Impersonation Detector

Brand protection

by kostja94 · MIT license · ★ 1,006 on GitHub

When the user faces brand impersonation, fake websites, phishing sites, or trademark infringement. Also use when the user mentions "fake site," "impersonation," "phishing site," "trademark infringement," "domain squatting," or "brand…

---
name: brand-protection
description: When the user faces brand impersonation, fake websites, phishing sites, or trademark infringement. Also use when the user mentions "fake site," "impersonation," "phishing site," "trademark infringement," "domain squatting," or "brand abuse." For monitoring, use brand-monitoring.
metadata:
  version: 1.0.1
---

# Strategy: Brand Protection

Guides discovery, reporting, and prevention of brand impersonation—fake websites, phishing sites, trademark infringement, and domain squatting. See **domain-selection** for defensive domain registration; **trust-badges** for official site verification signals; **about-page** for identity declaration.

**When invoking**: On **first use**, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output.

## Initial Assessment

**Project context:** Read root `contextus.md` when present and load only the modules relevant to this task. Without Contextus, use available project material or user-provided facts and ask for missing information; do not create a parallel context system.

Identify:

Overview

Guides discovery, reporting, and prevention of brand impersonation—fake websites, phishing sites, trademark infringement, and domain squatting. See domain-selection for defensive domain registration; trust-badges for official site verification signals; about-page for identity declaration.

What you get

Evidence package(checklist, evidence list)
Report templates(registrar, hosting, Google)
Timeline(immediate vs medium vs long-term actions)
Prevention(defensive registration, site verification, user education)

Manual install (npx, ZIP)

Claude Codenpx skills add kostja94/marketing-skills --skill brand-protection -g -a claude-code

Claude Code (degit)npx degit kostja94/marketing-skills/skills/strategies/brand/brand-protection#main ~/.claude/skills/brand-protection

Claude.ai / desktopZip the folder and upload it under Settings → Capabilities → Skills.

Codex, Cursor, other agentsPoint them at SKILL.md. The other files are plain text.

Connects with Agent Alley MCP · agentalley.io/mcp

Files included

SKILL.md9.3 KB

Read SKILL.md here

kostja94/main1 file shown

SKILL.md9.3 KB

Browse every file on GitHub↗

SKILL.md

Show the full text159 lines

Strategy: Brand Protection

Guides discovery, reporting, and prevention of brand impersonation—fake websites, phishing sites, trademark infringement, and domain squatting. See domain-selection for defensive domain registration; trust-badges for official site verification signals; about-page for identity declaration.

When invoking: On first use, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On subsequent use or when the user asks to skip, go directly to the main output.

Initial Assessment

Project context: Read root contextus.md when present and load only the modules relevant to this task. Without Contextus, use available project material or user-provided facts and ask for missing information; do not create a parallel context system.

Identify:

Impersonation type: Fake website, phishing, trademark misuse, domain squatting
Evidence available: Screenshots, URLs, WHOIS, hosting info
Legal assets: Registered trademark, copyright ownership
Impact: Traffic interception (fake site ranks for brand queries)? Payment fraud (users pay on fake site, then contact official support)?

Evidence Collection Checklist

Item	Action
Full URLs	Document all key pages of the fake site
Screenshots	Homepage, product pages, logo, layout; include date/time
Comparison	Side-by-side: official vs fake (layout, logo, copy similarity)
WHOIS	Use ICANN Lookup for registrar, creation date, registrant
Hosting	IP lookup to identify hosting provider

Reporting Channels (Priority Order)

Channel	Entry	Use Case
Domain registrar	Abuse / Report Misuse on registrar site	Brand impersonation, trademark, fraud
Hosting provider	Same; submit abuse form	Hosting infringing content
Google Safe Browsing	Report Phishing	Phishing / impersonation risk
Google Trademark	Trademark Complaint or [email protected]	Trademark infringement in search; requires registered trademark
Bing Content Removal	Content Moderation Platform	Copyright/trademark; content removal from Bing
Payment processors	PayPal Resolution Center, Stripe support	If fake site accepts payments; report fraud
Social platforms	X, Facebook, Instagram abuse forms	If fake site is promoted or linked there
Google Ads / Microsoft Ads	Platform trademark complaint forms	If impersonator runs brand ads
DMCA	To hosting provider	Copyright infringement; images, copy, design copied
ICANN	DNS Abuse complaint	If registrar does not respond within reasonable time

Report content: Include full URL, clear description of fraudulent activity, and all evidence (screenshots, logs).

Reporting Best Practices

Registrar vs hosting: Use ICANN Lookup for registrar. For hosting, use IP lookup (HostingCheckerOnline, HostingDetector, ipinfo.io) to find origin server—registrar may be Cloudflare while origin host is elsewhere; report to both.

