We tested every part on real systems before building it.
Eight tests, all run by us: the public certificate logs, 107,129 lookalike names, 1,991 page loads in locked boxes from three cities, 2,005 captures scanned for viruses, 200 altered copies of brand pages, and 480 controlled pages judged by Brandwarden AI. Here is what each one showed.
One small server keeps up with every public certificate log.
Every website that shows a padlock has a certificate, and every certificate is written into public logs. We built our own reader and pointed it at all of them.
Our own reader, on one small server in Cape Town, connected to 82 public logs run by 11 companies, counting every record for 32 minutes.
A new website using your name shows up as soon as its certificate is logged. Nobody has to report it first.
- Geomys18.0%
- Sectigo16.8%
- Google14.2%
- IPng Networks12.3%
- TrustAsia9.1%
- Let's Encrypt8.2%
- DigiCert7.5%
- Microsec6.1%
- HARICA3.9%
- Cloudflare3.7%
- GoDaddy0.3%
See the full numbers for test 1
| Log | Run by | Records |
|---|---|---|
| luoshu2027 | TrustAsia | 507,392 |
| tuscolo2027h1 | Geomys | 488,190 |
| selene2027h1 | HARICA | 454,120 |
| tuscolo2026h2 | Geomys | 444,547 |
| gouda2027h1 | IPng Networks | 394,752 |
| halloumi2027h1 | IPng Networks | 394,240 |
The six busiest of the 82 logs. Each log is a public, append only list of certificates.
| Run by | Records | Share |
|---|---|---|
| Geomys | 2,138,712 | 18.0% |
| Sectigo | 1,989,623 | 16.8% |
| 1,679,908 | 14.2% | |
| IPng Networks | 1,461,492 | 12.3% |
| TrustAsia | 1,084,808 | 9.1% |
| Let's Encrypt | 975,191 | 8.2% |
| DigiCert | 885,221 | 7.5% |
| Microsec | 718,221 | 6.1% |
| HARICA | 460,000 | 3.9% |
| Cloudflare | 436,378 | 3.7% |
| GoDaddy | 38,064 | 0.3% |
Counted by our server for the same run. Matches for the real brands we watched stay private.
107,129 lookalike names, checked in 45 minutes.
We made every common lookalike of ten brand names: look-alike letters, typing slips, added words like “verify”, and other web endings. Then we asked the internet's address book which ones exist.
Almost all of them don't. Of the ones that do, most are someone else's business, parked, or empty.
Our generator, plus 32 Nigerian scam words and 30 web endings. Each name was checked in DNS from Cape Town at 39.7 names a second, and every live one was opened once in a locked box (test 3).
Most lookalikes are noise. Brandwarden checks every one, so your team only looks at the few that matter.
- lookalike names made
- registered
- with a live web page
- copies of the brand
Bars are steps, not to scale.
- Empty or error page8
- Unrelated business3
- Parked or for sale1
Results for the five real brands we also watched stay private: we never publish a brand's results without its written permission.
See the full numbers for test 2
| Trick | Example | Names made |
|---|---|---|
| Look-alike letters | exarnp1ebank.com | 99,545 |
| Typing slips | exaplebank.com | 3,506 |
| Added words | examplebank-verify.com | 2,432 |
| Bit flips | exqmplebank.com | 773 |
| Other endings | examplebank.com.ng | 520 |
| Dots and dashes | exa-mplebank.com | 150 |
| Split names | ex.amplebank.com | 132 |
| Others | examsplebank.com | 71 |
All ten brands together. Look-alike letters make 93% of the names, so they are checked weekly and the cheaper tricks daily.
| Stand-in brand | Names | Registered | Live web page | Mail only |
|---|---|---|---|---|
| Example Bank | 5,623 | 7 | 2 | 2 |
| Example Pay | 4,242 | 7 | 3 | 6 |
| Example Mobile | 8,890 | 6 | 1 | 5 |
| Example Insure | 10,625 | 6 | 2 | 6 |
| Example Savings | 10,043 | 6 | 4 | 3 |
Every registered name but one came from split names, where the registered part belongs to an unrelated company. Mail only counts names that receive email, and a name can both host a page and receive email. 31 of the 107,129 names, 0.03%, got no answer from DNS.
