# Brand & fraud protection

> Brand protection and fraud detection: lookalike domains, fake apps, customer scam reports, measured takedowns, and stealer-log and leak monitoring.

Source: https://wahukeza.com/platform/brand-protection

Protect · Brand & fraud

## Find the fake login page. Block it, take it down, and know how long it took.

Lookalike domains in the scripts your customers read, fake apps in the stores, scam numbers and mule accounts your customers report, each one a candidate until the evidence or an analyst confirms it. Then it reaches your blocklists, your customers’ warning page and the registrar’s inbox, with the clock running.

Lookalike domains

## Generate, discover, read, confirm, act. With a floor, not a firehose.

1.  01
    
    ### Generate
    
    Typosquats, combosquats, homoglyphs, diacritics and ccTLD swaps for every monitored brand, computed on the registrable domain.
    
2.  02
    
    ### Discover
    
    Certificate transparency, ICANN zone files (CZDS), RDAP or WHOIS age and DNS surface the registrations nobody generated.
    
3.  03
    
    ### Read the page
    
    Screenshot, credential form, clone-of-your-login match and a read of what the page says it is, so a parked or unrelated business is told apart from an impersonation.
    
4.  04
    
    ### Confirm
    
    A candidate becomes confirmed on the page read or an analyst’s decision. Never on a single weak signal.
    
5.  05
    
    ### Act
    
    Confirmed lookalikes reach your blocklists, the brand feed and the public alerts page, and a takedown with evidence is one click away.
    

Generation & discovery

## The names an attacker would register, in the scripts your customers read.

-   typosquat · combosquat
    
    ### Typos and add-ons
    
    Omissions, swaps, keyboard neighbours and the words fraudsters bolt on (login, secure, verify, app, on a list you can extend), resolved on a schedule so a parked domain that goes live is noticed the day it does.
    
-   а · е · о · р · ο · ν
    
    ### Cyrillic and Greek homoglyphs
    
    Characters that render like Latin letters, generated as IDN and checked like any other name.
    
-   č ć š ž đ
    
    ### Latin diacritics
    
    The letters of the region’s languages, plus the common accented vowels: the domain your customer would not spot on a phone screen.
    
-   .me · .co.me · .rs · .ba · .hr · .si · .mk · .al · .eu
    
    ### ccTLD swaps that understand suffixes
    
    Swaps across the region’s country codes, computed against a mirrored Public Suffix List, so .co.me is treated as a suffix and not as your brand.
    
-   .срб · .мкд
    
    ### Cyrillic IDN
    
    For a brand with Cyrillic keywords, the full Cyrillic name is generated for the Cyrillic country-code domains.
    
-   crt.sh · CZDS
    
    ### Certificate transparency and zone files
    
    A certificate or a new registration for a name like yours is an early signal, often days before content appears.
    
-   RDAP · WHOIS
    
    ### Registration age, even where RDAP is missing
    
    Several Balkan registries publish no RDAP service; a minimal WHOIS reader fills in the creation date and abuse address, and fails open to “unknown age”.
    
-   surfacing floor
    
    ### Precision is a setting
    
    The minimum confidence to surface a lookalike is yours to set: down for a launch week, up for a quiet quarter. Below it, candidates wait rather than alert.
    

Page analysis

## What the page is, not only what the name looks like.

-   screenshot · form
    
    ### Screenshot and credential form
    
    Live pages are rendered and captured; a password field on a two-day-old domain carries more weight than a string match.
    
-   clone match
    
    ### Clone of your login
    
    Your own login page is the reference: a copy of its structure on someone else’s host is the strongest single signal there is.
    
-   content read
    
    ### Parked and unrelated sites, recognised
    
    The title, description, headings and footer say what a site claims to be. A real, unrelated business that shares your letters gets a proposed Benign with the reason. Proposed, never closed on its own.
    
-   kit fingerprint
    
    ### Kits linked across copies
    
    The same phishing kit on five domains is one campaign, not five unrelated alerts.
    
-   AI provider · optional
    
    ### Visual comparison where configured
    
    Comparison against your logo runs when an image-capable AI provider is configured. With AI off, the structural signals above still work.
    
-   disposition
    
    ### Every verdict has a reason
    
    Proposed dispositions show their factors on the indicator page. The analyst’s decision is recorded on the indicator with its author.
    

Page canary

## Your login page tells you when it is being served from somewhere else.

Reverse-proxy kits (adversary-in-the-middle) serve your real login page through their own host, so a lookalike scan sees nothing unusual. A small script on your e-banking login page fires only when the page renders off your domain. Legitimate hosts are embedded as hashes, so a kit that rewrites your hostname cannot rewrite the check. A render on your own domain is discarded before anything is stored: no record for legitimate visitors, no cookie, and the client address truncated.

page canary · brand: Banka Primjeraitm

rendered on

ebanka-prijava.example

first seen

06:41 · 37 renders since

client

203.0.113.0/24 (truncated, never whole)

state

candidate → confirmed · page read: clone of your login

The beacon’s token is public, so a hit alone proves nothing. It stays a candidate until the page read matches your content or an analyst confirms it.

