skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-brand-monitoring-for-impersonation

Detect brand impersonation across lookalike domains, social media, app stores, and dark web channels.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#phishing detection#typosquatting#brand monitoring#impersonation#takedown#dnstwist
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-brand-monitoring-for-impersonation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-brand-monitoring-for-impersonation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/performing-brand-monitoring-for-impersonation
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-brand-monitoring-for-impersonation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dnstwist, requests, beautifulsoup4, Levenshtein, tweepy.

What problem does it solve?

Brand impersonation attacks exploit consumer trust through typosquatted domains, fake social media profiles, counterfeit mobile apps, and phishing sites that mimic legitimate brands. This Skill builds a monitoring program that detects these threats early and generates evidence-backed takedown requests.

Core Features & Use Cases

  • Domain Squatting Detection: Runs dnstwist permutation scans with DNS resolution and ssdeep visual similarity scoring to find registered lookalike domains.
  • Multi-Channel Monitoring: Checks Google Safe Browsing, monitors social media for executive and brand impersonation, and searches app stores for counterfeit applications.
  • Takedown Request Generation: Produces formatted abuse reports with domain indicators, IP addresses, similarity scores, and detection evidence for registrar submission.
  • Use Case: A security team suspects phishing campaigns targeting their customers. They run the monitor against their brand domains, receive a prioritized report of live lookalike sites with MX records and login pages, and generate takedown requests for confirmed impersonations.

Quick Start

Monitor mycompany.com and mycompany.org for typosquatted domains and brand impersonation, then generate a prioritized findings report with takedown requests.

Frequently Asked Questions about performing-brand-monitoring-for-impersonation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect typosquatting domains targeting my brand?▼

Run dnstwist against your legitimate domains with the --registered flag to enumerate permutations that are actually registered. Filter results by DNS A records and ssdeep similarity scores to prioritize live lookalike sites that visually mimic your brand.

What tools detect brand impersonation on social media and app stores?▼

Social media impersonation detection uses the Twitter/X API to search for profiles matching brand or executive names. App store monitoring scrapes Google Play search results with requests and BeautifulSoup, flagging apps whose names contain brand keywords.

Does dnstwist catch homoglyph and IDN lookalike domains?▼

Default dnstwist fuzzers miss IDN/homoglyph domains using Cyrillic characters or punycode, and many new gTLDs. Add --tld dictionaries, run a separate homoglyph pass, and query Certificate Transparency logs like crt.sh or Certstream for freshly registered lookalikes.

How do I confirm a lookalike domain is actually malicious?▼

Corroborate with multiple sources before takedown: resolve the domain, screenshot the live page, check Google Safe Browsing and VirusTotal verdicts, and review WHOIS registration date. A high ssdeep score plus an active credential-harvesting form and recent registration confirms impersonation.

Why does brand monitoring generate too many false positives?▼

False positives come from your own marketing domains, defensive registrations, and legitimate resellers matching similarity checks. Allowlist these known assets before alerting so analysts only see genuinely suspicious findings.

Related Skills

Explore More Software Engineering Skills→
cris-mcris-m

virustotal

Analyze hashes, URLs, IPs, and domains for malware risk via VirusTotal APIs.

Community
Advanced
wyre-technologywyre-technology
39

cases

Manage Abnormal Security cases and analyze user-reported phishing email abuse reports.

Official
Intermediate
YukiIto1999YukiIto1999

analyzing-certificate-transparency-for-phishing

Analyze certificate transparency data to detect phishing domains and lookalike certificates.

Community
Advanced
afadtcafadtc
138

afa-pr

Coordinate media outreach, UGC integration, crisis monitoring, and takedown workflows.

Community
Advanced