# Brand Risk Protection

URL: https://www.deepinfo.com/platform/brp/

## Find the Domains Built to Look Like You.

Brand Risk Protection matches new domains and subdomains against your brand keywords, including names spelled with letters from other alphabets that the eye cannot tell apart. Each lookalike your team confirms is then watched like an asset, so you see when it starts resolving, receiving mail or serving a certificate.

[Request demo](https://www.deepinfo.com/request-demo/) · [Datasheet (PDF)](https://www.deepinfo.com/downloads/deepinfo-brp-datasheet.pdf) · [Platform guide: BRP](https://docs.deepinfo.com/guide/brp/)

### A Convincing Phishing Page Needs a Convincing Address.

An impersonation campaign needs a domain before it needs a phishing kit or a mailing list. Registering one is cheap, and the name can look exactly like yours.

Registration

#### Any Name, on Almost Any TLD

Your brand plus “login”, your name with one letter doubled, your exact name on a new extension. Each one is a separate registration that anyone can make.

Rendering

#### Letters the Eye Can’t Separate

A Cyrillic “а” and a Latin “a” look the same in most fonts. In an email or a chat message, an internationalized name can read as yours while DNS resolves an `xn--` name underneath.

Preparation

#### Setup Leaves Traces

To host a login page a lookalike needs DNS records and usually a certificate. To send or receive mail it needs a mail exchanger, and each of those shows up in data the Deepinfo Platform already collects.

### One Watch From Lookalike to Takedown.

Fraudulent Domain Monitoring does the matching and the watching on domains. Social media, app store and search engine monitoring cover where customers meet your brand away from your domains, and Managed Takedown handles removal.

#### [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/)

Rules match new domains and subdomains against your brand keywords, from exact names to typos and confusable letters. Confirmed lookalikes are monitored for DNS, MX, SSL and HTTP activity, with a risk score kept as a timeline.

#### [Social Media Monitoring](https://www.deepinfo.com/platform/brp/social-media-monitoring/)

Accounts on social platforms that present themselves as your brand or as one of its official channels.

#### [App Store Monitoring](https://www.deepinfo.com/platform/brp/app-store-monitoring/)

Apps listed in app stores under your brand name that your organization did not publish.

#### [Search Engine Monitoring](https://www.deepinfo.com/platform/brp/search-engine-monitoring/)

Results on search engines that use your brand to send people somewhere you don’t control.

#### [Managed Takedown](https://www.deepinfo.com/platform/brp/managed-takedown/)

When your team confirms a lookalike is abusive, Deepinfo’s takedown team files the removal requests and follows each one to a close.

### Match Types That Catch What a Typo Filter Misses.

Each rule pairs a brand keyword with one match type. Below, one name and what four of the types would catch: the confusable types add the substitutions a typo filter never checks.

- **Same name** (`exact`): The name itself, on another TLD
- **Typo** (`fuzzy`): One edit away: a dropped, doubled, swapped or mistyped letter
- **Lookalike letters** (`confusable_exact`): Letters swapped for ones that look identical
- **Lookalike and typo** (`confusable_fuzzy`): A typo and a lookalike letter together

[Every match type, on Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/)

### From a Keyword to a Monitored Lookalike.

1. **Rule**

   Pick a brand keyword and a match type, then narrow the rule: domains or subdomains, extensions to include or exclude, words that discard a match.
2. **Match**

   The rule runs against new domains and subdomains as they enter Deepinfo’s index. With `include_past` on, it also checks names registered before the rule existed.
3. **Review**

   Matches arrive as suspicious domains, each with the rule that found it. Your team approves or ignores them one by one or in bulk, and can revert either decision. A rule you trust can approve its own matches.
4. **Monitor**

   An approved match becomes a fraudulent domain. The platform tracks whether it resolves, receives mail, serves a certificate or answers HTTP, and keeps its DNS, SSL, WHOIS, web data and port history.
5. **Act**

   File with the collected evidence yourself, or hand the case to Managed Takedown. A notification rule on `new_fraudulent_domain_detected` emails your team instantly or in an hourly to monthly digest.

