brand-protection

Name: brand-protection
Author: kostja94/marketing-skills

$npx mdskill add kostja94/marketing-skills/brand-protection

Detect and report brand impersonation, phishing, and trademark abuse.

Identifies fake websites, phishing sites, and domain squatting.
Uses WHOIS, hosting info, and trademark databases for evidence.
Assesses impersonation type, evidence, legal assets, and impact.
Provides structured reporting guidance and prevention recommendations.

SKILL.md

.github/skills/brand-protectionView on GitHub ↗

---
name: brand-protection
description: When the user faces brand impersonation, fake websites, phishing sites, or trademark infringement. Also use when the user mentions "fake site," "impersonation," "phishing site," "trademark infringement," "domain squatting," or "brand abuse." For monitoring, use brand-monitoring.
metadata:
  version: 1.0.1
---

# Strategy: Brand Protection

Guides discovery, reporting, and prevention of brand impersonation—fake websites, phishing sites, trademark infringement, and domain squatting. See **domain-selection** for defensive domain registration; **trust-badges** for official site verification signals; **about-page** for identity declaration.

**When invoking**: On **first use**, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output.

## Initial Assessment

**Check for project context first:** If `.claude/project-context.md` or `.cursor/project-context.md` exists, read it for brand name, official domain, and key assets.

Identify:
1. **Impersonation type**: Fake website, phishing, trademark misuse, domain squatting
2. **Evidence available**: Screenshots, URLs, WHOIS, hosting info
3. **Legal assets**: Registered trademark, copyright ownership
4. **Impact**: Traffic interception (fake site ranks for brand queries)? Payment fraud (users pay on fake site, then contact official support)?

## Evidence Collection Checklist

| Item | Action |
|------|--------|
| **Full URLs** | Document all key pages of the fake site |
| **Screenshots** | Homepage, product pages, logo, layout; include date/time |
| **Comparison** | Side-by-side: official vs fake (layout, logo, copy similarity) |
| **WHOIS** | Use [ICANN Lookup](https://lookup.icann.org/) for registrar, creation date, registrant |
| **Hosting** | IP lookup to identify hosting provider |

## Reporting Channels (Priority Order)

| Channel | Entry | Use Case |
|---------|-------|----------|
| **Domain registrar** | Abuse / Report Misuse on registrar site | Brand impersonation, trademark, fraud |
| **Hosting provider** | Same; submit abuse form | Hosting infringing content |
| **Google Safe Browsing** | [Report Phishing](https://safebrowsing.google.com/safebrowsing/report_phish/) | Phishing / impersonation risk |
| **Google Trademark** | [Trademark Complaint](https://services.google.com/inquiry/aw_tmcomplaint) or [email protected] | Trademark infringement in search; requires registered trademark |
| **Bing Content Removal** | [Content Moderation Platform](https://www.bing.com/webmaster/contentremovalform/showanonymouspage) | Copyright/trademark; content removal from Bing |
| **Payment processors** | PayPal Resolution Center, Stripe support | If fake site accepts payments; report fraud |
| **Social platforms** | X, Facebook, Instagram abuse forms | If fake site is promoted or linked there |
| **Google Ads / Microsoft Ads** | Platform trademark complaint forms | If impersonator runs brand ads |
| **DMCA** | To hosting provider | Copyright infringement; images, copy, design copied |
| **ICANN** | [DNS Abuse complaint](https://www.icann.org/en/system/files/files/submitting-dns-abuse-complaints-icann-guide-17nov25-en.pdf) | If registrar does not respond within reasonable time |

**Report content**: Include full URL, clear description of fraudulent activity, and all evidence (screenshots, logs).

## Reporting Best Practices

**Registrar vs hosting**: Use [ICANN Lookup](https://lookup.icann.org/) for registrar. For hosting, use IP lookup (HostingCheckerOnline, HostingDetector, ipinfo.io) to find origin server—registrar may be Cloudflare while origin host is elsewhere; report to both.

**Cloudflare as registrar**: Use [abuse.cloudflare.com](https://abuse.cloudflare.com/) or [abuse form](https://abuse.cloudflare.com/phishing); select "Phishing & Malware" for impersonation. Email complaints are generally not processed; use the online form. Provide specific URLs of infringing pages.

