How Brandwarden AI works.
Brandwarden catches a fake in 8 steps, in the order below. For each step you can read what it looks at, the one question it answers, what happens next, and the number we measured, with the test it came from. Brandwarden AI is the part that judges a page: the page checker and Logo Match. The other steps find the page, open it safely and send the report, and a person decides what gets reported.
- 01New Site Watch
Reads every new padlock certificate as it is posted.
- 02Lookalike Finder
Lists the lookalikes of your name and checks which ones exist.
- 03Locked box capture
Opens the page safely and saves what it shows.
- 04AIPage checker
Scores how suspicious the way the page is built looks.
- 05AILogo Match
Names whose logo the page is wearing.
- 06Fingerprint
Gives the capture a code that shows it has not changed.
- 07AnalystAnalyst approval
Our analysts check the proof and approve every takedown request.
- 08Report Routes
Sends the report to the place that can take the page down.
Example Bank, Example Pay and Example Mobile are stand-ins for real brands. examplebank-verify.com is a name our Lookalike Finder made from Example Bank. The split name rule drops a name when the part of it that is actually registered is not close to your brand.
It reads every new padlock certificate as it is posted.
Every website that shows a padlock has a certificate, and every certificate is written into public logs, like guest books anyone can read. Brandwarden reads those logs as they grow, so a new website that uses your name shows up without anyone having to report it.
Has a new website just appeared with a name that looks like mine?
- The web address on each new certificate.
- Your brand's name, and the words scammers add to it, like verify or secure.
- Nothing else. It reads public records and never visits the website.
A name that matches goes on to the Lookalike Finder's checks and, if it is worth a look, to the locked box in step 03.
certificate records read in the first 32 minutes, 5,213 a second on average, from 82 public logs run by 11 companies
- your brand's name
- a word scammers add to it
- Geomys18.0%
- Sectigo16.8%
- Google14.2%
- IPng Networks12.3%
- TrustAsia9.1%
- Let's Encrypt8.2%
- DigiCert7.5%
- Microsec6.1%
- HARICA3.9%
- Cloudflare3.7%
- GoDaddy0.3%
It lists every lookalike of your name, then checks which ones exist.
A scammer needs only one changed letter. So Brandwarden writes down every common lookalike of your web address first, then asks the internet's address book (called DNS) which of them exist, which have a website and which only receive email.
Which names that look like mine exist right now?
- Your web address, letter by letter: look-alike letters, typing slips, bit flips and other endings.
- Words your customers trust, added to your name, like verify.
- The address book's answer for each name: not registered, registered, live website, or mail only.
- For a name split by a dot, whether the part that is really registered is close to your brand or belongs to an unrelated company.
Names that do not exist are set aside. Split names whose registered part is not close to your brand are dropped by rule. What is left is opened safely in step 03.
lookalike names made and checked for 10 brands in 45 minutes, 39.7 names a second
- names made from examplebank.com
- registered, so they exist
- dropped by the split name rule: the registered part is not close to the brand
- kept and checked from Ireland: error or empty page, not a copy, closed
Bars are steps, not to scale.
- Look-alike letters5,184rn for m, 1 for l, and letters from other alphabetsexarnp1ebank.com
- Typing slips211a letter missing, doubled, swapped or addedexaplebank.com
- Extra words128a trusted word added to your nameexamplebank-verify.com
- Bit flips49a letter one computer bit awayexqmplebank.com
- Other endings29the same name on another endingexamplebank.com.ng
- Dots and dashes19a dot or dash inside the nameexa-mplebank.com
- Others3plurals and mixed tricksexamsplebank.com
It opens the page in a locked box and only looks.
A fake page is not safe to open on a normal computer. So every page opens in its own fresh locked box, as a phone and as a computer, from 3 places: Lagos, Ireland and Cape Town. The box is destroyed straight after, and every file is scanned for viruses before anyone opens it.
What does this page show a customer in Nigeria, and what does it ask for?
- The page as a customer sees it: a picture of the screen, the words, and the boxes it asks you to fill in.
- What the page tries to do on its own, like sending data or jumping to another page.
- Whether it shows something different to visitors from different places.
- Every file it hands over, scanned by our virus scanner first.
The picture, the words and the fields it asks for are saved together as one capture and handed to the page checker and Logo Match.
page loads in locked boxes from 3 places, with 0 keystrokes typed, 0 forms submitted and 0 logins
What the box saves from our fake Example Bank login: the picture, the words and the 4 fields it asks for.
It never types into them.
The page checker scores how suspicious the page looks.
Phishing pages leave clues in how they are built, not only in how they look. The page checker (part of Brandwarden AI) adds up many small clues from the capture into one score.
Does this page behave more like a phishing page or a real one?
- The page's padlock certificate: how it is set up.
- How many of the page's links lead away from the website.
- Where the form sends what you type.
- Hidden frames, pop-ups and a switched-off right click.
- The web address itself: how long it is and what is added to it.
The score is saved with the capture, for the person who reviews it.
score out of 1 at telling phishing pages from real ones. Pick one of each at random and the checker marks the phishing page as more suspicious 98.6% of the time
- Certificate set up oddly
- Most links leave the website
- Form sends data somewhere else
- Certificate in order
- Links stay on the website
- Form stays on the website
- Everything we compute ourselves (25)0.986
- Only what our own page fetch sees (12)0.952
- Only the certificate, DNS and registration (4)0.906
- Only the web address (9)0.815
- Only outside rankings and blocklists (5)0.745
The strongest signals were the state of the page's certificate (47% of the weight) and the share of links that leave the site (24%).