Financial indicators

## Fraud infrastructure is more than a domain.

Seven indicator types for the things a scam actually runs on, validated on the way in so a typo never becomes a block. They travel through the same blocklists, STIX and MISP exports as every other indicator, and an IBAN or phone number can be checked from your payment pipeline.

| type | validated as | for |
| --- | --- | --- |
| iban | ISO 13616, mod-97 checked | The mule account a victim was asked to pay. |
| bic | ISO 9362, 8 or 11 characters | The bank behind a scam payee. |
| card-bin | 6-8 digits; longer is refused | Never a full card number, anywhere. |
| phone-number | E.164 | Vishing numbers and fake support lines. |
| sms-sender-id | 1-11 alphanumeric, or E.164 | The sender name on a smishing text. |
| app-package | Android package or iOS bundle id, optional signer | A fake banking app. |
| social-handle | platform:handle, closed platform list | The account that contacted a customer. |

A full card number is refused at every entry point. [The payee-risk lookup](https://wahukeza.com/platform/exchange#payee) answers your payment system by IBAN or phone.

Beyond the web

## Fake apps, scam reports and your own social channels.

-   Apple App Store · Aptoide
    
    ### Fake apps in the stores
    
    Listings that carry your brand under a developer that is not yours are filed as candidates; an icon match against your logo with a foreign developer confirms them. The package is never downloaded or run; only the store’s published metadata is read.
    
-   report-a-scam
    
    ### A channel for your customers
    
    A public form and a mailbox where customers report the link, number, sender, account or IBAN that targeted them. Each item is a candidate; the same link a scan already confirmed reads as malicious in seconds.
    
-   QR
    
    ### QR codes, decoded without the image
    
    On the form, the QR code is decoded in the customer’s browser and only its content is sent; no screenshot ever leaves their phone. Images sent to the mailbox are decoded on arrival.
    
-   3 reporters · 14 days
    
    ### Confirmed by more than one voice
    
    A phone number, sender ID, social handle or IBAN is confirmed only when three distinct reporters name it within 14 days, or an analyst does. One stranger’s word never reaches a blocklist.
    
-   privacy
    
    ### Nothing about the reporter
    
    No name or e-mail field; a mailbox sender is kept only as a short hash, a form address only as a /24. Proof-of-work stands in for a third-party CAPTCHA, so no vendor sees your customer first.
    
-   Telegram · YouTube
    
    ### Social watch lists
    
    Your own Telegram and YouTube handles are checked daily for a change of title, image or identity (the sign of a takeover). Public Telegram channels an analyst names are read for links and numbers that mention your brand. No logins, no crawling.
    

Takedowns

## Sent by the platform when the analyst says so. Then measured.

The notice is drafted from the evidence on file and sent from the case with one click. Nothing sends a first notice automatically, and nothing closes a takedown by itself.

-   A hashed evidence pack
    
    Screenshot, page extract, certificate-transparency entries, RDAP record, DNS resolution and HTTP response, zipped and hashed once, so every reminder and escalation carries identical bytes.
    
-   Replies threaded, reminders opt-in
    
    Replies to the notice attach to the request. Reminders follow after 48 hours of silence only if the sender armed them.
    
-   An escalation ladder, drafted
    
    Registrar → hosting provider → ccTLD registry → national CERT. Each rung is drafted when the previous one goes quiet, and each send is still a click.
    
-   Blocklist reporting in the same pass
    
    Netcraft through its API; Google Safe Browsing, Microsoft SmartScreen and PhishTank through pre-filled report forms. A fake app’s takedown starts at the store.
    
-   Time-to-takedown
    
    Median and 90th percentile, per provider and per month, from first send to the target going down. Verification proposes completion; the analyst closes.
    

takedowns · last 30 dayshours, first send → down

| provider | sent | median | p90 |
| --- | --- | --- | --- |
| registrar-a.example | 14 | 19 | 41 |
| registrar-b.example | 9 | 27 | 70 |
| host-c.example | 6 | 11 | 30 |
| registry .me | 3 | 52 | 96 |

Illustrative values. The same figures feed the monthly view and the management-body report.

Confirmed feed & public alerts

## What you confirmed protects your stack and warns your customers.

Each brand has its own confirmed feed, in the blocklist formats your mail gateway, web proxy, resolver and fraud engine already read, and as a TAXII collection and MISP feed. A brand that opts in also gets a public fraud-alerts page in English and Montenegrin: confirmed fake sites, fake apps and scam numbers with their state, a line on how to recognise the real site, and the link to report a scam. Never a screenshot, an analyst’s name or an IBAN.