**Hosting detection**: Sites behind Cloudflare CDN hide origin IP. Use reverse IP lookup or hosting detection tools to identify underlying host; submit abuse to that provider as well.

**Parallel reporting**: Submit to registrar, host, and Google Safe Browsing simultaneously; do not wait for one before others. Google trademark review takes 1–8 weeks.

## Legal Options

| Option | When | Notes |
|--------|------|-------|
| **Cease and desist** | Trademark infringement | Lawyer-drafted; often first step |
| **DMCA takedown** | Copyrighted material copied | Images, copy, design; hosting providers typically comply |
| **Consumer protection** | Scam / fraud | FTC ReportFraud.ftc.gov (US) |
| **Law enforcement** | Financial loss, identity theft | IC3 (FBI) for cybercrime |

## Prevention Measures

### Defensive Registration

- Register brand+ai, brand+app, brand+official, etc. See **domain-selection** for defensive registration.
- Redirect variants to main domain; do not deploy separate sites.

### Official Site Verification

Place "Official website: [domain]" prominently:
- **Homepage** (above fold or hero)
- **Sign-in / Sign-up pages**
- **Pricing / Payment pages**: "Only pay at [official-domain]. Do not enter payment on other domains."
- **Footer**: "© [Brand]. Official site: [domain]"
- **FAQ**: "How do I verify I'm on the official site?" → "The only official URL is [domain]. Any other domain is not affiliated."

Use **trust-badges** for verification signals. See **about-page** for identity declaration.

### Customer Support (Payment Fraud)

When users report "can't use after payment" but no record exists—likely paid on fake site:

1. **Verify source**: Ask which URL they used (request screenshot or URL).
2. **Response template**: Explain that the only official site is [official-domain]; if they paid elsewhere, that site is not affiliated. Recommend: (a) dispute charge with payment provider, (b) use only [official-domain] going forward.
3. **Roll out** template to support team; ensure consistent messaging.

### User Education

- Social media pinned post / announcement: "Only use [official-domain]"
- Email signatures, support replies: link to official domain only

## Traffic Recovery (When Impersonation Intercepts Search)

| Tactic | Purpose |
|--------|---------|
| **Brand search ads** | Run Google Ads and Microsoft Ads on brand terms; ensure official site appears first for brand queries |
| **SEO** | Strengthen official site for branded queries; Organization schema, clear H1, meta tags. See **schema-markup**, **title-tag** |
| **Social** | Pinned post: "Only use [official-domain]. Beware of impersonation." |

## Monitoring (Ongoing)

- Periodic search: brand name + common variants (e.g., brand+ai, brand+app)
- See **brand-monitoring** for monitoring setup, tool selection, and cadence

## Timeline (Typical)

| Phase | Focus |
|-------|-------|
| **Immediate (Days 1–3)** | Support template; site declaration; evidence collection |
| **Short-term (Week 1–2)** | Abuse reports; Google Safe Browsing; DMCA if applicable |
| **Traffic (Week 2+)** | Brand ads; SEO; social announcement |
| **Ongoing** | Monitoring; defensive registration if feasible |

## Implementation Checklist

**Short-term (1–2 weeks)**: Evidence collection; abuse reports to registrar and host; Google Safe Browsing report; DMCA if applicable; add "Official website" on site.

**Medium-term**: Add impersonation guidance to domain-selection; official verification to trust-badges, about-page.

**Long-term**: Periodic search (brand + variants); brand monitoring (BrandShield, Doppel); defensive registration of variants.

## Output Format

- **Evidence package** (checklist, evidence list)
- **Report templates** (registrar, hosting, Google)
- **Timeline** (immediate vs medium vs long-term actions)
- **Prevention** (defensive registration, site verification, user education)

## References

- [How to Report and Take Down a Fake Website - LegalClarity](https://legalclarity.org/how-to-report-and-take-down-a-fake-website/)
- [Website Spoofing: Detection and Take Down - BrandShield](https://www.brandshield.com/blog/website-spoofing-detection-take-down/)
- [ICANN DNS Abuse Complaints Guide](https://www.icann.org/en/system/files/files/submitting-dns-abuse-complaints-icann-guide-17nov25-en.pdf)
- [Google Safe Browsing - Report Phishing](https://safebrowsing.google.com/safebrowsing/report_phish/)
- [Cloudflare Abuse Reporting](https://www.cloudflare.com/trust-safety/reporting-abuse/) — use online form; select Phishing & Malware
- [Google Trademark Complaint](https://services.google.com/inquiry/aw_tmcomplaint)
- [Bing Content Removal](https://www.bing.com/webmaster/contentremovalform/showanonymouspage)