Cloudflare as registrar: Use abuse.cloudflare.com or abuse form; select "Phishing & Malware" for impersonation. Email complaints are generally not processed; use the online form. Provide specific URLs of infringing pages.

Hosting detection: Sites behind Cloudflare CDN hide origin IP. Use reverse IP lookup or hosting detection tools to identify underlying host; submit abuse to that provider as well.

Parallel reporting: Submit to registrar, host, and Google Safe Browsing simultaneously; do not wait for one before others. Google trademark review takes 1–8 weeks.

Legal Options

Option	When	Notes
Cease and desist	Trademark infringement	Lawyer-drafted; often first step
DMCA takedown	Copyrighted material copied	Images, copy, design; hosting providers typically comply
Consumer protection	Scam / fraud	FTC ReportFraud.ftc.gov (US)
Law enforcement	Financial loss, identity theft	IC3 (FBI) for cybercrime

Prevention Measures

Defensive Registration

Register brand+ai, brand+app, brand+official, etc. See domain-selection for defensive registration.
Redirect variants to main domain; do not deploy separate sites.

Official Site Verification

Place "Official website: [domain]" prominently:

Homepage (above fold or hero)
Sign-in / Sign-up pages
Pricing / Payment pages: "Only pay at [official-domain]. Do not enter payment on other domains."
Footer: "© [Brand]. Official site: [domain]"
FAQ: "How do I verify I'm on the official site?" → "The only official URL is [domain]. Any other domain is not affiliated."

Use trust-badges for verification signals. See about-page for identity declaration.

Customer Support (Payment Fraud)

When users report "can't use after payment" but no record exists—likely paid on fake site:

Verify source: Ask which URL they used (request screenshot or URL).
Response template: Explain that the only official site is [official-domain]; if they paid elsewhere, that site is not affiliated. Recommend: (a) dispute charge with payment provider, (b) use only [official-domain] going forward.
Roll out template to support team; ensure consistent messaging.

User Education

Social media pinned post / announcement: "Only use [official-domain]"
Email signatures, support replies: link to official domain only

Traffic Recovery (When Impersonation Intercepts Search)

Tactic	Purpose
Brand search ads	Run Google Ads and Microsoft Ads on brand terms; ensure official site appears first for brand queries
SEO	Strengthen official site for branded queries; Organization schema, clear H1, meta tags. See schema-markup, title-tag
Social	Pinned post: "Only use [official-domain]. Beware of impersonation."

Monitoring (Ongoing)

Periodic search: brand name + common variants (e.g., brand+ai, brand+app)
See brand-monitoring for monitoring setup, tool selection, and cadence

Timeline (Typical)

Phase	Focus
Immediate (Days 1–3)	Support template; site declaration; evidence collection
Short-term (Week 1–2)	Abuse reports; Google Safe Browsing; DMCA if applicable
Traffic (Week 2+)	Brand ads; SEO; social announcement
Ongoing	Monitoring; defensive registration if feasible

Implementation Checklist

Short-term (1–2 weeks): Evidence collection; abuse reports to registrar and host; Google Safe Browsing report; DMCA if applicable; add "Official website" on site.

Medium-term: Add impersonation guidance to domain-selection; official verification to trust-badges, about-page.

Long-term: Periodic search (brand + variants); brand monitoring (BrandShield, Doppel); defensive registration of variants.

Output Format

Evidence package (checklist, evidence list)
Report templates (registrar, hosting, Google)
Timeline (immediate vs medium vs long-term actions)
Prevention (defensive registration, site verification, user education)

References

How to Report and Take Down a Fake Website - LegalClarity
Website Spoofing: Detection and Take Down - BrandShield
ICANN DNS Abuse Complaints Guide
Google Safe Browsing - Report Phishing
Cloudflare Abuse Reporting — use online form; select Phishing & Malware
Google Trademark Complaint
Bing Content Removal

domain-selection: Defensive domain registration; brand variants
rebranding-strategy: When rebranding, sync brand protection checks
brand-monitoring: Proactive monitoring setup; tool selection; this skill = reactive takedown
branding: Brand asset protection; consistency
trust-badges: Official site verification signals
about-page: Official identity and domain declaration
homepage-generator: "Official website" placement
google-ads, paid-ads-strategy: Brand search ads for traffic recovery
schema-markup, title-tag: SEO for branded queries

