Proactive Corporate Brand Protection With Censys

To create a convincing brand imitation, the attacker needs to register a domain, obtain a certificate, set up a server, and place visual materials. Most standard security solutions focus on capturing already finished phishing pages, making the protection reactive. Censys offers a different approach: the platform indexes key elements of the internet infrastructure, allowing for tracking malicious activity before the resource becomes available to victims. By seeing domains, web properties, certificates, hosts, and DNS records, cybersecurity specialists can detect attack preparation at the earliest stages.

A TLS certificate allows a website to use HTTPS, which is critically important for cybercriminals since browsers warn users about unsecured connections. Obtaining a certificate for a domain like “{BRAND}-support[.]com” is completely legal and automated. However, modern browsers require the logging of public certificates in Certificate Transparency (CT) logs. The Censys platform ingests this data, allowing defenders to track certificate issuance mentioning their brand through “precert” status requests. This enables spotting a rogue domain before the phishing page is completed.

Cybercriminals constantly complicate masking tactics. Instead of typical word errors, they use the brand name as a prefix on their domain (e.g., “google[.]2oauth[.]com”), which on a mobile phone screen looks quite legitimate. During the study of the UNC1151 group’s activities, Censys experts detected the use of hyphens instead of dots to mimic Ukrainian portals (e.g., “meta-ua[.]cc[.]cd”). The platform’s toolset allows generating permutations and using regular expressions to automatically find such unconventional structures among billions of entries.

If the domain does not contain the company name, attackers are forced to copy original content to make the page appear convincing. Often, they do not simply download files but insert direct links to legitimate assets. For example, one of the clones of the Roblox page directly downloaded resources from the company’s official infrastructure. Another notable example concerns the phishing investigation under the guise of the USPS postal service: cybercriminals copied the original HTML code along with a working Google Analytics 4 tag. As a result, each load of the phishing site was recorded in the victim’s real analytics. Searching by own identifiers or favicon hashes allows finding such clones with high accuracy.

Every host in the Censys database receives a reputation score from 0 to 100 based on a machine learning model that considers compromise indicators, vulnerabilities, and WHOIS data. This helps quickly filter out informational noise. Furthermore, the Censys Investigator tool allows finding the entire network of an attacker with just one indicator. During the analysis of Roblox fakes, the platform transformed 3 suspicious domains into a cluster of 32 participants, relying on identical banner hashes and page structures. And preserving historical DNS data allows tracking infrastructure that constantly changes IP addresses.

Detecting a threat is only half the battle; for its elimination, a request must be sent to the appropriate provider (Takedown). Censys data allows clearly distinguishing the end servers of attackers (Origin), intermediate protective nodes like CDN/WAF (Edge), and compromised devices or proxies (Relay). Complaints about Edge addresses, which serve thousands of legitimate sites, will yield no results. The platform automatically marks these nodes and provides up-to-date abuse contacts of real hosting providers, significantly accelerating the process of eliminating hostile resources.

The main structural weakness of cybercriminals is that, to successfully imitate, they are forced to use original brand digital artifacts. Systematic monitoring of infrastructural traces with Censys solutions allows companies to transform passive protection into a proactive cyber intelligence process, stopping attacks before they reach users.

iiTD, as a distributor, offers advanced solutions for protecting information assets and network infrastructure. The expert team provides full project support from needs assessment to implementing attack surface analysis systems, helping partners find shadow infrastructure and reliably protect corporate brands from cyber threats.