1,991 page loads inside locked boxes. Not one keystroke.
We opened 300 known phishing pages, and every live lookalike from test 2, as a phone and as a computer, from Lagos, Ireland and Cape Town. Every page got a fresh locked box, destroyed straight after.
A fresh sandboxed browser for every page, with no passwords or cloud keys inside and no way into private networks. Every attempt to send data is cancelled before it leaves the box, and our own test server, built to try every kind of submission, received only page requests.
We can look at the worst pages on the internet without touching them, so neither your customers' details nor ours are ever at risk.
- ✓No typing, clicking or filling code anywhere in the capture code
- ✓Never submits a form, even when the page tries six ways on its own
- ✓No passwords or cloud keys inside the locked box
- ✓No way into private networks or the cloud's own services
- ✓Not fooled by names that point back inside our network
- ✓A fresh, empty browser for every page
- ✓Downloads cancelled, including a test virus
- ✓Endless loops, memory bombs and huge pages stopped safely
- ✓“Checking your browser” pages recorded, never answered
- ✓Our own page that hides from foreign visitors was caught from Lagos
- ✓The browser's own sandbox stayed on in every one of the 1,991 loads
See the full numbers for test 3
| Safety test | What happened |
|---|---|
| Never types or clicks | A check of the capture code found no typing, clicking, pressing, filling or file picking. |
| Never submits a form | Our test login tried to submit on its own six ways: on load, on a timer, by fetch, by XMLHttpRequest, by beacon and by an automatic form. Our server received page requests only. |
| No keys inside | A probe started like every capture found no cloud keys, no credential files and no route to the cloud's own metadata service. |
| No way into private networks | Private addresses, the host itself and the network's resolver were unreachable. The filter dropped 38 attempts during the safety jobs. |
| Not fooled by pointing names inward | Names set up to resolve to private addresses got no answer. |
| A fresh browser every time | Cookies, local storage, a database and a service worker set by one page were gone for the next. |
| Downloads cancelled | A test virus and a 100 MB file were both cancelled; at most 2.9 MB of the large file left the server first. |
| Bad pages stopped safely | An endless loop was stopped at about 81 seconds, a memory bomb crashed only its own tab, a redirect loop ended in an error and a 400,000 element page loaded. Every next job ran normally. |
| “Checking your browser” pages | Recorded as blocked, with no interaction. |
| Hidden traps caught | Our page that shows a fake login only to phones in Lagos showed it to the Lagos phone capture and to no other. |
| The browser's own sandbox | Stayed on inside the locked box in all 1,991 loads. |
The locked box: a fresh container for every page, destroyed afterwards, with a read only system, 2 GB of memory, 1.5 processors, at most 512 processes, no administrator rights and no cloud keys. Anything still running at 90 seconds is stopped. No capture ever needed that.
Most phishing pages die within hours. Some carry viruses.
Of the 200 newest phishing pages confirmed by PhishTank, only 77 still loaded from any of our cities. Of the 88 live phishing pages we captured, 7 served files our virus scanner flagged as malware, inside the page itself.
24 of the 88 sat on free website and app builders; the rest used their own web addresses.
Every capture was scanned for viruses before anyone could open it: 2,005 captures, 42 flagged and kept in quarantine. The same page was compared across cities, as a phone and as a computer.
Speed matters, so Brandwarden captures a page the moment it finds it, and treats every file as dangerous until it is scanned.
- Lagos600 loads · 9.6 s typical, 19.6 s slowest 5%
- Ireland600 loads · 12.1 s typical, 26.2 s slowest 5%
- Cape Town401 loads · 14.2 s typical, 35.3 s slowest 5%
No live phishing page looked different between our three cities. Our own test page that shows its trap only to phones in Lagos was caught from Lagos and hidden everywhere else, so the check works.
