Brand Protection
Catch live lookalike domains, separate parked squats from phishing infrastructure, and build takedown evidence in one pass.
Brand Protection Documentation
Generating typosquats is easy. The hard part is telling a parked squat from one wired into live phishing infrastructure. A lookalike list is noise until you know which entries resolve, where they host, and whether that hosting already appears in phishing feeds. Each of those checks is usually a separate service, and stitching them together for hundreds of candidates is a day's work that goes stale by the next.
WhisperGraph runs the whole loop on one pre-joined graph. whisper.variants() generates lookalikes and keeps only the registered ones. One traversal resolves them and reads the threat verdict off the hosting. explain() turns any hit into a scored evidence chain a registrar will act on. Co-hosting, shared-registrant, and shared-nameserver pivots expand one confirmed domain into the rest of the kit. You spend takedown effort on the domains that are live and dangerous, not the dormant ones.
Run it
Three guided workflows cover the core brand-protection jobs. Each runs in the browser against the live graph, with the Cypher behind every step visible and editable.
| Workflow | What it does |
|---|---|
| Typosquat Scanner | Brand domain to its registered lookalikes, each checked for ownership (yours, or a third party's?) and enriched with a threat verdict, hosting, and registration age. |
| Brand-impersonation TLD sweep | Hunt registered lookalikes of a brand within a risky TLD: a suffix plus keyword sweep across the namespace, catching what a per-brand variant generator misses. |
| Build the takedown evidence package | One-pass dossier for a scam or phishing domain: verdict, owner, listing feeds, registration age, and the wider infrastructure around it. |
Related flows live under other domains: the burner-domain detector flags fresh, privacy-protected registrations, phishing-actor-ttp chains a lookalike cluster to MITRE ATT&CK techniques, and the Attack-Surface Mapper includes registered lookalikes in a domain's external footprint.
Recipes
Lookalike Hunting collects the copy-paste Cypher for the full loop: generate registered typosquats in one call, resolve and score them in one pass, sweep risky TLDs for brand keywords, and expand a confirmed hit through co-hosting, WHOIS, nameserver, Certificate Transparency, and TLS-fingerprint pivots.
Go deeper
The verdicts behind these workflows come from the graph's threat feeds and categories. The procedures they lean on are documented under Procedures. To run the recipes yourself over HTTP, start with the Cypher API; anonymous runs stop at 2 traversal hops, and a free key raises that to 3 (see Getting Started).