Brand Protection Monitor. Finds lookalike domains of a brand (typos, homoglyphs incl. IDN, TLD swaps, added words like -claim or -airdrop, and new names seen in Certificate Transparency logs), checks which exist, and for those reads the registry (RDAP), the live TLS certificate and the homepage. Each finding has a deterministic 0-100 risk score with plain reasons (recently registered, fresh certificate, page copies the brand's title or icon, wallet or password prompt, parked, redirects to the official site) and an evidence record with fetch times and SHA-256 hashes. Built for crypto brands first. POST /v1/brand/scan (brand, official_domains[], keywords[]?, since?, limit?): the watched report; an unwatched brand gets a quick DNS-only scan now and a full scan on the next collector cycle. Use since for 'what changed since my last call'. POST /v1/brand/lookalikes (domain): which lookalikes exist right now. POST /v1/brand/evidence (evidence_id): the evidence behind one finding. GET /v1/brand/watched: brands under watch. Every response is a JSON object. Detection and evidence only: findings are observed signals, not a finding of fraud; no takedowns.
Service Metadata Cardsource: on-chain metadata (LCD)
{10 items
"schema":"pocket-service-card/v1"
"description":"Brand Protection Monitor. Finds lookalike domains of a brand (typos, homoglyphs incl. IDN, TLD swaps, added words like -claim or -airdrop, and new names seen in..."
"rpc_types":[1 item
0:{4 items
"type":"REST"
"intent":"expected"
"backend_hint":"brand-protection HTTP server on :8080; mount at /"
"notes":"Only POST /v1/brand/scan, /v1/brand/lookalikes, /v1/brand/evidence and GET /v1/brand/watched, /v1/version, /v1/health are expected. Every response is a JSON obj..."
"backend":"The brand-protection Node.js HTTP server (no external dependencies) behind a RelayMiner, REST backend at http://<container>:8080. Reports come from a store fill..."
"notes":"Identity probe: pins the backend to this service."
}
1:{4 items
"rpc_type":"REST"
"request":{2 items
"path":"/v1/health"
"method":"GET"
}
"expect":{2 items
"json_path":"$.status"
"matches":"^ok$"
}
"notes":"Readiness probe."
}
2:{4 items
"rpc_type":"REST"
"request":{2 items
"path":"/v1/brand/watched"
"method":"GET"
}
"expect":{2 items
"json_path":"$.service"
"matches":"^brand-protection$"
}
"notes":"Functional probe: reads the store without making any outbound call."
}
]
"notes":"Request bodies are capped at 1 MiB; responses are a few KB to ~100 KB (limit caps findings at 200). A quick scan is bounded to about 9 s; keep the relay timeout..."
