# Catch fake websites impersonating your brand every morning

> Every morning at 7am, spot new copycat and phishing sites using your name, ranked by how convincing they are, before your customers find them.

- Workflow type: agent
- Services: urlscan.io, Google Sheets, Slack
- Categories: Marketing, Operations
- Published: 2026-08-10

## What it does

- Searches a global website scanning archive every morning for newly seen sites whose web addresses mimic your brand name, while skipping your own domains.
- Also catches impostor pages that pull your logos and stylesheets straight from your real website, which is one of the strongest signs someone has cloned you.
- Checks every find against a running spreadsheet log of domains you have already reviewed, so you only ever see genuinely new sites instead of yesterday's list again.
- Posts new finds to Slack with a screenshot and a plain explanation of why each one looks like a copy of you, most convincing first, and says so clearly when a run turns up nothing.

## What you'll need

- A urlscan.io account. The free tier is enough for the searches this uses.
- A Google Sheets spreadsheet to hold the running log of domains you have already reviewed.
- A Slack workspace with a channel for brand protection alerts.
- A list of your official domains, your content delivery provider, and any partner sites you never want flagged.

## Prompt

Every morning at 7am, hunt for websites that are impersonating our brand and post anything genuinely new to our brand protection Slack channel. Before running this, fill in our real details wherever it says BRAND_NAME (our brand name as it appears inside domain names, for example "ourbrand"), OUR_DOMAINS (our official domains, for example ourbrand.com and ourbrand.org), OUR_CDN (the domain our assets are served from), and PARTNER_DOMAINS (known partner and vendor sites we never want flagged).

Start with urlscan Search Scans. Run it more than once, because each query shape catches a different kind of impostor and no single search finds them all.

Search one, lookalike hostnames. Use a regex on the page domain that matches our brand name while excluding our real domains: page.domain:(/.*BRAND_NAME.*/ AND NOT ourbrand.com AND NOT ourbrand.org). This catches typo variants, hyphenated versions, extra words like login or support, and the same name on a different top level domain.

Search two, hotlinked assets. Shape it as domain:ourbrand.com AND NOT page.domain:ourbrand.com. This finds pages served from someone else's hostname that are still requesting logos, stylesheets, or scripts from our real infrastructure. It is a strong signal that someone copied our site wholesale rather than rebuilding it, and it catches impersonators whose domain name looks nothing like ours.

Search three, already flagged pages. Combine the lookalike pattern with task.tags:phishing and verdicts.overall.malicious:true to surface hits that other researchers or urlscan itself have already judged to be malicious. Treat these as high priority since someone else has already confirmed the intent.

Notes on searching. urlscan search accepts full Lucene syntax. Results come back newest first and a single call returns at most the requested size, defaulting to 100. If there are more results than that, page by taking the sort array from the last result object and passing it as the search_after parameter on the next call. Since this runs daily, restrict to recent scans rather than pulling the whole history, and rely on the review log below as the real guard against repeats. One caveat: the brand field on search results is a urlscan Pro feature, so do not build the logic around it. Lean on the domain and hotlink queries plus the verdicts, which all work on the free tier, and treat brand attribution as a bonus when it happens to be present.

Before alerting on anything, deduplicate. Use Google Sheets Get Values to read our running log of domains we have already reviewed, then drop every candidate whose domain already appears in that log. Separately, drop anything on our permanent allowlist: OUR_DOMAINS, OUR_CDN, and PARTNER_DOMAINS. Those must never generate an alert. What survives both filters is the list of genuinely new candidates.

For each new candidate, gather evidence. Use urlscan Get Scan Result to pull the IP address, the hosting provider, the country, and the overall verdict. Use urlscan Get Screenshot to retrieve the stored image of the page so a human can eyeball it without ever visiting the live site. Include the screenshot and a link to the full scan result alongside each finding.

Then judge how convincing each impersonation actually is, and rank them. Weigh how closely the screenshot resembles our real site, how plausible the hostname reads as one of ours, whether the page is hotlinking our logos or stylesheets, whether it is capturing logins or payment details, whether the hosting looks unrelated to our own, and whether there is already a phishing tag or malicious verdict on it. A pixel accurate clone with a live login form matters far more than a parked page with our name in it, and the ranking should reflect that.

Post the new finds to our brand protection Slack channel with Slack Send a Message, leading with the most convincing ones. For each candidate give the domain, one or two plain sentences on why it looks like a copy of us, the IP address and hosting provider, the verdict, and links to the scan result and screenshot. Keep it skimmable so someone can triage the whole thing over coffee.

If nothing survives the filtering, still post a short message saying the run completed and found no new impersonating domains today. Say it plainly. Silence should always mean something is broken, never that everything is fine.

Finally, use Google Sheets Append Values to append every new domain from this run to the review log, along with the date it was first seen and a one line note on how convincing it looked. This is what keeps tomorrow's run quiet, so do it whether or not we decide to act on a given domain.

## How to customize

- Change the timing, for example running twice a day during a product launch or a big campaign.
- Update the allowlist of domains you never want alerted on as partners, campaign microsites, and vendors change.
- Tighten or loosen the alerting bar, from only sites already flagged as malicious through to every lookalike name regardless of verdict.

## Example output

Brand protection: 3 new lookalike domains this morning

1. ourbrand-secure-login.com (most convincing)
Near-pixel copy of our sign-in page, and it is loading our real logo and stylesheet from our own CDN, so it will keep looking current as we redesign. Live login form capturing email and password.
IP 185.x.x.x, hosted with a bulletproof reseller in NL, urlscan verdict: malicious, tagged phishing.

2. our-brand.co
Homepage copy lifted from us almost word for word with our hero image, but the pricing page is broken and the footer still has the template placeholder. No login form yet, worth watching.
IP 104.x.x.x, Cloudflare fronted, no verdict yet.

3. myourbrandapp.net
Parked page with our name in the address and nothing else on it. Low risk today, likely registered for later use.
IP 3.x.x.x, AWS, no verdict.

Screenshots and full scan results linked on each. All 3 added to the review log.

## FAQ

### Do I need a paid urlscan.io plan for this?

No. The searches this relies on, looking for lookalike web addresses and for pages that borrow assets from your real site, work on a free account. Automatic brand attribution is a paid extra, so this workflow treats it as a bonus when it happens to be there rather than depending on it.

### Will this actually visit the suspicious websites?

No. It reads from an archive of scans that already happened and pulls the stored screenshot of each page. That means you and your team can look at a suspected phishing page without anyone clicking through to the live site.

### Why does it need a spreadsheet?

The spreadsheet is the memory. Without it, the same copycat domain would be reported to you every single morning. Each new domain gets written to the log at the end of the run, so from the next day onward you only hear about things you have genuinely not seen before.

### Will it keep flagging our own websites and partners?

No. You list your official domains, your content delivery provider, and known partner sites up front, and those are excluded from alerting permanently rather than needing to be dismissed each time.

### What happens on a quiet day with no new sites?

It still posts a short note saying the run finished and found nothing new. That way silence in the channel always means something is broken, not that everything is fine.

### How does it decide which fakes to show first?

It weighs how much the page looks like your real site, how plausible the web address is as one of yours, whether the page is borrowing your logos and stylesheets, whether it is collecting logins or payments, and whether it has already been flagged as malicious. The most convincing impersonations lead the message.

Use this prompt in General Input: https://www.generalinput.com/prompts/catch-fake-websites-impersonating-your-brand-every-morning