[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFNSPPSFGPJFD8ZNRSKV3Y":3,"skill-same:01M6AFNSPPSFGPJFD8ZNRSKV3Y":142},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":97,"commitSha":98,"skillDirectory":99,"forksCount":100,"repositoryHtmlUrl":101,"repositoryHomepageUrl":102,"ownerHtmlUrl":103,"ownerBlogUrl":104,"ownerDescription":105,"updatedAt":106,"install":107,"resources":120},"01M6AFNSPPSFGPJFD8ZNRSKV3Y","performing-brand-monitoring-for-impersonation",null,"Monitor for brand impersonation attacks across domains, social media, mobile apps, and dark web channels to detect phishing campaigns, fake sites, and unauthorized brand usage targeting your organization.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-brand-monitoring-for-impersonation\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"performing brand monitoring for impersonation","impersonation","monitoring","threat-intelligence","social-media","brand-monitoring","t1566","initial-access","reconnaissance","domain-monitoring","phishing","cybersecurity","email","website","search","create","development","monitor","infrastructure","official","2026-11-10 10:12:30",false,"---\nname: performing-brand-monitoring-for-impersonation\ndescription: Monitor for brand impersonation attacks across domains, social media,\n  mobile apps, and dark web channels to detect phishing campaigns, fake sites, and\n  unauthorized brand usage targeting your organization.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- brand-monitoring\n- impersonation\n- phishing\n- domain-monitoring\n- social-media\n- brand-protection\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1566\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - resource-development\n  - initial-access\n  - stealth\n  techniques:\n  - id: T1583.001\n    name: 'Acquire Infrastructure: Domains'\n    tactic: resource-development\n    source: attack\n  - id: T1583.008\n    name: 'Acquire Infrastructure: Malvertising'\n    tactic: resource-development\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n  - id: T1593\n    name: Search Open Websites\u002FDomains\n    tactic: reconnaissance\n    source: attack\n  - id: F1032\n    name: Impersonate Official\n    tactic: initial-access\n    source: f3\n  - id: T1672\n    name: Email Spoofing\n    tactic: stealth\n    source: attack\n---\n# Performing Brand Monitoring for Impersonation\n\n## Overview\n\nBrand impersonation attacks exploit consumer trust through lookalike domains, fake social media profiles, counterfeit mobile apps, and phishing sites that mimic legitimate brands. In 2025, brand impersonation remained one of the most costly cyber threats, with AI-generated phishing emails achieving a 54% click-through rate. This skill covers building a comprehensive brand monitoring program that detects domain squatting, social media impersonation, fake mobile apps, unauthorized logo usage, and dark web brand mentions using automated scanning and alerting.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing brand monitoring for impersonation\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `dnstwist`, `requests`, `beautifulsoup4`, `Levenshtein`, `tweepy` libraries\n- API keys: VirusTotal, Google Safe Browsing, Twitter\u002FX API, Shodan\n- List of brand assets: domains, trademarks, logos, executive names\n- Certificate Transparency monitoring (Certstream or crt.sh)\n- Understanding of domain registration and TLD landscape\n\n## Key Concepts\n\n### Attack Surface\n\nBrand impersonation spans multiple channels: domain squatting (typosquatting, homoglyphs, TLD variations), phishing sites (cloned websites with stolen branding), social media (fake profiles impersonating executives or company), mobile apps (counterfeit apps in app stores), email spoofing (display name and domain impersonation), and dark web (brand mentions in forums, marketplaces).\n\n### Detection Approaches\n\nEffective brand monitoring combines proactive scanning (domain permutation with dnstwist, CT log monitoring), web crawling (screenshot comparison, logo detection), social media monitoring (profile name matching, post content analysis), app store monitoring (name and icon similarity detection), and dark web monitoring (forum scraping, marketplace tracking).