See the full numbers for test 3
| City and list | Loads | Live pages | Live pages captured | Challenge pages | Typical, slowest 5% |
|---|---|---|---|---|---|
| Lagos, PhishTank | 400 | 77 of 200 | 92.9% | 5.0% | 10.5 s, 23.1 s |
| Ireland, PhishTank | 400 | 77 of 200 | 95.5% | 5.0% | 12.7 s, 27.0 s |
| Cape Town, PhishTank | 400 | 77 of 200 | 94.8% | 5.0% | 14.2 s, 35.5 s |
| Lagos, public research set | 200 | 11 of 100 | 100% | 3.0% | 8.6 s, 14.7 s |
| Ireland, public research set | 200 | 11 of 100 | 100% | 3.5% | 11.0 s, 17.8 s |
Each address was loaded as a phone and as a computer, with Nigerian English and Lagos time. Every city beat our 85% target. 29 phishing loads and 22 lookalike loads hit the 45 second page limit; none had to be stopped at 90 seconds.
| Cities compared | Page pairs live in both | Same title | Same final address | Text far apart | Login form in only one |
|---|---|---|---|---|---|
| Lagos and Ireland | 163 | 100% | 100% | 1.8% | 0 |
| Lagos and Cape Town | 140 | 100% | 100% | 2.9% | 0 |
| Ireland and Cape Town | 143 | 100% | 100% | 2.8% | 0 |
No live phishing page in this sample hid its trap from one city. All three cities share one cloud network, and most of this sample imitated global brands, so pages aimed at Nigerian customers may behave differently.
- Between 34% and 40% of phishing loads tried to send something on their own, without any input.
- Malware flags came from at least 9 pages. Downloads were blocked, so the malware sat in the pages themselves.
- 24 of the 88 live phishing pages sat on 9 different free website and app builders; 64 used their own web addresses.
- Registrars were spread thin: the most common one held 7 of the phishing domains, and 18 domains gave no registration answer.
Simple page checks already tell phishing from real pages.
Pick one phishing page and one real page at random. Our page checks mark the phishing page as the more suspicious one 98.6% of the time.
Page features we compute ourselves, tested on a public set of phishing and real pages that we did not train on.
Brandwarden AI starts from checks that already work, then adds your logo and what the page asks for on top.
See the full numbers for test 4
| Checks used | How many | Score out of 1 |
|---|---|---|
| Everything we compute ourselves | 25 | 0.986 |
| Only what our own page fetch sees | 12 | 0.952 |
| Only the certificate, DNS and registration | 4 | 0.906 |
| Only the web address | 9 | 0.815 |
| Only outside rankings and blocklists | 5 | 0.745 |
Public Phishing Websites set, 5,849 unique pages after removing duplicates. The 0.986 held at 0.978 to 0.988 on five other splits. Outside rankings add only 0.006 on top of our own checks.
- The strongest signals were the state of the page's certificate (47% of the weight) and the share of links that leave the site (24%).
- From a web address's name alone, general checks scored 0.87 to 0.91 on 235,370 public addresses. So how close a name is to your brand has to do most of the work, which is what Lookalike Finder does.
- One public set could be split almost perfectly by three yes or no questions about the address, because every real page in it was a bare home page. A score is only as honest as the data behind it, so we report the numbers above.
The logo gives the fake away.
We made 200 altered copies of brand pages: resized, recoloured, blurred, cropped, in dark mode and with warning banners. From the logo alone, Brandwarden AI named the right brand first for 99% of them. From the whole page, only 85.5% to 91%.
Dark mode or a warning banner was enough to hide a copy from whole page matching.
Logos cut from each copy and compared with every brand's own logo files; whole pages compared with every brand's own pages. Every brand in this test is a stand-in.
Scammers change colours and layouts, but they need your logo to fool your customers. That is where Brandwarden looks first.
- From the logo alone99%
- From the whole page85.5 to 91%
The logo on our fake Example Bank login scored 0.854 for Example Bank, ahead of every other brand.