1	---
2	name: brand-protection
3	description: When the user faces brand impersonation, fake websites, phishing sites, or trademark infringement. Also use when the user mentions "fake site," "impersonation," "phishing site," "trademark infringement," "domain squatting," or "brand abuse." For monitoring, use brand-monitoring.
4	metadata:
5	version: 1.0.1
6	---
7
8	# Strategy: Brand Protection
9
10	Guides discovery, reporting, and prevention of brand impersonation—fake websites, phishing sites, trademark infringement, and domain squatting. See domain-selection for defensive domain registration; trust-badges for official site verification signals; about-page for identity declaration.
11
12	When invoking: On first use, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On subsequent use or when the user asks to skip, go directly to the main output.
13
14	## Initial Assessment
15
16	Project context: Read root `contextus.md` when present and load only the modules relevant to this task. Without Contextus, use available project material or user-provided facts and ask for missing information; do not create a parallel context system.
17
18	Identify:
19	1. Impersonation type: Fake website, phishing, trademark misuse, domain squatting
20	2. Evidence available: Screenshots, URLs, WHOIS, hosting info
21	3. Legal assets: Registered trademark, copyright ownership
22	4. Impact: Traffic interception (fake site ranks for brand queries)? Payment fraud (users pay on fake site, then contact official support)?
23
24	## Evidence Collection Checklist
25
26	\| Item \| Action \|
27	\|------\|--------\|
28	\| Full URLs \| Document all key pages of the fake site \|
29	\| Screenshots \| Homepage, product pages, logo, layout; include date/time \|
30	\| Comparison \| Side-by-side: official vs fake (layout, logo, copy similarity) \|
31	\| WHOIS \| Use [ICANN Lookup](https://lookup.icann.org/) for registrar, creation date, registrant \|
32	\| Hosting \| IP lookup to identify hosting provider \|
33
34	## Reporting Channels (Priority Order)
35
36	\| Channel \| Entry \| Use Case \|
37	\|---------\|-------\|----------\|
38	\| Domain registrar \| Abuse / Report Misuse on registrar site \| Brand impersonation, trademark, fraud \|
39	\| Hosting provider \| Same; submit abuse form \| Hosting infringing content \|
40	\| Google Safe Browsing \| [Report Phishing](https://safebrowsing.google.com/safebrowsing/report_phish/) \| Phishing / impersonation risk \|
41	\| Google Trademark \| [Trademark Complaint](https://services.google.com/inquiry/aw_tmcomplaint) or [email protected] \| Trademark infringement in search; requires registered trademark \|
42	\| Bing Content Removal \| [Content Moderation Platform](https://www.bing.com/webmaster/contentremovalform/showanonymouspage) \| Copyright/trademark; content removal from Bing \|
43	\| Payment processors \| PayPal Resolution Center, Stripe support \| If fake site accepts payments; report fraud \|
44	\| Social platforms \| X, Facebook, Instagram abuse forms \| If fake site is promoted or linked there \|
45	\| Google Ads / Microsoft Ads \| Platform trademark complaint forms \| If impersonator runs brand ads \|
46	\| DMCA \| To hosting provider \| Copyright infringement; images, copy, design copied \|
47	\| ICANN \| [DNS Abuse complaint](https://www.icann.org/en/system/files/files/submitting-dns-abuse-complaints-icann-guide-17nov25-en.pdf) \| If registrar does not respond within reasonable time \|
48
49	Report content: Include full URL, clear description of fraudulent activity, and all evidence (screenshots, logs).
50
51	## Reporting Best Practices
52
53	Registrar vs hosting: Use [ICANN Lookup](https://lookup.icann.org/) for registrar. For hosting, use IP lookup (HostingCheckerOnline, HostingDetector, ipinfo.io) to find origin server—registrar may be Cloudflare while origin host is elsewhere; report to both.
54
55	Cloudflare as registrar: Use [abuse.cloudflare.com](https://abuse.cloudflare.com/) or [abuse form](https://abuse.cloudflare.com/phishing); select "Phishing & Malware" for impersonation. Email complaints are generally not processed; use the online form. Provide specific URLs of infringing pages.
56
57	Hosting detection: Sites behind Cloudflare CDN hide origin IP. Use reverse IP lookup or hosting detection tools to identify underlying host; submit abuse to that provider as well.
58
59	Parallel reporting: Submit to registrar, host, and Google Safe Browsing simultaneously; do not wait for one before others. Google trademark review takes 1–8 weeks.
60
61	## Legal Options
62
63	\| Option \| When \| Notes \|
64	\|--------\|------\|-------\|
65	\| Cease and desist \| Trademark infringement \| Lawyer-drafted; often first step \|
66	\| DMCA takedown \| Copyrighted material copied \| Images, copy, design; hosting providers typically comply \|
67	\| Consumer protection \| Scam / fraud \| FTC ReportFraud.ftc.gov (US) \|