\n\n### Risk Prioritization\n\nNot all impersonation is malicious. Risk factors include: active web content (especially login pages), SSL certificate present, MX records configured (email receiving capability), visual similarity to legitimate site, recent registration date, and hosting in regions associated with cybercrime.\n\n## Workflow\n\n### Step 1: Multi-Channel Brand Monitoring System\n\n```python\nimport subprocess\nimport requests\nimport json\nfrom datetime import datetime\nfrom urllib.parse import urlparse\nimport Levenshtein\n\nclass BrandMonitor:\n    def __init__(self, brand_config):\n        self.brand_name = brand_config[\"name\"]\n        self.domains = brand_config[\"domains\"]\n        self.keywords = brand_config[\"keywords\"]\n        self.executive_names = brand_config.get(\"executives\", [])\n        self.logo_hash = brand_config.get(\"logo_hash\", \"\")\n        self.findings = []\n\n    def scan_domain_squatting(self):\n        \"\"\"Detect typosquatting and lookalike domains.\"\"\"\n        all_results = []\n        for domain in self.domains:\n            cmd = [\"dnstwist\", \"--registered\", \"--format\", \"json\",\n                   \"--nameservers\", \"8.8.8.8\", \"--threads\", \"30\", domain]\n            try:\n                result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)\n                if result.returncode == 0:\n                    domains = json.loads(result.stdout)\n                    registered = [d for d in domains if d.get(\"dns_a\") or d.get(\"dns_aaaa\")]\n                    all_results.extend(registered)\n                    print(f\"[+] Domain squatting scan for {domain}: \"\n                          f\"{len(registered)} registered lookalikes\")\n            except (subprocess.TimeoutExpired, Exception) as e:\n                print(f\"[-] Error scanning {domain}: {e}\")\n\n        for entry in all_results:\n            self.findings.append({\n                \"type\": \"domain_squatting\",\n                \"indicator\": entry.get(\"domain\", \"\"),\n                \"fuzzer\": entry.get(\"fuzzer\", \"\"),\n                \"dns_a\": entry.get(\"dns_a\", []),\n                \"ssdeep_score\": entry.get(\"ssdeep_score\", 0),\n                \"detected_at\": datetime.now().isoformat(),\n            })\n        return all_results\n\n    def check_google_safe_browsing(self, urls, api_key):\n        \"\"\"Check URLs against Google Safe Browsing API.\"\"\"\n        url = f\"https:\u002F\u002Fsafebrowsing.googleapis.com\u002Fv4\u002FthreatMatches:find?key={api_key}\"\n        body = {\n            \"client\": {\"clientId\": \"brand-monitor\", \"clientVersion\": \"1.0\"},\n            \"threatInfo\": {\n                \"threatTypes\": [\"MALWARE\", \"SOCIAL_ENGINEERING\", \"UNWANTED_SOFTWARE\"],\n                \"platformTypes\": [\"ANY_PLATFORM\"],\n                \"threatEntryTypes\": [\"URL\"],\n                \"threatEntries\": [{\"url\": u} for u in urls],\n            },\n        }\n        resp = requests.post(url, json=body, timeout=15)\n        if resp.status_code == 200:\n            matches = resp.json().get(\"matches\", [])\n            print(f\"[+] Google Safe Browsing: {len(matches)} threats found\")\n            return matches\n        return []\n\n    def monitor_social_media_impersonation(self, platform=\"twitter\"):\n        \"\"\"Detect social media profiles impersonating brand or executives.\"\"\"\n        suspicious_profiles = []\n        # Search for profiles with similar names\n        for name in self.executive_names + [self.brand_name]:\n            # Using a general search approach\n            search_url = f\"https:\u002F\u002Fapi.twitter.com\u002F2\u002Fusers\u002Fby\u002Fusername\u002F{name.replace(' ', '')}\"\n            # Note: In production, use authenticated Twitter API\n            suspicious_profiles.append({\n                \"search_term\": name,\n                \"platform\": platform,\n                \"note\": \"Requires authenticated API access for full search\",\n            })\n        return suspicious_profiles\n\n    def monitor_app_stores(self):\n        \"\"\"Check for fake mobile apps impersonating the brand.