Logo Match checks whose logo the page is wearing.
Scammers can change a page's colours and layout, but they need your logo to fool your customers. So Brandwarden AI cuts the logo out of the capture and compares it with each brand's own logo files.
Whose logo is this?
- The logo on the page, cut out of the screen picture.
- Each brand's own logo files: full colour, reversed for dark backgrounds, the symbol alone and the name alone.
- The whole page, only as a second opinion, because pages built on the same layout look alike.
The best match and its score are saved with the capture, and the logo's place on the picture is marked. A page that wears a brand's logo and asks for a BVN (a bank verification number) stands out.
of 200 altered copies of brand pages had the right brand ranked first from the logo alone. From the whole page: 85.5% to 91.0%
- Example Bank0.854
- Example Pay0.784
- Example Mobile0.738
One real run: the logo on our fake login scored 0.854 for Example Bank, ahead of every other brand. Example Bank stands in for your brand.
- From the logo alone99%
- From the whole page85.5 to 91.0%
The whole page never names a brand on its own: every false match in this test came from another stand-in brand built on the same page layout.
Every capture gets a fingerprint.
A fingerprint is a short code worked out from a file. The same file always gives the same code, and changing even one byte changes the code completely. Brandwarden stamps each capture with one when it is saved, so if the file were ever changed, the code would no longer match.
Is this the same file we captured, unchanged?
- The capture file itself, every byte of it.
The fingerprint is stored with the capture and shown beside it in the console, so anyone can check that the evidence is the same file.
The Example Bank capture's fingerprint, worked out again in your browser, matches the one saved when it was captured. Run the check yourself.
64 characters. Change one byte of the picture and every one of them changes.
- Saved at capture33d3973dc4e9eeef…
- Worked out again33d3973dc4e9eeef…
- ResultMATCH, not one byte changed
What Brandwarden AI never decides alone.
The AI does the looking: it judges how the page is built and whose logo it wears, and weighs both with what the page asks for. How well it does that, and where it falls short, is test 8. The decision stays with our analysts.
- 01Whether a report goes out.
A person looks at the picture and the proof, then approves every report. The AI does not press send.
- 02Whose name we act for.
Only for a brand that has asked us in writing, and only after a person has checked the proof.
- 03Typing, clicking or logging in.
Never. The locked box only looks: 0 keystrokes, 0 forms submitted and 0 logins in 1,991 page loads (test 3).
- 04Beating a “prove you are human” check.
If a page blocks us, we write down that it was blocked. Microsoft's report form asks for this check (a CAPTCHA), so a person files it (test 6).
Telegram may stop acting on a reporter who sends unfounded reports, which is one more reason our analysts approve every request.
Report Routes knows where each fake gets reported, and what proof they want.
A fake page is taken down by someone else: the web host, the company that sold the web address, a browser's warning list or an app. Each has its own form and its own rules for proof. Brandwarden read each one's own pages and wrote down what it asks for.
Who can take this page down fastest, and what do they need to see?
- Who carries the page: a free website builder, or a web host on the page's own web address.
- Who sold the web address, and who runs its registry, the body that keeps the list of every address with the same ending, like .ng.
- The proof each place asks for, and how big the files may be.
- Whether the form needs a person, like a “prove you are human” check.
The report pack is built to that place's rules and waits for a person's approval (step 07). Then it goes to the place that can remove the page.
live phishing pages from test 3 traced to who carried them. Only 2 of the 8 reporting routes we read say how fast they act
- 24 sat on free website and app builders, which can remove a page inside their own service
- 64 used their own web address, so the host and the registrar come next
We mapped the reporting routes of the 18 providers that carried the most.
- NiRA.ng registry abuse portal
Asks for up to three evidence files of 3 MB each; says it investigates within one business day
- CloudflareA service that sits in front of websites
Shows visitors a warning page and forwards the report to the host
- GoogleBrowser blocklist
Manual phishing report form
- MicrosoftBrowser blocklist
Report form with a “prove you are human” check (a CAPTCHA), so a person files it
- MetaFacebook, Instagram, WhatsApp
Impostor forms, and intellectual property reports for copied logos and names, which are usually handled within a day
- TelegramMessaging
Takedown requests by email with links to the content
NiRA will not take a report without evidence files: at most three, of 3 MB each. Our capture of the fake Example Bank login is 185 KB.
Every number here comes from a test we ran.
Each test has its own page on the proof page, with the full tables and how we ran it. Results for the real brands we watched stay private. Every brand shown here is a stand-in.
- Test 1 · Watch11,872,615certificate records read
- Test 2 · Find107,129lookalike names made and checked
- Test 3 · Look safely1,991page loads in locked boxes
- Test 4 · Spot0.986score out of 1 for the page checker
- Test 5 · Match99%right brand first from the logo alone
- Test 6 · Report8reporting routes read
- Test 7 · Lagos10 of 10test viruses caught before use
- Test 8 · Decide74 of 74alerts were fakes, on brands it had never seen
- Every test
Every table, every safety test and how each one was run.
See who is copying your brand.
Tell us your brand name and we will show you the lookalike web addresses that already exist for it, and what is on them.
hello@brandwarden.cloud