Example Bank stands in for your brand.
See the full numbers for test 5
| What we compared | Method | Right brand first | Caught at our strict setting | False matches |
|---|---|---|---|---|
| The logo | Brandwarden AI | 94.5% to 99.0% | 54.0% to 76.5% | 0% to 2.8% |
| The logo | Simple image fingerprints | 63.5% to 92.5% | 8.0% to 55.0% | 0% to 4.4% |
| The whole page | Brandwarden AI | 85.5% to 91.0% | 22.5% to 29.5% | 0% to 1.6% |
| The whole page | Simple image fingerprints | 46.0% to 55.0% | 0% to 11.5% | 0% to 0.4% |
Ranges cover the versions we tried. The strict setting keeps false alarms rare, so it catches fewer copies than ranking does. Every false match came from another stand-in brand on the same page layout.
| Copies | How many | Caught from the logo | Caught from the whole page |
|---|---|---|---|
| Easy | 80 | 86% | 59% |
| Medium | 84 | 67% | 13% |
| Hard | 36 | 50% | 3% |
Caught at the strict setting. From the logo: 76% of computer screen copies and 63% of phone screen copies.
- The hardest changes for the logo were heavy JPEG compression (42% caught), a different font in the wordmark (45%) and the icon without the name (49%). Missed copies usually still ranked the right brand first.
- Dark mode or a warning banner hid every copy from whole page matching.
- Speed: 68 ms to 1.16 s a page on a busy laptop processor, far inside our 30 second budget. Simple fingerprints take 1 to 3 ms.
Where a fake gets reported, and the proof each place wants.
Every registry, web host, browser and app has its own reporting route and its own rules for proof. We read each one's own pages and wrote down what it asks for.
Then we looked at who carried the 88 live phishing pages from test 3, and mapped the abuse routes of the 18 that carried the most.
Read from each place's official reporting pages and forms, with nothing submitted and no account created. Brandwarden has no partnership with any of them.
A report goes first to whoever can remove the page fastest, carries the right proof the first time, and is approved by one of our analysts before it is sent.
- Step 1The platform24 of 88
sat on free website and app builders, which can remove a page inside their own service
- Step 2The web host64 of 88
used their own web address, so the host's network is next
- Step 3The registrar18 domains
gave no registration answer, so the host and the registry take over
Only 2 of the 8 routes we read say how fast they act, and some give no ticket at all. So Brandwarden rechecks every reported page until it is down.
- NiRA.ng registry abuse portal
Asks for up to three evidence files of 3 MB each; says it investigates within one business day
- CloudflareProxy and CDN
Shows visitors a warning page and forwards the report to the host
- GoogleBrowser blocklist
Manual phishing report form
- MicrosoftBrowser blocklist
Report form with a CAPTCHA, so a person files it
- MetaFacebook, Instagram, WhatsApp
Impostor forms and IP reports; IP reports usually handled within a day
- TelegramMessaging
Takedown requests by email with links to the content
See the full numbers for test 6
| Route | How a report is made | Who files it | Stated response time |
|---|---|---|---|
| NiRA abuse portal (.ng) | Web form with evidence files, at most three of 3 MB each; a reference number is given | An analyst | Investigated within one business day; active phishing usually escalated within 24 to 48 hours |
| NiRA dispute policy | Written complaint on paper and by email; expert fee ₦100,000 plus VAT | The brand owner | No takedown time; the name holder has 20 days to answer |
| Cloudflare | Web form; an API for some accounts | An analyst | Not stated |
| Google browser blocklist | Manual form; its reporting API is closed to new users | An analyst | Not stated; no ticket |
| Microsoft browser blocklist | Web form with a CAPTCHA, up to 100 addresses at once | An analyst, because we never solve CAPTCHAs | Not stated; no ticket |
| Facebook and Instagram | Impostor forms; a brand protection programme for trademark owners; an API for IP claims by application | An analyst, or the brand's own programme access | IP reports usually within a day; impersonation not stated |
| Scam reports inside the app; a web form for trademark claims | In the app | Not stated | |
| Telegram | Email to its abuse address with links; a form for EU illegal content; a scam report account in the app | An analyst, by email | Not stated |
Read from each route's own pages. Nothing was submitted, no account was created and nobody signed in.
