookalike domains
│   ├── Brand name in certificate Subject/SAN
│   └── Wildcard certs for phishing subdomains
└── Social Media
    ├── Fake support accounts
    ├── Brand name in username variations
    └── Cloned profile images and bios
```

### Detection Coverage Matrix

| Vector | Detection Method | Automation |
|---|---|---|
| Lookalike domains | `dnstwist` weekly scans | High |
| New certificates | CT log monitoring (crt.sh) | High |
| Visual clones | Page similarity scoring | Medium |
| Logo abuse | Reverse image search | Medium |
| Social accounts | Username enumeration | Low |

## Workflow

### 1. Lookalike Domain Scanning

```bash
# Generate and check domain permutations
dnstwist --registered --format json company.com > /tmp/lookalikes.json

# Automated scan with agent
node agent.js scan-domains company.com

# Monitor specific brand terms across TLDs
node agent.js check-tlds --brand company --tlds com,net,org,io,xyz,top
```

### 2. Certificate Transparency Monitoring

```bash
# Query crt.sh for certificates containing brand name
curl -s "https://crt.sh/?q=%25company%25&output=json" | python3 -m json.tool

# Automated CT monitoring
node agent.js monitor-ct company.com

# Check for certificates issued to lookalike domains
node agent.js check-certs --domain company --days 30
```

### 3. Visual Similarity Analysis

```bash
# Compare a suspected phishing page against known brand login
node agent.js compare-pages \
  --legitimate https://login.company.com \
  --suspicious /tmp/phish_page.html

# Fuzzy hash comparison of page content
ssdeep -b /tmp/legitimate.html /tmp/phishing.html
```

### 4. Takedown Workflow

```bash
# Generate abuse report for domain registrar
node agent.js generate-takedown --domain fake-company.com --evidence /tmp/evidence/

# Identify registrar and hosting provider
whois fake-company.com | grep -iE 'registrar|abuse'
dig A fake-company.com
whois $(dig +short A fake-company.com)
```

## Detection

```yaml
title: Brand Impersonation Detection Detection
id: f3151a79-336f-45e0-88fb-f93b91b13251
status: experimental
description: Detects suspicious activity related to performing brand impersonation detection techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1583.001
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Lookalike domains scanned | `dnstwist` weekly output reviewed |
| CT logs monitored | crt.sh queries running for brand terms |
| New registrations alerted | Newly registered lookalikes flagged |
| Visual comparison done | Similarity score for suspected pages |
| Takedown initiated | Abuse report sent to registrar/hosting |

## References

- [dnstwist Documentation](https://github.com/elceef/dnstwist)
- [Certificate Transparency — crt.sh](https://crt.sh/)
- [ICANN UDRP — Domain Dispute](https://www.icann.org/resources/pages/help/dndr/udrp-en)
- [APWG Phishing Report](https://apwg.org/)
- [Google Safe Browsing](https://safebrowsing.google.com/)
