# Phishing Detection and Prevention URL: https://www.deepinfo.com/solutions/use-cases/phishing-detection-and-prevention/ ## Catch Phishing Infrastructure at the Registration Stage. A phishing campaign needs an address before it needs anything else, and every step of setting one up leaves a trace in data the Deepinfo Platform already collects. [Brand Risk Protection](https://www.deepinfo.com/platform/brp/) matches new names against your brand and watches each match until it is ready to send. [Request demo](https://www.deepinfo.com/request-demo/) ### A Phishing Domain Announces Itself Early. By the time a customer reports a phishing page, the campaign has already run. The stages before it are quieter but visible: a name that matches your brand, then a DNS record, a mail exchanger, a certificate. Detection that starts at registration leaves your team time to act. - **Registered**: Matched by one of your rules against a brand keyword - **Resolves**: `dns`: the name answers in DNS - **Takes mail**: `dns_mx`: a mail exchanger is configured - **Has a certificate**: `ssl`: it serves an SSL certificate - **Goes live**: `http`: it answers on the web ### The Ways a Name Can Pass for Yours. Each rule pairs a brand keyword with one match type. Below, one name and a domain each type would catch: the confusable types add the substitutions a typo list never checks. - **Same name** (`exact`): The name itself, on another TLD - **Name inside** (`contains`): The name inside a longer label - **Typo** (`fuzzy`): One edit away: a dropped, doubled, swapped or mistyped letter - **Typo inside** (`fuzzy_contains`): A typo inside a longer label - **Lookalike letters** (`confusable_exact`): Letters swapped for ones that look identical - **Lookalike letters inside** (`confusable_contains`): Lookalike letters inside a longer label - **Lookalike and typo** (`confusable_fuzzy`): A typo and a lookalike letter together - **Lookalike and typo inside** (`confusable_fuzzy_contains`): Both, inside a longer label ### Follow One Lookalike From Start to Finish. 1. **Rule** Pick brand keywords and match types in [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/), then narrow each rule: domains or subdomains, extensions, words that discard a match. 2. **Triage** Suspicious domains arrive with the rule that matched them. Your team approves or ignores them in bulk, by filter. 3. **Watch** Approved names are monitored for DNS, mail, certificate and web activity, and their risk score is kept as a timeline. 4. **Investigate** Pivot through [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/) to the campaign’s other domains: same IP, same name servers, or the same registrant within minutes. 5. **Act** File with the evidence yourself or hand the case to [Managed Takedown](https://www.deepinfo.com/platform/brp/managed-takedown/), then confirm the result on the next scan. ### Script the Rules and the Review. Rules, suspicious domains, review actions and monitored lookalikes, with their history and risk-score timelines, are available through the BRP API. Review actions take a search filter, so one request can approve every match from a rule your team trusts. [Suspicious Domain Approve reference](https://docs.deepinfo.com/reference/brp/suspicious-domain-approve/) Approve by filter ```bash curl -X POST \ "https://api.deepinfo.com/v1/brp/suspicious-domains/search:approve" \ -H "apikey: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d @filter.json ``` ### Registration-Stage Detection in the Field. - [A leading research university](https://www.deepinfo.com/customers/research-university/) (Customer story): Phishing portals around application and donor cycles, caught and routed to Managed Takedown. - [A regional municipality](https://www.deepinfo.com/customers/municipal-government/) (Customer story): Lookalike domains registered around tax filing and permit renewal, caught and removed. - [Brand Impersonation Protection](https://www.deepinfo.com/solutions/use-cases/brand-impersonation-protection/) (Use case): This watch, extended to accounts, apps and search results. ### Use This Data in Your Tools The domains the index sees each day are also a daily file and a search API, for teams that run their own lookalike matching or enrich alerts in a SIEM. - [Daily Registered Domains Feed](https://www.deepinfo.com/data-api/feeds/daily-registered-domain-names/) - [Domain Search API](https://www.deepinfo.com/data-api/apis/domain-search/) - [Screenshot API](https://www.deepinfo.com/data-api/apis/screenshot-lookup/) - [Same-Time Registered Domain Finder API](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/) ### Questions About Phishing Detection and Prevention **How is this different from email filtering?** Email filtering inspects messages as they arrive. This workflow looks at the infrastructure behind them: the lookalike domain, its mail server and its certificate, often before the first message is sent. The two work at different stages and complement each other. **Where do the domains come from?** From Deepinfo’s own index: 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates. Rules match names as they come into it. **Does it only catch typos?** No. Besides exact, contains, fuzzy and fuzzy contains matches, each type has a confusable variant that catches letters from other alphabets that look identical to Latin ones. **What about a brand name inside a subdomain?** Rules can target subdomains as well as registered domains, so your brand placed in a subdomain of an unrelated domain is matched too. **Can a new rule check names registered before it existed?** Yes. With `include_past` on, a new rule also checks names already in the index, not only new registrations. **Can we be alerted when a new lookalike appears?** Yes, once a match is confirmed. A new fraudulent domain, approved by your team or by a rule set to auto-approve, is a notification event, emailed to the team members a rule names instantly or as an hourly, daily, weekly or monthly digest. **How do we keep our own domains out of the results?** List them as ignored domains in the brand protection settings. A name on that list is never reported, whichever rule matches it. ### Find the Lookalikes Registered Against You. Book a demo and we’ll run match rules against your brand names with your team. [Request demo](https://www.deepinfo.com/request-demo/)