### What Each Lookalike Carries With It.

A match is not a verdict. Each record keeps what your team needs to decide, and the history to support a takedown request or a dispute later. These records also come back from the BRP API, under the platform’s `apikey` header.

- **Name**: `fraudulent` and `fraudulent_unicode`: the name as registered, in `xn--` form for internationalized names, and the name as a browser displays it
- **Type**: `fraudulent_type`: domain or subdomain
- **Detections**: `detection_history`: the rules that matched the name, and when
- **State**: `state`: `in_review`, `approved` or `ignored`, with the date of each decision
- **Indicators**: `monitoring_indicator`: the flags `dns`, `dns_mx`, `ssl` and `http`, for whether the name resolves, receives mail, serves a certificate and answers on the web
- **Login page**: `is_login_page` and `screenshot`: whether the lookalike serves a login page, and a capture of the page itself
- **Risk score**: `risk_score`: the current score, plus a timeline of how it has moved
- **History**: DNS, SSL, WHOIS, web data and port scan history for each monitored lookalike

[BRP API reference](https://docs.deepinfo.com/reference/brp/fraudulent-rule-create/)

### Where Brand Risk Leads Next.

- [Brand Impersonation Protection](https://www.deepinfo.com/solutions/use-cases/brand-impersonation-protection/) (Use case): Lookalikes, impersonation and takedown run as one program.
- [An academic publisher](https://www.deepinfo.com/customers/academic-publisher/) (Customer story): Predatory-journal domains trading on a publisher’s name, found through Fraudulent Domain Monitoring.
- [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM): Continuous scanning, run on the assets you own.

### Query This Data Through the API

Lookalike matching runs over the domains the index sees each day. Data teams can take these domains as a feed and run their own matching. The index holds 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates.

- [Daily Registered Domains Feed](https://www.deepinfo.com/data-api/feeds/daily-registered-domain-names/)
- [Domain Search API](https://www.deepinfo.com/data-api/apis/domain-search/)
- [Same-Time Registered Domain Finder API](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/)

### Questions About Brand Risk Protection

**What is Brand Risk Protection?**

Brand Risk Protection is the detection and removal of infrastructure that impersonates your organization: lookalike domains, the pages and mail servers built on them, and impersonation on social platforms, app stores and search engines. It treats brand abuse as something to watch continuously, not something customers report to you after the fact.

**Which channels does BRP cover?**

Domains and subdomains, through Fraudulent Domain Monitoring, and impersonation on social platforms, app stores and search engines, where coverage is confirmed per engagement. Confirmed findings from each channel can go to [Managed Takedown](https://www.deepinfo.com/platform/brp/managed-takedown/).

**How is this different from a list of typo variants?**

A static list covers the names someone thought of in advance. BRP matches rules against domains as they appear, includes confusable characters, and keeps watching every confirmed lookalike, so your team sees when a parked name gets a mail exchanger, a certificate or a live web page.

**Is every match a phishing domain?**

No. Resellers, fan sites and names parked years ago match too, which is why matches wait for your team’s review and the monitoring indicators show which ones are being put to work.

**Will our own and our partners’ domains be flagged?**

Not if they are on the ignore list: domains you add to it in the BRP settings are never reported.

**What does the takedown workflow look like?**

Your team reviews a suspicious domain and approves it, which starts monitoring. When it turns abusive, you can file using the DNS, SSL, WHOIS and web evidence the platform has collected, or hand the case to Managed Takedown, where Deepinfo’s team files with the registrar or hosting provider and follows each request to a close.

**How is BRP priced?**

Pricing depends on the scope you monitor. See [pricing](https://www.deepinfo.com/pricing/) for how it works, or talk to us for a scoped quote.

### See Who’s Pretending to Be Your Brand.

Book a working demo with rules built on your brand names.

[Request demo](https://www.deepinfo.com/request-demo/)