- Cloudflare usually shows a warning page rather than removing a site, and forwards the report to the host, which still has to remove it.
- NiRA will not take a report without evidence files: at most three, of 3 MB each. Our capture of the fake Example Bank login is 185 KB.
- WhatsApp and Telegram scam reports need an account inside the app.
- Telegram may stop acting on a reporter who sends unfounded reports, which is one more reason our analysts approve every request.
From Lagos, a Nigerian server answers in 16 ms.
We ran a server in a Lagos data centre and timed it against Cape Town. We also scanned 200 test files for viruses before use, 10 of them harmless test viruses.
Round trips timed to the same server hosted in Nigeria, from Lagos and from Cape Town. The scan ran on every file before any program could open it.
We see pages the way your customers in Nigeria see them, and nothing from a fake page is opened before it is scanned.
- From Lagos15.9 ms
- From Cape Town74.8 ms
See the full numbers for test 7
| Nigerian websites | How many | Typical from Lagos | Typical from Cape Town |
|---|---|---|---|
| Hosted in Nigeria | 7 | 101 ms | 235 ms |
| Served from global networks | 11 | 92 ms | 1.8 ms |
| Did not answer | 2 |
Round trips to 20 well known Nigerian websites. Sites hosted in Nigeria answered faster from Lagos; sites on global networks answered faster from Cape Town. The fastest Nigeria-hosted site answered in 15.9 ms from Lagos and 74.8 ms from Cape Town.
- Our Lagos server's address shows as Lagos, Nigeria in the cloud's own location feed and in IPinfo's database.
- 1,000 of 1,000 one megabyte captures uploaded from Lagos to our storage in 109 seconds.
- Virus scan: 190 clean files all came back clean, typically in 65 s, 95% within 137 s and all within 139 s. 5 test viruses, and 5 more hidden inside zip files, were all caught within 19 s.
IP address data powered by IPinfo.
Can Brandwarden AI tell a fake from an honest page that shows your logo?
Honest pages show your logo too: news stories, reviews, comparison tables, shop checkouts and your own login page. A logo match alone cannot tell them from a fake, so Brandwarden AI weighs it together with what the page asks for, how it pressures the visitor and which web address it sits on.
We tested that on 480 controlled pages from 8 stand-in brands such as Example Bank. The risk model learned from four brands, then judged the other four, which it had never seen.
480 controlled pages, built by us and served only to a browser on our own machine, with every other request refused: 8 stand-in brands, 15 kinds of page each, 4 versions of each kind, on computer and phone. 5 kinds are fakes and 7 are honest pages, 5 of them showing the brand's logo. The other 3 kinds are pages too empty to judge, or hidden behind a “checking your browser” wall. The risk model learned from four brands and was scored on the other four. Then we swapped the two groups and did it again.
An alert from Brandwarden AI is worth a person's time. On brands it had never seen, no honest page showing your logo raised one, and a fake it was unsure about went to a person, never to “Likely legitimate”.
A fake below the alert line is marked Not enough evidence, which sends it to a person.
- New kinds of honest page. On page kinds it never saw, 60.0% of 40 alerts were fakes and 75.0% of 32 fakes alerted, because all 16 similar-name businesses were flagged. So each new kind of honest page needs labelled examples first.
- A score is a ranking, not a chance. Scores put pages in the right order, but a score of 0.9 does not mean a 9 in 10 chance that the page is fake. The calibration error, which measures how far scores sit from true chances, was 0.072 to 0.096 on unseen brands.
- Brandwarden AI100.0% of 74
- Logo match alone38.9% of 131
- Brandwarden AI0 of 80
- Logo match alone98.8% of 80
A copied logo does not show intent. On its own, the logo match flagged nearly every honest page that shows the logo, and fewer than half its flags were fakes.