\"\"\"\n        fake_apps = []\n        for keyword in self.keywords:\n            # Google Play Store search (unofficial)\n            url = f\"https:\u002F\u002Fplay.google.com\u002Fstore\u002Fsearch?q={keyword}&c=apps\"\n            try:\n                resp = requests.get(url, timeout=15, headers={\n                    \"User-Agent\": \"Mozilla\u002F5.0\"\n                })\n                if resp.status_code == 200:\n                    # Parse results for brand name matches\n                    from bs4 import BeautifulSoup\n                    soup = BeautifulSoup(resp.text, \"html.parser\")\n                    app_links = soup.find_all(\"a\", href=lambda h: h and \"\u002Fstore\u002Fapps\u002Fdetails\" in h)\n                    for link in app_links:\n                        app_name = link.get_text(strip=True)\n                        if any(k.lower() in app_name.lower() for k in self.keywords):\n                            fake_apps.append({\n                                \"name\": app_name,\n                                \"url\": f\"https:\u002F\u002Fplay.google.com{link['href']}\",\n                                \"platform\": \"google_play\",\n                                \"keyword\": keyword,\n                            })\n            except Exception as e:\n                print(f\"[-] App store search error: {e}\")\n        return fake_apps\n\n    def generate_monitoring_report(self):\n        report = {\n            \"brand\": self.brand_name,\n            \"generated\": datetime.now().isoformat(),\n            \"total_findings\": len(self.findings),\n            \"findings_by_type\": {},\n            \"high_priority\": [],\n        }\n        for finding in self.findings:\n            ftype = finding[\"type\"]\n            if ftype not in report[\"findings_by_type\"]:\n                report[\"findings_by_type\"][ftype] = 0\n            report[\"findings_by_type\"][ftype] += 1\n\n            # High priority: has web similarity or MX records\n            if finding.get(\"ssdeep_score\", 0) > 50:\n                report[\"high_priority\"].append(finding)\n\n        with open(f\"brand_monitoring_{self.brand_name.lower()}.json\", \"w\") as f:\n            json.dump(report, f, indent=2)\n        print(f\"[+] Brand monitoring report: {len(self.findings)} findings\")\n        return report\n\nmonitor = BrandMonitor({\n    \"name\": \"MyCompany\",\n    \"domains\": [\"mycompany.com\", \"mycompany.org\"],\n    \"keywords\": [\"mycompany\", \"mybrand\", \"myproduct\"],\n    \"executives\": [\"CEO Name\", \"CTO Name\"],\n})\nmonitor.scan_domain_squatting()\nreport = monitor.generate_monitoring_report()\n```\n\n### Step 2: Takedown Request Generation\n\n```python\ndef generate_takedown_request(finding, brand_info):\n    \"\"\"Generate abuse report for domain\u002Fsite takedown.\"\"\"\n    request = f\"\"\"Subject: Abuse Report - Brand Impersonation \u002F Phishing\n\nDear Abuse Team,\n\nWe are writing to report a domain that is impersonating {brand_info['name']}\nfor apparent phishing\u002Ffraud purposes.\n\nInfringing Domain: {finding.get('indicator', '')}\nIP Address: {', '.join(finding.get('dns_a', ['Unknown']))}\nDetection Method: {finding.get('fuzzer', 'domain similarity analysis')}\nWeb Similarity Score: {finding.get('ssdeep_score', 'N\u002FA')}%\nDetection Date: {finding.get('detected_at', '')}\n\nOur legitimate domain(s): {', '.join(brand_info['domains'])}\n\nThis domain appears to be impersonating our brand through {finding.get('fuzzer', 'typosquatting')}.\nWe request immediate suspension of this domain.\n\nEvidence of infringement is available upon request.