Malte ZanderContents
This glossary explains the 40 terms that keep coming up in brand protection and takedowns, in one or two sentences each. It is organized by topic: attack types, detection, evidence, takedown and reporting channels, and law and procedures. Where a term is covered in more depth, a link leads to the matching article.
- Since 28 January 2025, RDAP has been the definitive source of registration data for generic domains, replacing WHOIS (ICANN).
- Under ICANN contracts, DNS abuse means malware, botnets, phishing, pharming and spam used to deliver them (ICANN).
- Chrome only trusts TLS certificates that appear in Certificate Transparency logs (Chrome).
- According to Google, Safe Browsing protects more than five billion devices every day (Google Safe Browsing).
Attack types
AiTM (adversary in the middle): a phishing page that sits between the victim and the real website, relays the sign-in live and captures the password, code and session cookie along the way. That is why classic two-factor login doesn't stop it. See Why two-factor login doesn't stop every phishing page.
Cloaking: a technique that shows a page's real content only to certain visitors and a harmless page to scanners. See Hidden fakes.
Clone firm: a fake firm that uses the name, address and registration number of a genuine authorized company, mainly in financial services. See Financial services impersonation.
Cloned website: a copy of your website on someone else's domain, with your logo, copy and design. See Clone sites vs phishing pages.
Fake shop: an online store that takes payments but delivers nothing or counterfeits, often using the name or look of real brands. See Fake shop takedown.
Fake verification page: a page that confirms forged certificates, degrees or register entries as valid, usually reached through a QR code on the forgery. See Fake certification registers.
Homoglyph: a character that looks almost identical to another, such as "rn" instead of "m" or a Cyrillic "а" instead of the Latin "a". Popular for lookalike domains.
Lookalike domain: a domain that can easily be mistaken for yours, through misspellings (typosquatting), homoglyphs, other endings or add-ons like login, shop or support.
Phishing: deception aimed at stealing credentials, payment details or other sensitive information, usually through a cloned page. See From email to landing page.
Phishing kit: a ready-made package of files and scripts for setting up phishing pages in series. See Phishing kits.
Quishing: phishing through QR codes, for example on letters, posters or forged certificates. See Quishing.
Detection
Certificate Transparency (CT): public logs in which newly issued TLS certificates appear. They help you find new domains with your name early. See Reading TLS certificates.
Domain scanner: a tool that generates variants of your domains, for example with typos, homoglyphs and add-ons, and checks whether they are registered and what they show.
False positive: a finding that looks like a fake but isn't, such as a partner's domain. See False positives in brand protection.
Ignore list: a list of your own domains and your partners' domains that are never reported.
OSINT: investigation using publicly available sources such as registration data, DNS, certificate logs and web archives. See OSINT basics for brand protection teams.
Report widget: a form on your website where customers, verifiers and staff report suspicious links or documents in one step. See Report widget.
Visual similarity: comparing the look of a suspicious page with your real page, these days usually with AI. See Visual similarity.
Watchlist: a list of risky but not yet active domains, such as parked or for sale, that are reassessed with every scan.
Evidence
Chain of custody: complete documentation of who captured, passed on or changed which evidence and when. See Chain of custody for digital evidence.
Evidence package: all the evidence for a case in one place, such as screenshots, registration data, DNS, hosting, the TLS certificate and trademark evidence. See The evidence package your law firm actually needs.
Hash value: a digital fingerprint of a file, for example using SHA-256. If the file changes, the hash changes, which lets you show that evidence has not been altered.
RDAP: the protocol for registration data of domains and IP addresses. For generic domains, it has replaced WHOIS as the definitive source.
WARC: a standardized file format for archiving web pages with all their requests and responses. See Archiving fake sites before they vanish.
Takedown and reporting channels
Abuse contact: a provider's address for reporting abuse. For IP networks in Europe, it is listed in the abuse-c object of the RIPE database. See Hosting and IP lookups.
CDN: a network that caches and delivers content while hiding the actual host, such as Cloudflare. See Taking down a site behind Cloudflare.
Framing: classifying a case as phishing, brand forgery or certificate forgery. It decides the channels, grounds and evidence. See Takedown framing.
Google Safe Browsing: a Google service that lets browsers warn visitors about dangerous pages. A listing protects visitors before the page is removed. See Google Safe Browsing reports.
Host: the provider whose servers a page runs on. It can remove content and is usually the fastest lever.
Human in the loop: a process in which software finds and prepares, and a person decides and sends. See Human in the loop takedowns.
Parallel takedowns: reporting to the host, registrar, DNS provider and Google at the same time instead of one after another. See One find, many reports.
Registrar: the provider through which a domain is registered. It can suspend the domain, making all content under it unreachable.
Registry: the operator of a domain ending, such as DENIC for .de. It manages the ending but generally doesn't remove content.
Takedown: the removal of a fake by the responsible providers, based on a report. See How to take down a fake website.
Law and procedures
DENIC dispute: an entry at DENIC that prevents a .de domain from being transferred to third parties during a legal dispute.
Digital Services Act (DSA): the EU regulation on digital services. Its Article 16 requires hosts to run a notice and action mechanism for illegal content. See Host, registrar or DNS.
DNS abuse: under ICANN contracts, malware, botnets, phishing, pharming and spam used to deliver them. Since April 2024, registrars must act against it once they have actionable evidence.
Trademark Clearinghouse (TMCH): a database of trademarks that enables priority registrations under new generic endings and sends notices about matching registrations during at least the first 90 days.
Trusted flagger: a trusted notifier under the DSA whose notices online platforms must prioritize. The status is awarded by national coordinators.
UDRP: the dispute resolution procedure for generic domains in trademark cases, run for example by WIPO. It can lead to a domain being transferred or cancelled. See Takedown or legal action?.
How does AI Fraud Protect help?
AI Fraud Protect brings many of these terms together in one process: the domain scanner and the report widget find lookalike domains, cloned websites, phishing pages and fake verification pages, the AI visually compares every finding with your real page, and risky domains stay on the watchlist. Every case gets an evidence package, you choose the framing, and the reports to host, registrar, DNS provider and Google Safe Browsing go out in parallel after a person has reviewed them. Your domains and partners are on the ignore list.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the process in the app.
FAQ
What is the difference between a registrar and a registry?
The registry operates an ending, such as .de or .com. The registrar sells and manages domains under that ending for its customers. For a takedown, the registrar is usually the right contact.
Is a lookalike domain always illegal?
No. It only becomes a case when it is used to deceive or infringes trademark rights. Many lookalike domains belong on the watchlist, not in a takedown. This is not legal advice.
Does WHOIS still exist?
For generic domains, RDAP has been the definitive source since January 2025. Many tools still say WHOIS colloquially, but mean registration data that today often comes via RDAP.
What is the difference between phishing and brand forgery?
Phishing aims to steal data; brand forgery uses your presence to pose as you, for example in a fake shop. The distinction decides which providers you report to and on what grounds.
Sources
ICANN: launching RDAP, sunsetting WHOIS, 27 January 2025
ICANN: advisory on compliance with DNS abuse obligations, 5 February 2024