- 1A stand-in brand with its logo
Example Bank, added with its logo and its own web address.
- 2A controlled fake BVN page
A fake page built by us, on a lookalike address, that asks for a BVN and an OTP.
- 3An analysis that said Suspicious
Score 0.894 and logo match 0.974. The versions of the engine, the risk model and the logo match were recorded with it.
- 4A saved decision
An analyst confirmed it as a fake. The decision was saved with who made it, when, and the version of the evidence.
- 5The queue and the reports agree
Both lists show the same case, and its report cannot be sent without approval.
- 6An evidence package
7 files, and every file matches its fingerprint (its hash).
- 7Reopened unchanged
Opened again later, the case and the evidence package came back exactly the same.
- A new analysis records its versions and the signals behind it
- Analysing the case again adds a row and keeps the first
- The decision is saved with the analyst, the time and the evidence version
- The queue and the report list agree
- A report cannot be sent without approval
- Every file in the package matches its fingerprint
- The evidence version matches the one in the decision
- The reopened case is unchanged
- The reopened package is identical
- The log of every action checks out from start to end
See the full numbers for test 8
| What we counted | Unseen brands, A | Unseen brands, B | Unseen brands and page kinds, A | Unseen brands and page kinds, B |
|---|---|---|---|---|
| Pages to learn from, to test on | 240, 240 | 240, 240 | 160, 128 | 160, 128 |
| Ranking score out of 1 | 0.998 | 1.000 | 0.930 | 0.833 |
| Alerts that are fakes | 100.0% of 74 | 97.5% of 81 | 60.0% of 40 | 60.0% of 40 |
| Fakes alerted | 92.5% of 80 | 98.8% of 80 | 75.0% of 32 | 75.0% of 32 |
| Honest pages showing the logo alerted | 0.0% of 80 | 0.0% of 80 | 0.0% of 32 | 0.0% of 32 |
| Honest pages called Likely legitimate | 82.1% of 112 | 76.8% of 112 | 66.7% of 48 | 66.7% of 48 |
| Outcome as expected | 89.2% of 240 | 88.8% of 240 | 81.2% of 128 | 81.2% of 128 |
| Calibration error (lower is better) | 0.072 | 0.096 | 0.211 | 0.291 |
Every brand's pages sit on one side only. In A the risk model learned from four brands and was tested on the other four, and B swaps the two groups. The last two columns also hold back five kinds of page it never saw: reward pages, fakes on neutral addresses, review pages, comparison tables and similar-name businesses. An alert is a page marked Suspicious. Ranking score: 0.5 is a coin toss, 1 is never wrong. In no split was a fake called Likely legitimate: fakes below the alert line were marked Not enough evidence, which sends them to a person.
| Test pages | Rule | Fakes flagged | Honest pages showing the logo flagged | All honest pages flagged | Flags that are fakes |
|---|---|---|---|---|---|
| Unseen brands, A | Brandwarden AI risk model v0 | 92.5% of 80 | 0.0% of 80 | See the first table | 100.0% of 74 |
| Unseen brands, A | Logo match alone | 63.7% of 80 | 98.8% of 80 | 71.4% of 112 | 38.9% of 131 |
| Unseen brands, A | Asks for a secret alone | 100.0% of 80 | 20.0% of 80 | 42.9% of 112 | 62.5% of 128 |
| Unseen brands and page kinds, A | Brandwarden AI risk model v0 | 75.0% of 32 | 0.0% of 32 | See the first table | 60.0% of 40 |
| Unseen brands and page kinds, A | Logo match alone | 87.5% of 32 | 100.0% of 32 | 70.8% of 48 | 45.2% of 62 |
| Unseen brands and page kinds, A | Asks for a secret alone | 100.0% of 32 | 0.0% of 32 | 33.3% of 48 | 66.7% of 48 |
A copied logo does not show intent. On its own, the logo match flagged nearly every honest page that shows the logo, and fewer than half its flags were fakes. Asking for a secret alone flagged every fake, but honest pages that ask for a secret were flagged too.