\n\nRegards,\n{brand_info['name']} Security Team\n\"\"\"\n    return request\n```\n\n## Validation Criteria\n\n- Domain squatting detected through dnstwist permutation scanning\n- Google Safe Browsing checks identify known threats\n- Certificate transparency monitoring detects new phishing certificates\n- Social media monitoring identifies impersonation profiles\n- App store monitoring detects counterfeit applications\n- Takedown requests generated with required evidence\n\n## References\n\n- [Netcraft: Brand Protection Platforms](https:\u002F\u002Fwww.netcraft.com\u002Fblog\u002F6-best-brand-protection-platforms-for-defending-your-company-s-online-reputation\u002F)\n- [Cyble: Brand Impersonation 2025](https:\u002F\u002Fcyble.com\u002Fknowledge-hub\u002Fbrand-impersonation-2025-threats-2026\u002F)\n- [Recorded Future: Brand Intelligence](https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fbrand-intelligence)\n- [NetDiligence: Domain Security and Phishing](https:\u002F\u002Fnetdiligence.com\u002Fblog\u002F2025\u002F12\u002Funderstanding-domain-security-brand-impersonation\u002F)\n- [Flare: Digital Brand Protection](https:\u002F\u002Fflare.io\u002Fglossary\u002Fdigital-brand-protection\u002F)\n- [dnstwist GitHub](https:\u002F\u002Fgithub.com\u002Felceef\u002Fdnstwist)\n","# Performing Brand Monitoring for Impersonation\n\n## Overview\n\nBrand impersonation attacks exploit consumer trust through lookalike domains, fake social media profiles, counterfeit mobile apps, and phishing sites that mimic legitimate brands. In 2025, brand impersonation remained one of the most costly cyber threats, with AI-generated phishing emails achieving a 54% click-through rate. This skill covers building a comprehensive brand monitoring program that detects domain squatting, social media impersonation, fake mobile apps, unauthorized logo usage, and dark web brand mentions using automated scanning and alerting.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing brand monitoring for impersonation\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `dnstwist`, `requests`, `beautifulsoup4`, `Levenshtein`, `tweepy` libraries\n- API keys: VirusTotal, Google Safe Browsing, Twitter\u002FX API, Shodan\n- List of brand assets: domains, trademarks, logos, executive names\n- Certificate Transparency monitoring (Certstream or crt.sh)\n- Understanding of domain registration and TLD landscape\n\n## Key Concepts\n\n### Attack Surface\n\nBrand impersonation spans multiple channels: domain squatting (typosquatting, homoglyphs, TLD variations), phishing sites (cloned websites with stolen branding), social media (fake profiles impersonating executives or company), mobile apps (counterfeit apps in app stores), email spoofing (display name and domain impersonation), and dark web (brand mentions in forums, marketplaces).\n\n### Detection Approaches\n\nEffective brand monitoring combines proactive scanning (domain permutation with dnstwist, CT log monitoring), web crawling (screenshot comparison, logo detection), social media monitoring (profile name matching, post content analysis), app store monitoring (name and icon similarity detection), and dark web monitoring (forum scraping, marketplace tracking).\n\n### Risk Prioritization\n\nNot all impersonation is malicious. Risk factors include: active web content (especially login pages), SSL certificate present, MX records configured (email receiving capability), visual similarity to legitimate site, recent registration date, and hosting in regions associated with cybercrime.\n\n## Workflow\n\n### Step 1: Multi-Channel Brand Monitoring System\n\n```python\nimport subprocess\nimport requests\nimport json\nfrom datetime import datetime\nfrom urllib.parse import urlparse\nimport Levenshtein\n\nclass BrandMonitor:\n    def __init__(self, brand_config):\n        self.brand_name = brand_config[\"name\"]\n        self.domains = brand_config[\"domains\"]\n        self.keywords = brand_config[\"keywords\"]\n        self.executive_names = brand_config.get(\"executives\", [])\n        self.logo_hash = brand_config.get(\"logo_hash\", \"\")\n        self.findings = []\n\n    def scan_domain_squatting(self):\n        \"\"\"Detect typosquatting and lookalike domains.