Agents are only as good as the data under them

BrandDefender.ai is our new detection engine for brand infringement: agents that sweep a brand across our index and return a grouped, prioritised set of findings in minutes. It is built for brand protection providers and IP firms to run under their own name, or to connect to their own agents in Claude, ChatGPT or whatever they build in-house.

The agent is not the hard part. Reasoning is cheap and getting cheaper. What an agent cannot do is see something that isn't in front of it, and most brand protection agents are reading a keyword watch list. That produces a thousand lookalike domains a month, one takedown each, replaced by morning. Whack-a-mole, with a model doing the whacking.

Finding the operator instead of the domain takes four things a name-based watch does not have:

• Coverage, including the country TLDs: 400 million domains, 99% of everything registered, with new registrations picked up daily and a full recrawl every month. Coverage that stops at .com is not coverage, because the abuse rarely does: in one recent sweep the phishing cluster sat almost entirely on .com.ph, and the gambling operation spread across .top, .vip and .cam. We hold 11.47 million .cn domains, the largest index outside China, and the same depth across the rest of the ccTLD space. An agent that cannot see a zone cannot report on it.
• Page content: Plenty of infringement never puts the brand in the domain name. In that same sweep, a content scan surfaced 124 third-party domains referencing the brand on the page only: gift-card and rewards scams impersonating the loyalty programme, counterfeit timeshare resale listings, unauthorised storefronts. All invisible to a domain-string watch. We crawl up to 50 pages deep, so the agent reads what a site says, not what it is called.
• Certificates: Attackers need the padlock, and certificates leak their plans. Four generic lookalikes in that sweep picked up DV certificates in a single week — staging, before any of them served a page. An invoice-fraud domain aimed at the brand's accounts-payable team appeared in both SAN and subject scans with a certificate issued on 12 August, weeks before it would have been used. The domain alone tells you nothing until the site is live.
• Ownership and infrastructure: This is what turns a list into a target. Ten brand-adjacent domains with different registration dates resolving to the same pair of IPs behind the same nameservers. Four lookalike TLD variants in one /24 block at one Dutch hoster, all with the same Plesk-issued invalid certificates. A gambling cluster registered in batches through one registrar. Those are three complaints, not two hundred notices. The same WHOIS-overlap matching reconstructs which domains the brand genuinely owns, so you can see the gaps in its own portfolio before a squatter does.

None of that is a model capability. It is data: built since 2010, with ten years of history behind it, so you can also see a domain change hands, move hoster, or go from parked to live. The agents do not crawl the web. We already have it, which is why a sweep takes minutes and a count is exact rather than a sample.

Models are converging. Everyone will have a good agent. The firms that win this market will be the ones whose agents can see the whole web.

Try it on a brand you protect today: BrandDefender.ai