| Page kind | Suspicious | Likely legitimate | Not enough evidence | Could not see the page |
|---|---|---|---|---|
| Fake BVN and OTP update | 16 | 0 | 0 | 0 |
| Fake reward asking for card details | 16 | 0 | 0 | 0 |
| Fake login, name but no logo | 16 | 0 | 0 | 0 |
| Fake login, lookalike address | 14 | 0 | 2 | 0 |
| Fake login, neutral address | 12 | 0 | 4 | 0 |
| News article showing the logo | 0 | 16 | 0 | 0 |
| Shop checkout, “pay with” button | 0 | 16 | 0 | 0 |
| Customer reviews | 0 | 16 | 0 | 0 |
| Comparison table | 0 | 16 | 0 | 0 |
| The brand's own login | 0 | 16 | 0 | 0 |
| Similar-name business with its own login | 0 | 8 | 8 | 0 |
| Another bank, same layout | 0 | 4 | 12 | 0 |
| Parked lookalike address | 0 | 0 | 16 | 0 |
| Empty lookalike page | 0 | 0 | 16 | 0 |
| Behind a “checking your browser” wall | 0 | 0 | 0 | 16 |
Unseen brands, split A, with the weights Brandwarden AI ships with. Each kind has 16 pages: 4 brands, 4 versions each, on computer and phone. No fake is in the Likely legitimate column. A page marked Not enough evidence goes to a person.
- 97.5% of 81 alerts were fakes. 98.8% of 80 fakes alerted. 0.0% of 80 honest pages showing the logo alerted.
| Signal | Weight | Effect on the score |
|---|---|---|
| Pressure phrases | +2.405 | Raises it |
| Asks for a BVN, OTP, PIN or card details | +2.179 | Raises it |
| Asks for any secret | +1.362 | Raises it |
| Words common in fakes in the address | +1.296 | Raises it |
| Address similar to the brand's | +0.552 | Raises it |
| The brand's name in the address | +0.426 | Raises it |
| Logo similarity | +0.286 | Raises it |
| Free hosting platform | +0.218 | Raises it |
| Names the brand in full | +0.071 | Raises it |
| Reads like news, reviews, a comparison or a checkout | 0.000 | None |
| Links to the brand's own site | -0.399 | Lowers it |
| Names other organisations | -0.475 | Lowers it |
| The brand's own address | -0.614 | Lowers it |
Learned from four of the 8 stand-in brands and tested on the other four. Starting point: -3.124. A score of 0.274 or more raises an alert. A score below 0.211 can be called Likely legitimate, unless the page shows the brand's logo and asks for a secret away from the brand's own address. The band in between always goes to a person.
- The logo counts for little once honest pages are in the set. Honest pages show the logo too, so what tells a fake apart is what it asks for, how it pressures the visitor and where it lives. The logo still ties a page to the brand, and its box shows the analyst where the copy is.
- New kinds of honest page are the real risk. Without a similar-name business among the pages it learned from, all 16 such pages were flagged and alerts that were fakes fell to 60.0%. With them among those pages, none were.
- The first round of learning exposed two mistakes in our own code, now fixed: a shared word counted as naming the brand, and the alert line sat just above the highest honest page. Fixing them raised alerts that were fakes on unseen brands, split A, from 90.6% to 100.0%.
- One fake login was first called Likely legitimate. It was a plain copy of a brand's login on a lookalike address: the logo (0.82), a username and a password, a link to the real help page and no pressure phrases. A floor rule now sends such a page to a person.
Every capture gets a fingerprint.
Change one pixel and the fingerprint changes. When we report a fake, the fingerprint shows our proof has not been touched. Your browser is checking one of our captures right now.
See who is copying your brand.
Tell us your brand name and we will show you the lookalike web addresses that already exist for it, and what is on them.
hello@brandwarden.cloud