\"\"\"\n        all_results = []\n        for domain in self.domains:\n            cmd = [\"dnstwist\", \"--registered\", \"--format\", \"json\",\n                   \"--nameservers\", \"8.8.8.8\", \"--threads\", \"30\", domain]\n            try:\n                result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)\n                if result.returncode == 0:\n                    domains = json.loads(result.stdout)\n                    registered = [d for d in domains if d.get(\"dns_a\") or d.get(\"dns_aaaa\")]\n                    all_results.extend(registered)\n                    print(f\"[+] Domain squatting scan for {domain}: \"\n                          f\"{len(registered)} registered lookalikes\")\n            except (subprocess.TimeoutExpired, Exception) as e:\n                print(f\"[-] Error scanning {domain}: {e}\")\n\n        for entry in all_results:\n            self.findings.append({\n                \"type\": \"domain_squatting\",\n                \"indicator\": entry.get(\"domain\", \"\"),\n                \"fuzzer\": entry.get(\"fuzzer\", \"\"),\n                \"dns_a\": entry.get(\"dns_a\", []),\n                \"ssdeep_score\": entry.get(\"ssdeep_score\", 0),\n                \"detected_at\": datetime.now().isoformat(),\n            })\n        return all_results\n\n    def check_google_safe_browsing(self, urls, api_key):\n        \"\"\"Check URLs against Google Safe Browsing API.\"\"\"\n        url = f\"https:\u002F\u002Fsafebrowsing.googleapis.com\u002Fv4\u002FthreatMatches:find?key={api_key}\"\n        body = {\n            \"client\": {\"clientId\": \"brand-monitor\", \"clientVersion\": \"1.0\"},\n            \"threatInfo\": {\n                \"threatTypes\": [\"MALWARE\", \"SOCIAL_ENGINEERING\", \"UNWANTED_SOFTWARE\"],\n                \"platformTypes\": [\"ANY_PLATFORM\"],\n                \"threatEntryTypes\": [\"URL\"],\n                \"threatEntries\": [{\"url\": u} for u in urls],\n            },\n        }\n        resp = requests.post(url, json=body, timeout=15)\n        if resp.status_code == 200:\n            matches = resp.json().get(\"matches\", [])\n            print(f\"[+] Google Safe Browsing: {len(matches)} threats found\")\n            return matches\n        return []\n\n    def monitor_social_media_impersonation(self, platform=\"twitter\"):\n        \"\"\"Detect social media profiles impersonating brand or executives.\"\"\"\n        suspicious_profiles = []\n        # Search for profiles with similar names\n        for name in self.executive_names + [self.brand_name]:\n            # Using a general search approach\n            search_url = f\"https:\u002F\u002Fapi.twitter.com\u002F2\u002Fusers\u002Fby\u002Fusername\u002F{name.replace(' ', '')}\"\n            # Note: In production, use authenticated Twitter API\n            suspicious_profiles.append({\n                \"search_term\": name,\n                \"platform\": platform,\n                \"note\": \"Requires authenticated API access for full search\",\n            })\n        return suspicious_profiles\n\n    def monitor_app_stores(self):\n        \"\"\"Check for fake mobile apps impersonating the brand.\"\"\"\n        fake_apps = []\n        for keyword in self.keywords:\n            # Google Play Store search (unofficial)\n            url = f\"https:\u002F\u002Fplay.google.com\u002Fstore\u002Fsearch?q={keyword}&c=apps\"\n            try:\n                resp = requests.get(url, timeout=15, headers={\n                    \"User-Agent\": \"Mozilla\u002F5.0\"\n                })\n                if resp.status_code == 200:\n                    # Parse results for brand name matches\n                    from bs4 import BeautifulSoup\n                    soup = BeautifulSoup(resp.text, \"html.parser\")\n                    app_links = soup.find_all(\"a\", href=lambda h: h and \"\u002Fstore\u002Fapps\u002Fdetails\" in h)\n                    for link in app_links:\n                        app_name = link.get_text(strip=True)\n                        if any(k.lower() in app_name.lower() for k in self.keywords):\n                            