Malte ZanderContents
Groups with many brands give forgers many points of attack, and attackers pick the brand with the weakest protection. A hybrid model has proven itself: every brand gets its own organization with its own domains, scans and reporting route, and all of them follow shared rules for framing, approval, mandates and reporting. That keeps each brand fast while the group keeps the full picture.
- In Q4 2025 alone, phishing campaigns targeted 866 different brands (APWG).
- For new generic top-level domains, the Trademark Clearinghouse notifies trademark holders during at least the first 90 days of general registration when someone registers a domain matching their mark (Trademark Clearinghouse).
- An EU trademark is valid in all member states, and filing online costs EUR 850 for one class (Austrian Patent Office).
- Because similar names and misspellings had not been registered, fraudsters were able to put an almost indistinguishable copy of the IAF CertSearch database online in 2025 (DAkkS).
Why is brand protection harder for groups?
Because every additional brand enlarges the attack surface, but not every brand is equally well protected. A group has more domains, more variants, more login pages and more customer groups. Acquired brands bring old domains and their own habits. And rarely does every team know which of its sister brands' domains are genuine.
Attackers exploit exactly these differences. They don't pick the best-known brand, but the one where a copy stays online longest. A case at a small brand can still hurt the whole group if the fake imitates the parent brand or shared services.
Central, decentralized or hybrid?
Three models, each with clear strengths:
| Model | Strengths | Weaknesses | Fits when |
|---|---|---|---|
| Central | Uniform rules, one team, one report | Far from the customers and channels of individual brands | Brands are similar and cases are few |
| Decentralized | Close to customers, fast decisions | Uneven quality, no overall picture, duplicated work | Brands are very different and have their own legal teams |
| Hybrid | Each brand works on its own, under shared rules | Needs clear roles and a good start | Most groups with three or more brands |
In the hybrid model, each brand's team decides on its own cases, and a small central team maintains rules, templates and the report and handles escalations.
What belongs in the shared rules?
Seven points, set once for all brands:
Framing rules: when is a case phishing, when brand forgery, when certificate forgery? See Takedown framing.
Approval: who may send reports, and who reviews them first?
Mandate and power of attorney per rights holder. If brands belong to different companies, every report needs the authorization of the company that owns the mark.
Templates for every channel, in each brand's languages. Writing an abuse report that hosts actually act on is a good starting point.
A shared ignore list with every domain in the group and its partners, so no brand accidentally reports a sister brand.
Escalation and handover to the law firm: when does the central team take over, and when does legal?
Shared metrics, so brands can be compared.
How do you manage domains and marks across the portfolio?
With an inventory everyone knows and a clear line on new and old domains:
A complete register of all official domains, including old campaign and country domains, with owner and purpose.
Trademark registrations per brand and territory, such as an EU trademark for the EU market. Proof of the mark belongs in every evidence package.
Record key marks in the Trademark Clearinghouse if you want early notice of registrations under new generic endings.
Register the obvious variants of your most important domains yourself, especially misspellings and add-ons like login or service. Buying every variant is neither possible nor necessary.
Don't let domains lapse carelessly. German consumer advocates documented a case in which a fake shop suddenly appeared on an association's former, already cancelled domain (Verbraucherzentrale).
How do you report on the portfolio?
With the same metrics for every brand and a summary for the group. These have proven useful:
New cases per brand and month, split by source: scan, report through the widget, tip from support.
Time to removal, as a median per brand.
Open cases and cases without a response from a provider.
Recurring cases, meaning copies that come back after removal.
Patterns across brands, such as the same template or the same host showing up for several brands.
Measuring takedown success shows how to choose and calculate the metrics. Brand protection reporting offers a template for the report to leadership.
How does AI Fraud Protect help?
In AI Fraud Protect, every brand gets its own organization with its own domains, scans and report widget. The platform is multi-tenant and can run in your brand's look. Each brand team works on its own cases, while rules such as the ignore list and framing stay the same for everyone. The activity history records who initiated a takedown, changed a status or sent a report and when, and every message is reviewed and sent by a person.
Start the free fraud scan for a short report within 48 hours, or request a demo to see what organizations for several brands look like in the app.
FAQ
Do we need a separate mandate for every brand?
Reports are made on behalf of the rights holder. If the brands belong to different companies in the group, you usually need a mandate and power of attorney from each of those companies. This is not legal advice.
Is the Trademark Clearinghouse worth it?
Often yes for your most important marks, if you want early warning under new generic endings or want to take part in sunrise periods. The Clearinghouse does not cover country endings such as .de or .co.uk, where only your own monitoring helps.
Who decides on a takedown within the group?
In the hybrid model, the team of the affected brand, within the shared rules. The central team takes over when several brands are affected, a provider does not respond or legal steps are due.
How should we handle the parent brand?
Like a brand of its own, with its own organization and monitoring. The parent brand is often the best known and is imitated accordingly, especially for login and support pages that serve several brands.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
DAkkS: Warning, fake clone IAF CertSearch website published, 27 March 2025
Verbraucherzentrale: fake shops and the registration of .de domains