Brand Protection Monitor

security

Serving

Finds lookalike domains of a brand (typos, homoglyphs, TLD swaps, added words like -airdrop), checks which exist, and reads their registry record, live certificate and homepage. Each finding has a 0-100 risk score, plain reasons and hashed evidence. POST /v1/brand/scan, /v1/brand/lookalikes, /v1/brand/evidence. Detection only, not a finding of fraud.

Endpoint: POST https://agent.pocket.network/v1/brand-protection/v1/brand/scan
Price per call: $0.005 USD
Networks payable on: Base (eip155:8453), Tempo (eip155:4217)
Protocol: rest

Calling it

The first call returns 402 Payment Required with the terms. Sign for those terms and retry the same request with the payment attached.

Example request

A real, working call — the request the service card verifies against.

curl -X POST https://agent.pocket.network/v1/brand-protection/v1/brand/scan \
  -H 'content-type: application/json' \
  -d '{"official_domains":["uniswap.org"],"brand":"Uniswap","limit":5}'

Example response

The response this call returned, captured 2026-11-09 19:45:55 UTC.

{
  "portal": {
    "provenance": "third-party-supplier",
    "serviceId": "brand-protection",
    "schemaCheck": "unchecked"
  },
  "data": {
    "service": "brand-protection",
    "version": "0.1.8",
    "fetched_at": "2026-11-09T19:45:54.736Z",
    "brand_id": "uniswap.org",
    "brand": "Uniswap",
    "official_domains": [
      "uniswap.org"
    ],
    "as_of": "2026-11-09T09:43:27.975Z",
    "age_hours": 10,
    "scan_type": "full",
    "full_scan": "done",
    "collector_warnings": [],
    "method": "bp-risk/5",
    "coverage": {
      "candidates_generated": 310,
      "candidates_dns_checked": 310,
      "dns_errors": 25,
      "existing": 67,
      "full_checks": 67,
      "ct_hits": 0,
      "partial": false,
      "duration_ms": 45752
    },
    "since": null,
    "findings_total": 70,
    "findings_returned": 5,
    "findings": [
      {
        "domain": "uniswap-rewards.org",
        "fuzzer": "added-word",
        "risk": 55,
        "risk_level": "medium",
        "status": "live",
        "reasons": [
          "resolves to an address (+15)",
          "registered 30 days ago (+25)",
          "name adds a phishing-style word to the brand (+15)"
        ],
        "registered_at": "2026-10-09T19:59:05.472Z",
        "certificate_issuer": null,
        "title": "Contact Verification Suspension Page",
        "checked": "full",
        "evidence_id": "9daf9e618be40f259c34369a",
        "first_seen": "2026-11-04T00:20:37.013Z",
        "changed_at": "2026-11-06T21:45:06.096Z"
      },
      {
        "domain": "niswap.org",
        "fuzzer": "omission",
        "risk": 50,
        "risk_level": "medium",
        "status": "live",
        "reasons": [
          "resolves to an address (+15)",
          "registered 12 days ago (+25)",
          "TLS certificate issued 4 days ago (+10)"
        ],
        "registered_at": "2026-10-27T20:01:29.085Z",
        "certificate_issuer": "Let's Encrypt",
        "title": "Service Status",
        "checked": "full",
        "evidence_id": "1edcad58a9d3404187ce48cb",
        "first_seen": "2026-11-04T00:20:37.013Z",
        "changed_at": "2026-11-04T21:41:35.089Z"
      },
      {
        "domain": "uiswap.org",
        "fuzzer": "omission",
        "risk": 50,
        "risk_level": "medium",
        "status": "live",
        "reasons": [
          "resolves to an address (+15)",
          "registered 12 days ago (+25)",
          "TLS certificate issued 4 days ago (+10)"
        ],
        "registered_at": "2026-10-27T20:01:28.992Z",
        "certificate_issuer": "Let's Encrypt",
        "title": "Service Status",
        "checked": "full",
        "evidence_id": "406226422e6a6c9aa2efbb74",
        "first_seen": "2026-11-04T00:20:37.013Z",
        "changed_at": "2026-11-04T21:41:35.089Z"
      }
    ],
    "risk_scale": "0-100, higher means more signs of impersonation; 70+ high, 40-69 medium; unchecked means only DNS was read, so the page and registry have not been assessed and the number is a floor, not a verdict",
    "note": "Findings are observed signals (lookalike name, recent registration, fresh certificate, page copies the brand, wallet or password prompt), not a finding of fraud. Detection and evidence only. Fetch /v1/brand/evidence with a finding's evidence_id for fetch times and SHA-256 hashes."
  }
}

Try it

Make one real paid call from your own wallet — about $0.005 on Base (eip155:8453). The wallet signs; nothing here holds a key. You'll see exactly what the service answers.

No browser wallet found. Install MetaMask, Rabby, or Coinbase Wallet to try a call here.

EndpointRequest body

Supported methods

Methods the registry lists for this service. The portal forwards any call as sent; the supplier decides what it answers, and a delivered answer is settled.

Methods Brand Protection Monitor accepts, and whether each reads or writes.
Method	Effect
`GET /v1/brand/watched`	read
`GET /v1/health`	read
`GET /v1/version`	read
`POST /v1/brand/evidence`	read
`POST /v1/brand/lookalikes`	read
`POST /v1/brand/scan`	read

Schemas

Published by the service itself. The example above is generated from these.

Request schema

{
  "type": "object",
  "description": "The body of POST /v1/brand/scan. /v1/brand/lookalikes takes domain, with optional since and limit; /v1/brand/evidence takes evidence_id (24 hex characters, from a finding); GET /v1/brand/watched lists the brands under watch.",
  "properties": {
    "official_domains": {
      "type": "array",
      "minItems": 1,
      "maxItems": 5,
      "items": {
        "type": "string"
      },
      "description": "The brand's own domains, e.g. [\"uniswap.org\"]."
    },
    "brand": {
      "type": "string",
      "maxLength": 64,
      "description": "The brand name, e.g. Uniswap."
    },
    "keywords": {
      "type": "array",
      "maxItems": 10,
      "items": {
        "type": "string",
        "maxLength": 40
      },
      "description": "Extra words to look for in lookalikes."
    },
    "since": {
      "type": "string",
      "format": "date-time",
      "description": "Only findings new or changed after this time."
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200,
      "description": "At most this many findings; default 50."
    }
  },
  "required": [
    "official_domains"
  ]
}

Response schema

{
  "type": "object",
  "description": "POST /v1/brand/scan answers the brand's report: findings, each with the lookalike domain, a 0-100 risk score, reasons and an evidence_id. lookalikes answers the lookalikes that exist now; evidence answers the fetch times, hashes and observations behind one finding. Errors carry an error field."
}