Banka Primjer · Upozorenja o prevaramaME · EN

Prava stranica: ebank.banka-primjer.example

-   Lažna stranica · ebanka-prijava.exampleaktivno
-   Lažna aplikacija · App Storeuklonjeno
-   SMS pošiljalac · BANKA-INFOaktivno

Prijavi prevaru · Report a scam

Only confirmed items of a brand that opted in. Your site links to it; the platform serves it.

Exposure monitoring

## Leaked credentials and secrets, handled as what they are.

Breached accounts on your domains from Have I Been Pwned; stealer-log captures against your e-banking host (your customers) and your mail domain (your staff), which needs an HIBP Pro subscription and a verified domain; ransomware leak-site posts naming your brands or clients; and secrets pushed to public GitHub code beside your identifiers. All of it is masked, TLP:RED and visible to admins only.

exposures · banka-primjerTLP:RED

-   j••••.d••@banka-primjer.exampleHIBP · breach 2026-08
-   sha256:4be1…9c07stealer log · ebank host
-   AKIA••••••••••••••Q7public GitHub code · High
-   Leak-site post naming a clientaggregator · 3 days ago

Masked at rest and in the UI; stealer-log exports are hashes your fraud team matches against its own customer table.

Leaked secrets in public code

## The key a contractor pushed to a public repository.

-   GitHub code search
    
    ### Your identifiers, searched
    
    Your domains, mail domains and the internal project names you choose are searched in public GitHub code, newest first; your own open-source repositories can be allowlisted.
    
-   22 patterns
    
    ### Classified by a cited catalogue
    
    Cloud keys, tokens, connection strings, private keys and generic passwords, each pattern citing its published source. Severity rises with proximity to your identifier.
    
-   masked · hashed
    
    ### Never tested, never minted
    
    The secret is stored masked and hashed with a short redacted excerpt; it is never tried against the provider, never becomes an indicator, and the committer is never contacted by the platform.
    
-   secret-scanning alerts
    
    ### Your own organisation, mirrored
    
    With an organisation token, GitHub’s secret-scanning alerts for your repositories appear beside the public findings. Resolution stays in GitHub.
    

How the modules work together

## One fake login page, from certificate to closed takedown.

Each step below is a different part of the platform. None of them needs a second tool, and every hand-off is recorded on the case.

1.  01 · Certificate transparency
    
    A certificate is issued for a name one homoglyph away from your e-banking host. The name becomes a candidate the same day, often before any content exists.
    
2.  02 · Page analysis · page canary
    
    When the page goes live it is screenshotted and read: a credential form, your login’s structure. If it is a reverse proxy of your real page, your own login page reports where it was rendered.
    
3.  03 · Analyst confirms
    
    The evidence is on the indicator page. One decision marks it a true positive; nothing was closed or confirmed without it.
    
4.  04 · Blocked where your users are
    
    The domain enters the brand’s confirmed feed and your blocklists: firewall, proxy, mail gateway, DNS RPZ and, through Android Private DNS, staff phones.
    
5.  05 · Takedown with evidence
    
    The notice goes to the registrar’s abuse contact with a hashed evidence pack and can be reported to Netcraft from the same screen, with reminders and the next rung drafted if nobody answers.
    
6.  06 · Reports join the case
    
    Staff who report a mail carrying the same link from Outlook are matched to the confirmed indicator and join the same case, with a verdict and its reason shown in their pane.
    
7.  07 · Measured
    
    When the target goes down the takedown proposes completion, the analyst closes it, and time-to-takedown appears in the monthly figures and the management-body report.
    

Stated plainly

## What it does not do.

-   ### No automatic takedowns
    
    No job, rule or playbook sends a first notice or closes a takedown. A playbook can open a draft; a person sends it.
    
-   ### Not every store, not every network
    
    Apps are read from the Apple App Store and Aptoide. Stores and social networks that serve search only to a logged-in browser are not scraped; customers report what reached them instead.
    
-   ### No card numbers, no binaries
    
    A full card number is refused everywhere. App packages are never downloaded, run or detonated.
    
-   ### No live-testing of secrets
    
    A leaked key is never exercised to see whether it works; rotation guidance and links are given to the analyst.
    

## Give us one brand.

We will show the generated candidates, the certificate-transparency hits and the page reads, and where the floor should sit for you. Brand Protection is in the Standard package and above, or licensed on its own.

[Book a demo](https://wahukeza.com/contact?intent=demo)

[Next: phishing defence](https://wahukeza.com/platform/phishing)