68	\| Law enforcement \| Financial loss, identity theft \| IC3 (FBI) for cybercrime \|
69
70	## Prevention Measures
71
72	### Defensive Registration
73
74	- Register brand+ai, brand+app, brand+official, etc. See domain-selection for defensive registration.
75	- Redirect variants to main domain; do not deploy separate sites.
76
77	### Official Site Verification
78
79	Place "Official website: [domain]" prominently:
80	- Homepage (above fold or hero)
81	- Sign-in / Sign-up pages
82	- Pricing / Payment pages: "Only pay at [official-domain]. Do not enter payment on other domains."
83	- Footer: "© [Brand]. Official site: [domain]"
84	- FAQ: "How do I verify I'm on the official site?" → "The only official URL is [domain]. Any other domain is not affiliated."
85
86	Use trust-badges for verification signals. See about-page for identity declaration.
87
88	### Customer Support (Payment Fraud)
89
90	When users report "can't use after payment" but no record exists—likely paid on fake site:
91
92	1. Verify source: Ask which URL they used (request screenshot or URL).
93	2. Response template: Explain that the only official site is [official-domain]; if they paid elsewhere, that site is not affiliated. Recommend: (a) dispute charge with payment provider, (b) use only [official-domain] going forward.
94	3. Roll out template to support team; ensure consistent messaging.
95
96	### User Education
97
98	- Social media pinned post / announcement: "Only use [official-domain]"
99	- Email signatures, support replies: link to official domain only
100
101	## Traffic Recovery (When Impersonation Intercepts Search)
102
103	\| Tactic \| Purpose \|
104	\|--------\|---------\|
105	\| Brand search ads \| Run Google Ads and Microsoft Ads on brand terms; ensure official site appears first for brand queries \|
106	\| SEO \| Strengthen official site for branded queries; Organization schema, clear H1, meta tags. See schema-markup, title-tag \|
107	\| Social \| Pinned post: "Only use [official-domain]. Beware of impersonation." \|
108
109	## Monitoring (Ongoing)
110
111	- Periodic search: brand name + common variants (e.g., brand+ai, brand+app)
112	- See brand-monitoring for monitoring setup, tool selection, and cadence
113
114	## Timeline (Typical)
115
116	\| Phase \| Focus \|
117	\|-------\|-------\|
118	\| Immediate (Days 1–3) \| Support template; site declaration; evidence collection \|
119	\| Short-term (Week 1–2) \| Abuse reports; Google Safe Browsing; DMCA if applicable \|
120	\| Traffic (Week 2+) \| Brand ads; SEO; social announcement \|
121	\| Ongoing \| Monitoring; defensive registration if feasible \|
122
123	## Implementation Checklist
124
125	Short-term (1–2 weeks): Evidence collection; abuse reports to registrar and host; Google Safe Browsing report; DMCA if applicable; add "Official website" on site.
126
127	Medium-term: Add impersonation guidance to domain-selection; official verification to trust-badges, about-page.
128
129	Long-term: Periodic search (brand + variants); brand monitoring (BrandShield, Doppel); defensive registration of variants.
130
131	## Output Format
132
133	- Evidence package (checklist, evidence list)
134	- Report templates (registrar, hosting, Google)
135	- Timeline (immediate vs medium vs long-term actions)
136	- Prevention (defensive registration, site verification, user education)
137
138	## References
139
140	- [How to Report and Take Down a Fake Website - LegalClarity](https://legalclarity.org/how-to-report-and-take-down-a-fake-website/)
141	- [Website Spoofing: Detection and Take Down - BrandShield](https://www.brandshield.com/blog/website-spoofing-detection-take-down/)
142	- [ICANN DNS Abuse Complaints Guide](https://www.icann.org/en/system/files/files/submitting-dns-abuse-complaints-icann-guide-17nov25-en.pdf)
143	- [Google Safe Browsing - Report Phishing](https://safebrowsing.google.com/safebrowsing/report_phish/)
144	- [Cloudflare Abuse Reporting](https://www.cloudflare.com/trust-safety/reporting-abuse/) — use online form; select Phishing & Malware
145	- [Google Trademark Complaint](https://services.google.com/inquiry/aw_tmcomplaint)
146	- [Bing Content Removal](https://www.bing.com/webmaster/contentremovalform/showanonymouspage)
147
148	## Related Skills
149
150	- domain-selection: Defensive domain registration; brand variants
151	- rebranding-strategy: When rebranding, sync brand protection checks
152	- brand-monitoring: Proactive monitoring setup; tool selection; this skill = reactive takedown
153	- branding: Brand asset protection; consistency
154	- trust-badges: Official site verification signals
155	- about-page: Official identity and domain declaration
156	- homepage-generator: "Official website" placement
157	- google-ads, paid-ads-strategy: Brand search ads for traffic recovery
158	- schema-markup, title-tag: SEO for branded queries
159