·
3 min read
Brand impersonation glossary
Plain definitions of the terms used in brand impersonation and takedowns, from typosquatting and wallet drainers to blocklists and takedowns.
ChainPatrol
Brand impersonation is someone posing as your company, its staff or its products to deceive your customers, usually to steal money or credentials. These are the terms used when finding and removing it, in plain language. Each links to a guide where it's covered in more depth.
Threats
Term | What it means |
|---|---|
Brand impersonation | Fake websites, accounts, apps, ads or numbers that pose as your company to deceive customers. |
Fake support account | A social or messaging account posing as your customer support, usually replying to complaints and moving customers to a message or link. See fake support account takedowns. |
Executive impersonation | A fake profile of one of your leaders, used for investment scams or to request payments from staff. See how to remove fake executive profiles. |
Phishing site | A page built to look like yours to collect passwords, codes or payments. See how to take down a phishing site. |
Wallet drainer | A malicious site or script that empties a crypto wallet once the owner signs a transaction. |
Typosquatting | Registering misspellings of a brand's domain. See how to monitor for lookalike domains. |
Homograph domain | A domain using characters from other alphabets that look identical to the real ones. |
Scam ad | A paid ad that impersonates a brand or sends people to a phishing page. See how to report scam ads. |
Fake app | An app or APK that copies a brand to harvest logins or deposits. See how to get a fake app removed. |
Enforcement
Term | What it means |
|---|---|
Takedown | Getting a platform, host or registrar to remove an impersonating site, account, app or ad. |
Blocking | Adding a confirmed phishing site to wallet and browser blocklists so visitors see a warning. Blocking applies to web domains and URLs; fake social profiles and chat accounts are removed through platform takedowns. See blocking vs takedown. |
Blocklist | A shared list of known malicious sites that browsers, wallets and security tools use to warn people. |
Registrar | The company a domain is registered through. It can suspend the domain. See registrar vs host vs Cloudflare. |
Host | The provider whose servers run a site. It can remove the content. |
Letter of authorization | A signed document that lets a third party file impersonation and trademark claims for a company. See what a letter of authorization is. |
Impersonation report | A platform report that an account poses as someone else, with no intellectual property claim needed. |
Trademark report | A report that someone misuses a registered name or logo, backed by registration details. |
Parody, commentary and fan accounts | Accounts platforms allow if clearly labeled. On X, the label must start the account name. See fake support vs fan accounts vs parody. |
Managed takedown service | A service that files and follows up takedowns for you and reports results, rather than only sending alerts. |
Frequently asked questions
What's the difference between brand impersonation and phishing?
Phishing is one form of brand impersonation, aimed at stealing credentials or payments through a fake page. Impersonation also covers fake accounts, apps, ads and numbers.
What's the difference between blocking and a takedown?
Blocking warns people away from a site; a takedown removes it at the source. Most responses need both.
See what's impersonating your brand right now. Get a free scan, with results within 48 hours.
Fakes of your brand already out there?
ChainPatrol finds them, blocks the links in wallets and browsers, and files the takedowns for you.