brand-impersonation

Name: brand-impersonation
Availability: InStock
Author: chenchunrun

Detect brand impersonation by monitoring phishing domains and domain variants.

1|1|Updated Apr 25, 2026

Search Tags:#brand #phishing #typosquatting #impersonation #homograph #domain-monitoring

Ready to run

npx skills add https://github.com/chenchunrun/onyx-soc --skill brand-impersonation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: brand-impersonation
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/brand-impersonation
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill brand-impersonation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

企业在品牌保护场景中需要快速发现品牌仿冒、钓鱼域名及同形字攻击，降低用户误导、信任下降和商业损失的风险。

Core Features & Use Cases

同形字与 Typosquatting 检测：识别外观相似的域名并给出风险评估。
仿冒域名监控工作流：覆盖域名变体、CT 日志、前缀/后缀变体等，持续监控潜在威胁。
证据收集与处置模板：提供报告格式与下架/取证模板，便于跨团队协作。

Quick Start

输入目标品牌与域名清单，让系统快速检测同形字攻击、仿冒域名及相似域名并输出风险分析。

Frequently Asked Questions about brand-impersonation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect homograph and typosquatting domains impersonating my brand?▼

To detect homograph and typosquatting domains, this Skill applies deterministic checks on domain similarity against your target brand and domain list, identifying visually similar variants and outputting structured risk insights for phishing prevention.

What is the best way to monitor phishing domains across TLS logs and registrars?▼

The best way to monitor phishing domains is by applying this Skill's impersonation monitoring workflow across TLS logs and registrars, continuously tracking domain variants to generate structured cyber threat intel risk insights.

Can I use this to collect evidence for phishing domain takedowns?▼

Yes, you can collect evidence for phishing domain takedowns as this Skill provides report formats and takedown templates alongside structured risk insights, facilitating cross-team collaboration during brand protection workflows.

Do I need a predefined domain list to start brand impersonation monitoring?▼

Yes, you need a predefined list containing your target brand and domains to start brand impersonation monitoring, which the system then uses to perform deterministic checks on domain similarity and detect typosquatting variants.

How does domain similarity checking work for homograph attacks?▼

Domain similarity checking for homograph attacks works by applying deterministic checks to identify visually identical characters from different scripts, evaluating domain variants and outputting structured risk insights for threat intelligence.

What are the limitations of automated typosquatting detection?▼

Automated typosquatting detection limitations involve relying on deterministic checks for domain similarity, which may require manual context validation to distinguish malicious phishing domains from benign similarly-named entities.