fake_apps.append({\n                                \"name\": app_name,\n                                \"url\": f\"https:\u002F\u002Fplay.google.com{link['href']}\",\n                                \"platform\": \"google_play\",\n                                \"keyword\": keyword,\n                            })\n            except Exception as e:\n                print(f\"[-] App store search error: {e}\")\n        return fake_apps\n\n    def generate_monitoring_report(self):\n        report = {\n            \"brand\": self.brand_name,\n            \"generated\": datetime.now().isoformat(),\n            \"total_findings\": len(self.findings),\n            \"findings_by_type\": {},\n            \"high_priority\": [],\n        }\n        for finding in self.findings:\n            ftype = finding[\"type\"]\n            if ftype not in report[\"findings_by_type\"]:\n                report[\"findings_by_type\"][ftype] = 0\n            report[\"findings_by_type\"][ftype] += 1\n\n            # High priority: has web similarity or MX records\n            if finding.get(\"ssdeep_score\", 0) > 50:\n                report[\"high_priority\"].append(finding)\n\n        with open(f\"brand_monitoring_{self.brand_name.lower()}.json\", \"w\") as f:\n            json.dump(report, f, indent=2)\n        print(f\"[+] Brand monitoring report: {len(self.findings)} findings\")\n        return report\n\nmonitor = BrandMonitor({\n    \"name\": \"MyCompany\",\n    \"domains\": [\"mycompany.com\", \"mycompany.org\"],\n    \"keywords\": [\"mycompany\", \"mybrand\", \"myproduct\"],\n    \"executives\": [\"CEO Name\", \"CTO Name\"],\n})\nmonitor.scan_domain_squatting()\nreport = monitor.generate_monitoring_report()\n```\n\n### Step 2: Takedown Request Generation\n\n```python\ndef generate_takedown_request(finding, brand_info):\n    \"\"\"Generate abuse report for domain\u002Fsite takedown.\"\"\"\n    request = f\"\"\"Subject: Abuse Report - Brand Impersonation \u002F Phishing\n\nDear Abuse Team,\n\nWe are writing to report a domain that is impersonating {brand_info['name']}\nfor apparent phishing\u002Ffraud purposes.\n\nInfringing Domain: {finding.get('indicator', '')}\nIP Address: {', '.join(finding.get('dns_a', ['Unknown']))}\nDetection Method: {finding.get('fuzzer', 'domain similarity analysis')}\nWeb Similarity Score: {finding.get('ssdeep_score', 'N\u002FA')}%\nDetection Date: {finding.get('detected_at', '')}\n\nOur legitimate domain(s): {', '.join(brand_info['domains'])}\n\nThis domain appears to be impersonating our brand through {finding.get('fuzzer', 'typosquatting')}.\nWe request immediate suspension of this domain.\n\nEvidence of infringement is available upon request.\n\nRegards,\n{brand_info['name']} Security Team\n\"\"\"\n    return request\n```\n\n## Validation Criteria\n\n- Domain squatting detected through dnstwist permutation scanning\n- Google Safe Browsing checks identify known threats\n- Certificate transparency monitoring detects new phishing certificates\n- Social media monitoring identifies impersonation profiles\n- App store monitoring detects counterfeit applications\n- Takedown requests generated with required evidence\n\n## References\n\n- [Netcraft: Brand Protection Platforms](https:\u002F\u002Fwww.netcraft.com\u002Fblog\u002F6-best-brand-protection-platforms-for-defending-your-company-s-online-reputation\u002F)\n- [Cyble: Brand Impersonation 2025](https:\u002F\u002Fcyble.com\u002Fknowledge-hub\u002Fbrand-impersonation-2025-threats-2026\u002F)\n- [Recorded Future: Brand Intelligence](https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fbrand-intelligence)\n- [NetDiligence: Domain Security and Phishing](https:\u002F\u002Fnetdiligence.com\u002Fblog\u002F2025\u002F12\u002Funderstanding-domain-security-brand-impersonation\u002F)\n- [Flare: Digital Brand Protection](https:\u002F\u002Fflare.io\u002Fglossary\u002Fdigital-brand-protection\u002F)\n- [dnstwist