{
  "serviceId": "brand-protection",
  "displayName": "Brand Protection Monitor",
  "description": "Finds lookalike domains of a brand (typos, homoglyphs, TLD swaps, added words like -airdrop), checks which exist, and reads their registry record, live certificate and homepage. Each finding has a 0-100 risk score, plain reasons and hashed evidence. POST /v1/brand/scan, /v1/brand/lookalikes, /v1/brand/evidence. Detection only, not a finding of fraud.",
  "category": "security",
  "resourceUrl": "https://agent.pocket.network/v1/brand-protection",
  "priceUsd": "0.005000",
  "priceVersion": 1,
  "rails": [
    {
      "id": "base",
      "network": "eip155:8453",
      "chainId": 8453,
      "tokenAddress": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "tokenDecimals": 6,
      "payToAddress": "0xF732ea490c5766071785a2310523f7fA2CEbB829"
    }
  ],
  "paymentNetworks": [
    "eip155:8453",
    "eip155:4217"
  ],
  "paymentProtocols": [
    "x402",
    "mpp"
  ],
  "protocols": [
    "rest"
  ],
  "inputSchema": {
    "type": "object",
    "description": "The body of POST /v1/brand/scan. /v1/brand/lookalikes takes domain, with optional since and limit; /v1/brand/evidence takes evidence_id (24 hex characters, from a finding); GET /v1/brand/watched lists the brands under watch.",
    "properties": {
      "official_domains": {
        "type": "array",
        "minItems": 1,
        "maxItems": 5,
        "items": {
          "type": "string"
        },
        "description": "The brand's own domains, e.g. [\"uniswap.org\"]."
      },
      "brand": {
        "type": "string",
        "maxLength": 64,
        "description": "The brand name, e.g. Uniswap."
      },
      "keywords": {
        "type": "array",
        "maxItems": 10,
        "items": {
          "type": "string",
          "maxLength": 40
        },
        "description": "Extra words to look for in lookalikes."
      },
      "since": {
        "type": "string",
        "format": "date-time",
        "description": "Only findings new or changed after this time."
      },
      "limit": {
        "type": "integer",
        "minimum": 1,
        "maximum": 200,
        "description": "At most this many findings; default 50."
      }
    },
    "required": [
      "official_domains"
    ]
  },
  "outputSchema": {
    "type": "object",
    "description": "POST /v1/brand/scan answers the brand's report: findings, each with the lookalike domain, a 0-100 risk score, reasons and an evidence_id. lookalikes answers the lookalikes that exist now; evidence answers the fetch times, hashes and observations behind one finding. Errors carry an error field."
  },
  "methods": {
    "GET /v1/brand/watched": "read",
    "GET /v1/health": "read",
    "GET /v1/version": "read",
    "POST /v1/brand/evidence": "read",
    "POST /v1/brand/lookalikes": "read",
    "POST /v1/brand/scan": "read"
  },
  "example": {
    "method": "POST",
    "path": "/v1/brand/scan",
    "request": {
      "official_domains": [
        "uniswap.org"
      ],
      "brand": "Uniswap",
      "limit": 5
    },
    "response": {
      "portal": {
        "provenance": "third-party-supplier",
        "serviceId": "brand-protection",
        "schemaCheck": "unchecked"
      },
      "data": {
        "service": "brand-protection",
        "version": "0.1.8",
        "fetched_at": "2026-11-09T19:45:54.736Z",
        "brand_id": "uniswap.org",
        "brand": "Uniswap",
        "official_domains": [
          "uniswap.org"
        ],
        "as_of": "2026-11-09T09:43:27.975Z",
        "age_hours": 10,
        "scan_type": "full",
        "full_scan": "done",
        "collector_warnings": [],
        "method": "bp-risk/5",
        "coverage": {
          "candidates_generated": 310,
          "candidates_dns_checked": 310,
          "dns_errors": 25,
          "existing": 67,
          "full_checks": 67,
          "ct_hits": 0,
          "partial": false,
          "duration_ms": 45752
        },
        "since": null,
        "findings_total": 70,
        "findings_returned": 5,
        "findings": [
          {
            "domain": "uniswap-rewards.org",
            "fuzzer": "added-word",
            "risk": 55,
            "risk_level": "medium",
            "status": "live",
            "reasons": [
              "resolves to an address (+15)",
              "registered 30 days ago (+25)",
              "name adds a phishing-style word to the brand (+15)"
            ],
            "registered_at": "2026-10-09T19:59:05.472Z",
            "certificate_issuer": null,
            "title": "Contact Verification Suspension Page",
            "checked": "full",
            "evidence_id": "9daf9e618be40f259c34369a",
            "first_seen": "2026-11-04T00:20:37.013Z",
            "changed_at": "2026-11-06T21:45:06.096Z"
          },
          {
            "domain": "niswap.org",
            "fuzzer": "omission",
            "risk": 50,
            "risk_level": "medium",
            "status": "live",
            "reasons": [
              "resolves to an address (+15)",
              "registered 12 days ago (+25)",
              "TLS certificate issued 4 days ago (+10)"
            ],
            "registered_at": "2026-10-27T20:01:29.085Z",
            "certificate_issuer": "Let's Encrypt",
            "title": "Service Status",
            "checked": "full",
            "evidence_id": "1edcad58a9d3404187ce48cb",
            "first_seen": "2026-11-04T00:20:37.013Z",
            "changed_at": "2026-11-04T21:41:35.089Z"
          },
          {
            "domain": "uiswap.org",
            "fuzzer": "omission",
            "risk": 50,
            "risk_level": "medium",
            "status": "live",
            "reasons": [
              "resolves to an address (+15)",
              "registered 12 days ago (+25)",
              "TLS certificate issued 4 days ago (+10)"
            ],
            "registered_at": "2026-10-27T20:01:28.992Z",
            "certificate_issuer": "Let's Encrypt",
            "title": "Service Status",
            "checked": "full",
            "evidence_id": "406226422e6a6c9aa2efbb74",
            "first_seen": "2026-11-04T00:20:37.013Z",
            "changed_at": "2026-11-04T21:41:35.089Z"
          }
        ],
        "risk_scale": "0-100, higher means more signs of impersonation; 70+ high, 40-69 medium; unchecked means only DNS was read, so the page and registry have not been assessed and the number is a floor, not a verdict",
        "note": "Findings are observed signals (lookalike name, recent registration, fresh certificate, page copies the brand, wallet or password prompt), not a finding of fraud. Detection and evidence only. Fetch /v1/brand/evidence with a finding's evidence_id for fetch times and SHA-256 hashes."
      }
    },
    "capturedAt": "2026-11-09T19:45:55.570Z"
  },
  "firstParty": true,
  "networks": [
    "eip155:8453",
    "eip155:4217"
  ],
  "serving": true,
  "page": "https://agent.pocket.network/services/brand-protection",
  "descriptor": "https://agent.pocket.network/services/brand-protection/descriptor.json"
}