Digital risk protection · Brand impersonation
Find and remove anything pretending to be you
Digital Brand Protection covers three places an attacker can pretend to be you: the web, social media and app stores. In each, the service finds the impersonation, an analyst confirms it, and its takedown is requested. Takedowns are unlimited across all three.
Web impersonation
This is the anti-phishing core of the service.
- Newly registered lookalike domains, detected from your brand keywords and official domains: typos, extra words, other top-level domains, characters that look alike.
- Active phishing sites impersonating you, found through DNS activity and web crawling, whatever their domain looks like.
- Use of your intellectual property: pages that copy your logo, your design or your code, found by computer vision and HTML comparison.
- Inactive domains, monitored on your behalf. A lookalike registered and parked today is re-probed until it becomes a phishing site, and flagged the moment it does.
Every web finding comes with the infrastructure behind it, extracted automatically from open sources and BlueVoyant’s own threat intelligence: IP address, hosting, registrar, first DNS activity, and whether the domain has a mail (MX) record.
Why MFA alone does not stop a phishing site
Many phishing sites today are not static copies. They are proxies: the victim types their password into the fake page, the proxy passes it to your real login page, your real site sends the MFA prompt, the proxy shows it, the victim approves it, and the proxy keeps the session cookie your site issues. The attacker can now replay that stolen cookie to take over the authenticated session, with no password or MFA prompt in the way.
Phishing-resistant MFA helps for your own staff. Your customers and partners are still exposed. Taking the proxy site offline stops it catching new victims; sessions it has already stolen have to be revoked separately.
Lookalike domains that never host a page
Some lookalikes are used only for email. A domain one letter away from yours sends invoices to your suppliers, job offers to candidates, or instructions that appear to come from your CFO. None of that mail passes through your gateway, because it is sent to other people. The domain is detected all the same, and the alert notes whether it has an MX (mail) record, which can raise its severity.
App impersonation
- Unauthorised copies of your app in official and unofficial stores.
- Modified versions of your genuine app, repackaged with extra code.
- Apps that claim an affiliation with your brand that does not exist.
More than 300 official and unofficial app stores are checked, and removal requests go to the stores in the format each one requires. A rogue app is reported to you within 24 hours of detection.
What a takedown looks like here
| Web | Social media | Apps | |
|---|---|---|---|
| Blocking | Reported to Google Safe Browsing and Cloudflare; shared with URLscan, VirusTotal and security vendors | – | – |
| Removal | Abuse report to the registrar and host; trademark escalation if it stays up | Reported through the platform’s impersonation process, with your trademark documents and certificate of authority | Removal request to the app store |
| Follow-up | Monitored around the clock for reactivation | Monitored until inactive | Monitored until removed |
| Number of takedowns | Unlimited | Unlimited | Unlimited |
Where this stops
It covers impersonation, not every mention. A critical review, a parody account clearly labelled as one, or a reseller using your name legitimately is not an impersonation, and platforms will not remove it as one.
Counterfeit goods are a different problem. This service is built around phishing, impersonation and fraud. If your main problem is counterfeit products on marketplaces, tell us, and we will say honestly whether this is the right service.
Analysts work business hours. Detection runs around the clock, but confirming a fake profile and filing its takedown is done by people, during business hours and at weekends when a case is urgent.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
If your official accounts and brand are in scope, the page is detected, confirmed by an analyst and reported to you within 24 hours of detection. With your trademark documents and certificate of authority on file, it is reported through Facebook’s impersonation process, followed up until it is removed, and then monitored.
Yes. Fake profiles using a named executive’s name or photograph are covered here, for the key people you list at onboarding. For deeper protection of an executive’s personal digital footprint, such as leaked personal data, private credentials and domains registered in their name, there is a separate add-on.
A domain that sends phishing email but hosts no page can be harder to remove, because there is no page to point to. It is reported, any mail (MX) record is noted in the alert so your team can block it on the gateway, and it goes into the weekly indicator list.
What else is watched
Dark web monitoring
Leaked credentials, fraud campaigns, stolen payment cards and leaked documents, each checked by an analyst.
Executive protection
Executive Cyber Guard maps each executive’s footprint and requests the takedown of impersonation.
Takedown
Three layers of removal, unlimited takedowns, and an 18-hour median for phishing sites.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.
Social media impersonation
Social media and app stores are searched around the clock, and a detected fake profile is reported within 24 hours. Profiles are scored by a classifier on how legitimate they look and how closely they resemble your official accounts, then confirmed by an analyst. How the classifier works →