## Related Skills

- **domain-selection**: Defensive domain registration; brand variants
- **rebranding-strategy**: When rebranding, sync brand protection checks
- **brand-monitoring**: Proactive monitoring setup; tool selection; this skill = reactive takedown
- **branding**: Brand asset protection; consistency
- **trust-badges**: Official site verification signals
- **about-page**: Official identity and domain declaration
- **homepage-generator**: "Official website" placement
- **google-ads**, **paid-ads-strategy**: Brand search ads for traffic recovery
- **schema-markup**, **title-tag**: SEO for branded queries

More from kostja94/marketing-skills

Skill	Description
404-page-generator	When the user wants to create, optimize, or audit 404 error pages. Also use when the user mentions "404 page," "404 error," "error page," "page not found," "broken link page," "404 design," "custom 404," "404 redirect," "404 page UX," or "404 recovery." For sitewide page planning, use website-structure.
about-page-generator	When the user wants to create, optimize, or audit About page content. Also use when the user mentions "about page," "about us," "company story," "our team," "about section," "company overview," "brand story," "team page," or "who we are." For sitewide page planning, use website-structure.
affiliate-marketing	When the user wants to plan, implement, or optimize affiliate marketing strategy. Also use when the user mentions "affiliate marketing," "affiliate program strategy," "CPS model," "affiliate recruitment," "commission structure," "affiliate partners," "affiliate network," "affiliate tracking," "affiliate commission," or "partner marketing." For affiliate page, use affiliate-page-generator.
affiliate-page-generator	When the user wants to create, optimize, or audit affiliate program page content. Also use when the user mentions "affiliate program," "affiliate page," "partner program," "referral program page," "affiliate landing," "partner landing," "commission page," or "affiliate signup." For affiliate program strategy, use affiliate-marketing.
ai-traffic-tracking	When the user wants to track AI search traffic in GA4 or GSC. Also use when the user mentions "AI traffic," "ChatGPT referral," "Perplexity traffic," "AI Overviews," "GA4 AI sources," "AI search analytics," "track AI referrals," "AI search traffic," "Claude traffic," or "how to track AI traffic." For AI SEO strategy, use generative-engine-optimization.
alternatives-page-generator	When the user wants to create, optimize, or audit alternatives or comparison content (page or blog article). Also use when the user mentions "alternatives page," "alternatives listicle," "X alternatives," "competitor comparison," "vs page," "compare page," "best alternatives to X," "switch from X," "competitor brand traffic," "brand keyword ads," or "intercept competitor search." For competitor research, use competitor-research.
api-page-generator	When the user wants to create, optimize, or audit the API introduction/overview page. Also use when the user mentions "API page," "API landing page," "/api page," "API overview," "developer landing," "API marketing," or "API for developers." Note: API documentation (endpoint reference) lives in docs; use docs-page-generator.
app-ads	When the user wants to run app install ads, user acquisition (UA), or promote mobile apps. Also use when the user mentions "app ads," "app install ads," "UA," "user acquisition," "Google App Campaigns," "Apple Search Ads," "ASA," "UAC," "App Store ads," "Play Store ads," "CPI," or "app promotion." For store listings, use distribution-channels.
article-content	When the user wants to write, generate, or create article body content—blog post body, long-form content, how-to guide, listicle. Also use when the user mentions "write article," "article content," "blog post content," "article body," "long-form content creation," "generate article," "article draft," "how-to guide content," "listicle content," "information gain," or "content density." For single post page structure, schema, and SEO metadata, use article-page-generator. For blog index/listing page, use blog-page-generator. For short ad, landing, or email copy, use copywriting.
backlink-analysis	When the user wants to analyze backlinks, audit link profile, or identify link issues. Also use when the user mentions "backlink analysis," "backlink audit," "referring domains," "toxic links," "link profile," or "disavow file." For acquisition, use link-building.