HOW IT WORKS · the product in one minute

1. Dashboard — the mission line and the five-step strip

   “BrandWatch finds sites impersonating a brand — on the web and in Facebook / Instagram ads — proves it with tamper-proof evidence, maps the attacker's servers and drafts the takedown. A human decides every step.”

   Likely question: what's real here? → In demo mode every external service is a recorded scenario; the same code calls VirusTotal, crt.sh, Google and Chromium in live mode.

2. The brand page — tick “include fingerprinting”, press START SCAN

   “First it learns what the real site looks like, then it hunts for copies on five streams.”

   Likely question: how do you find domains that don't exist in any list yet? → Permutations checked in DNS, new certificates in CT logs, yesterday's registrations.

   Likely question: what about ChatGPT and Gemini? → With AI answers on, the approved questions (support phone, contact, login, fraud) are asked to ChatGPT, Gemini and Google AI Mode; every contact in the answers is compared with the ones on the brand's own website, a mismatch gets a "show me the official page" follow-up, and BrandWatch opens the cited pages itself before it raises a finding.

   Likely question: what about social media? → Facebook pages by name (Meta's page search, every country) and Instagram / Facebook profiles Google knows; each one's page history, logo, links and posts are checked and an AI reads the content. Fakes become findings with a Report-to-Meta box, a link in their bio goes to the website checks, and the brand's own accounts are never flagged. Ads about the brand are searched too, per country.

3. The live scan console — then “▶ replay highlights”

   “Every step is narrated as it happens; the report at the bottom says what the scan did in plain words.”

   Likely question: what if VirusTotal is down? → Retries with backoff, a circuit breaker, then the next provider in the chain; the alert panel says what happened and how to fix it.

4. A cloaked kit — read the two-sentence summary, then the three screenshots

   “This kit shows a blank page to scanners and the login page to real visitors. We fetch it like a victim would.”

   Likely question: why is VirusTotal at 0? → It's days old; blocklists lag. Unknown is never treated as clean.

5. Explain Finding — signals, group caps, the score line, “open the arithmetic”

   “Deterministic, explainable scoring: every point traces back to evidence. Risk and confidence are separate axes. The AI is advisory.”

   Likely question: false positives? → Penalties (old domain, redirects to the brand), a whitelist, and a golden-dataset regression gate (precision / recall ≥ 0.90).

6. Press Confirm phishing, then Investigate site & network

   “Confirming maps the attacker's infrastructure automatically. The investigation tabs on the finding page replace twenty minutes of VirusTotal, urlscan and RDAP tabs.”

7. The attack infrastructure map — drag the graph, read two triage reasons

   “One site led to the whole operation. Noise is triaged out with a reason; the indicators go to a SIEM as STIX.”

8. The takedown → Activity

   “Three channels — registrar, host, CDN — plus the blocklists. Every step is in an append-only audit log the database won't let anyone edit.”

Trust & safety

• A human decides every verdict and every takedown; nothing is ever sent automatically.
• Residential IPs are used to look like a victim, never to interact; probes never submit forms.
• The AI only gives advisory opinions under a strict JSON schema, with the page text framed as untrusted.
• Only brands you are authorised to protect; every action is in the append-only audit log.

Baseline

The fingerprint of the brand's real site — favicon hash, screenshot hash, colours, login pages, keywords. Every suspect is compared against it.

Candidate / watched domain

Any domain discovered for a brand. It lives on the Watchlist until it scores high enough to become a finding, expires, or is dismissed.

Finding

A candidate that scored Medium or higher. An analyst confirms it as phishing or dismisses it; nothing happens automatically.

Signal

One piece of evidence (e.g. 'identical favicon'). 50 signals in 7 groups; each adds points.

Group cap

Each group can add at most its cap, so ten weak visual hints never outweigh one strong behaviour signal.

Risk score

How dangerous the site is, 0–100. Medium ≥ 25, High ≥ 50, Critical ≥ 75. Combination rules can raise the severity.

Confidence

How complete and consistent the evidence is (breadth, completeness, provider agreement) — separate from risk.

Cloaking

A kit that shows a harmless decoy to scanners and the phishing page to victims. BrandWatch fetches as a bot, as a victim link, from a search referer and from a home IP.

Detection track

Light, Standard or Deep: which discovery streams run, how many sites are visited, how often the watchlist is re-checked.

Attack infrastructure

The map built from one confirmed site: every server, certificate and sister domain it shares, triaged so reverse-IP noise is excluded. The pivot is budgeted (at most 2 hops, 100 nodes, a fixed number of API calls) and those limits are frozen in code.

Advisory opinions

An AI model and a trained classifier each give a second opinion on Medium+ findings. The page text is passed as untrusted input and the answer must match a strict JSON schema. Shown for context only: the deterministic score never depends on them.

IOC

Indicator of compromise: a domain, IP, certificate hash or tracking ID a firewall / SIEM can block. Exported as CSV, JSON or STIX 2.1.

Takedown

The request to remove a site. Draft → review → approved → sent → taken down; sent to the registrar, the hosting provider and the CDN, and reported to blocklists.

Evidence

Every screenshot, HTML page, DNS / WHOIS answer and reputation lookup, stored append-only with its SHA-256 — the database rejects edits and deletes.

Discovery stream

One way of finding look-alikes: look-alike names (dnstwist), new certificates (CT), newly registered domains (NRD), Google search, the urlscan.io archive, social media, ads. A track decides which streams run.

dnstwist

Generates the names a phisher would register — typos, swapped letters, other TLDs, look-alike Unicode — and checks in DNS which of them exist.

Certificate transparency (CT)

Every HTTPS certificate is published in public logs within minutes; a new certificate carrying the brand's name is often the first sign of a kit.

Newly registered domains (NRD)

Yesterday's list of every newly registered domain (about 70,000 a day), searched for the brand's name.

urlscan.io

A public archive of scanned web pages: past scans that mention the brand, and a screenshot of a site that blocks BrandWatch.

Home / mobile IP probe

A visit through a home (residential) or 4G/5G address, for kits that show the real page only to people, never to a datacentre. Needs a proxy and a GB budget.

STIX 2.1

The standard file format security tools exchange threat indicators in; the infrastructure map's indicators can be exported as STIX for a SIEM or a firewall.

Golden dataset

Recorded, hand-labelled scenarios (phishing, cloaked kits, scam shops, legitimate sites) the real pipeline is run on in every build; precision and recall are measured on them.

TLD set

Which top-level domains dnstwist tries: common (.com .net …), popular (about 100) or all (about 1,280).

Vertical

The kind of business ("footwear and apparel", "crypto exchange") — read by the AI from the official site, used to pick the right Google queries.

Who sells it

Only the brand (a service, an app, a bank) or other shops too: then scam shops advertising its products are hunted as well.

Demo mode

Recorded scenarios replace every external service: the full pipeline runs deterministically, offline, at $0.