What Is Brand Protection?

Introduction

Brand protection is the work of stopping other people from misusing your company's name, logo, domains, and identity online. It spans legal enforcement, marketplace monitoring, social media takedowns, and domain-level detection.

This guide covers one part of that: the domain layer. Specifically, how registration, DNS, and certificate records expose an impersonation attempt before it reaches your customers, and how to read those records when one appears.

You will learn how WHOIS and DNS records expose the ownership and history behind a domain, how to pivot from a single lookalike registration to the wider set of domains behind it, and how newly registered domain feeds surface an impersonation attempt while it is still being set up rather than after the first email lands.

The later chapters move from background to method: detecting lookalike and typosquatted domains registered against your brand, and the workflow analysts run when an executive impersonation attempt arrives.

The Four Ways a Brand Gets Attacked Online

Brand attacks fall into four categories. They need different defences, and only one of them is fully visible in domain data.

Counterfeiting. Fake goods sold under your name, usually on marketplaces. Detected by marketplace monitoring and test purchasing, not by domain records.

Domain impersonation. Lookalike domains registered to resemble yours, used for phishing, credential harvesting, or invoice fraud. This is the category domain data catches, and catches early, because a registration is visible the day it happens.

Identity impersonation. Fake social profiles, spoofed executive emails, fraudulent support accounts. Partly visible in domain data when the attacker needs a sending domain, which they usually do.

Intellectual property infringement. Unauthorised use of trademarks, logos, and copy. A legal matter first, a detection matter second.

The middle two are where registration records earn their place, and they are what the chapters below cover. The first and fourth are named here for completeness, and they need tools this guide does not discuss.

Where Domain Data Fits in Brand Protection

Most brand protection coverage starts at the takedown. A fake site is found, a notice is sent, the site comes down, and the attacker registers another one that afternoon.

Domain data moves the detection earlier. Every impersonation attempt that uses a web address needs a domain, and that domain has to be registered before it can host anything. The registration is a public record from the moment it exists.

That gives three signals no marketplace scan or social monitor produces:

Registration date. A domain resembling your brand that was created this week is a different proposition from one created six years ago. Age alone resolves most triage decisions.

Registrant and nameserver. Attackers register in batches and reuse infrastructure. One confirmed lookalike leads to the rest of the batch through the fields it shares with them.

Certificate issuance. A lookalike domain that has just obtained a TLS certificate is being prepared for use. Issuance is often the last step before a campaign goes live, and it is publicly logged.

None of this replaces marketplace monitoring or legal enforcement. It sits underneath them, and it is the only layer that produces a signal before the attack reaches anyone.

Why Domain Data Matters in an Investigation

Almost every phishing campaign, malware distribution network, and business email compromise attempt starts with a domain. Someone registers it, points DNS at hosting, and issues a certificate. Each of those steps leaves a record, and those records are what domain intelligence reads. If you have never examined one, run a WHOIS lookup on any domain and read the fields before going further.

That matters because the records exist before the attack does. A lookalike domain registered against your brand is visible at registration, days or weeks before the first email goes out. An analyst who is monitoring registration feeds sees it then. An analyst who is only reading email headers sees it after the first user clicks.

The records also connect. A single malicious domain shares a registrant email, a nameserver, an IP block, or a certificate with others in the same operation. Pivoting on any one of those fields turns one indicator into the full set of infrastructure behind it, which is the difference between blocking one domain and blocking a campaign.

The chapters that follow work through each of those data types in the order an investigation actually uses them. Running these checks by hand works for a single domain. Across a portfolio on a daily schedule, domain monitoring replaces the manual pass with scheduled checks and alerting.

What You Need Before You Start

Nothing in this guide requires a paid account or a security platform. Every check described across the four chapters runs against publicly available records, and the tools that return them are linked at the point each check appears.

What it does require is knowing which record answers which question. Registration records tell you who created a domain and when. DNS records tell you where it points and whether it is live. Certificate records tell you whether someone has prepared it to look legitimate in a browser. Most failed investigations come from reaching for the wrong one, not from lacking access.

A worked example makes the distinction concrete. An employee reports a suspicious invoice email from a supplier domain that looks almost right. Registration data answers whether that domain was created last week or eight years ago. DNS data answers whether it has mail records configured, which separates a domain built to receive replies from one built to serve a phishing page. Certificate data answers whether someone has issued a certificate for it, which is usually the last step before a campaign goes live. Three records, three different questions, and together they resolve in minutes what a mailbox rule cannot resolve at all.

What Domain Data Cannot Do

Three limits are worth stating, because a brand protection programme built only on registration records will miss things in predictable ways.

It does not see counterfeits. A seller listing fake goods on a marketplace never registers a domain. Nothing in this guide detects that.

It does not see impersonation on someone else's platform. A fake support account on a social network, an app store listing using your logo, or a paid ad pointing at a legitimate-looking redirect all sit outside the domain layer.

It cannot tell you intent. Registration records tell you a lookalike domain exists, who registered it and when. They do not tell you whether it is a phishing setup, a defensive registration by a partner, or an unrelated business with a similar name. That judgment stays human.

The practical consequence is that domain detection is one input among several. It is the earliest and the cheapest, which is why it is worth running first, but a brand protection programme that stops there has gaps in three directions.

Running these checks continuously across a domain portfolio rather than one at a time is what domain brand monitoring is for.