Brand Impersonation Exposure
impersonation_exposureAssess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT logs, and whether a wildcard certificate exists — returning an A+ (low exposure) to F (high exposure) grade. NEUTRAL FRAMING (important): a registered lookalike domain is NOT proof of impersonation — it may be a legitimate third party or the owner's own. Report it as exposure to verify, never as an accusation against a specific domain. Fully passive: public DNS delegation checks plus public CT-log queries, sending nothing to the target or the lookalike domains, so it is safe and lawful to run. Use lookalike_domains or subdomain_discovery for the raw per-tool detail. Read-only; requires no API key; rate-limited. Returns a text report: grade, counts, per-category findings, and a shareable report link.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Registrable domain to assess for impersonation exposure (e.g., 'example.com'). Scheme and path are stripped. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| grade | Yes | Exposure grade A+ (low exposure) to F (high exposure) | |
| score | Yes | 0-100, higher = less exposed | |
| wildcard | No | Whether a wildcard certificate exists | |
| reportUrl | Yes | Human-facing interactive report on dechonet.com | |
| typosquatCount | Yes | Live third-party lookalike/typosquat domains (variants on the domain's own nameservers/IP are excluded) | |
| riskySubdomainCount | Yes | Exposed operational subdomains found |