GitHub](https:\u002F\u002Fgithub.com\u002Felceef\u002Fdnstwist)\n",{"name":5,"tags":57,"author":59,"domain":43,"license":15,"version":60,"mitre_f3":61,"nist_csf":87,"subdomain":35,"description":7,"mitre_attack":92},[37,33,42,41,36,58,35],"brand-protection","mahipal","1.0",{"tactics":62,"version":65,"techniques":66},[40,63,39,64],"resource-development","stealth","1.1",[67,71,74,78,81,84],{"id":68,"name":69,"source":70,"tactic":63},"T1583.001","Acquire Infrastructure: Domains","attack",{"id":72,"name":73,"source":70,"tactic":63},"T1583.008","Acquire Infrastructure: Malvertising",{"id":75,"name":76,"source":77,"tactic":63},"F1020.002","Create Fake Materials: Fake Website","f3",{"id":79,"name":80,"source":70,"tactic":40},"T1593","Search Open Websites\u002FDomains",{"id":82,"name":83,"source":77,"tactic":39},"F1032","Impersonate Official",{"id":85,"name":86,"source":70,"tactic":64},"T1672","Email Spoofing",[88,89,90,91],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[93,94,79,95,96],"T1591","T1592","T1589","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-brand-monitoring-for-impersonation",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":108,"prompt":118,"zipAvailable":119},[109,112,115],{"tool":110,"command":111},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-brand-monitoring-for-impersonation",{"tool":113,"command":114},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-brand-monitoring-for-impersonation",{"tool":116,"command":117},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-brand-monitoring-for-impersonation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-brand-monitoring-for-impersonation\u002FSKILL.md",true,[121,126,130,136],{"path":122,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-brand-monitoring-for-impersonation\u002FLICENSE",{"path":127,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":128,"sourceHtmlUrl":129},"LICENSE.txt",143,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fseo-maps\u002FLICENSE.txt",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"references\u002Fapi-reference.md","REFERENCE","参考文档",4493,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-brand-monitoring-for-impersonation\u002Freferences\u002Fapi-reference.md",{"path":137,"resourceType":138,"resourceTypeDesc":139,"sizeBytes":140,"sourceHtmlUrl":141},"scripts\u002Fagent.py","SCRIPT","脚本",6795,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-brand-monitoring-for-impersonation\u002Fscripts\u002Fagent.py",[143,170,194,221,247,274],{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[149],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[151,152,153,154,155,43,156,157,158,159,160,161,162,163,164,165,166,167,168,169],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":177,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[176],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[178,166,179,180,155,181,43,158,182,183,184,185,186,187,188,189,190,191,192,193],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":204,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[200,203],{"categoryNo":201,"categoryName":202,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[188,205,206,207,208,43,50,209,182,210,211,212,213,214,215,216,217,218,219,220],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":228,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[227],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[229,230,231,43,232,233,234,235,236,237,238,239,240,241,242,243,185,244,245,246],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":248,"name":249,"nameZh":6,"description":250,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":251,"categories":252,"keywords":254,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[253],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[255,256,257,43,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":275,"name":276,"nameZh":6,"description":277,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":278,"categories":279,"keywords":281,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[280],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[155,282,43,283,284,285,286,287,288,289,290,216,291,217,292,293,294,295,296,297],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]