Censys Guide Shows How to Detect Brand-Impersonation Infrastructure

Oct 9, 2026 · Original article ↗

Summary

Censys outlines a layered approach to finding brand impersonation across certificates, domains, web content, and infrastructure, then clustering related hosts, monitoring findings, and preparing evidence-based takedowns.

Key points

Public certificate transparency logs can expose lookalike domains early, but miss infrastructure using plain HTTP or self-signed certificates.
Queries for typosquats, brand-prefix domains, copied page content, favicons, and analytics identifiers can surface impersonation sites.
Reputation scores and shared infrastructure attributes help triage candidates and connect related operations.
Historical DNS data can reveal rotating infrastructure; one USPS smishing investigation identified 682 unique lookalike hostnames across seven IPs.
Distinguishing origin servers from CDN edges and relays helps direct takedown requests to the appropriate provider.
Censys recommends including first-seen time, screenshots, certificate fingerprints, infrastructure context, and specific impersonation artifacts in takedown reports.

Article Details

Defense Focus: Detect and investigate brand impersonation by monitoring public internet infrastructure, matching attacker-used hosts against brand-specific artifacts, pivoting from initial indicators to related infrastructure, and supporting evidence-based takedowns.
Detection Methods: Monitor newly logged Certificate Transparency precertificates for brand names, and review lookalike certificate names.
Search hostnames for brand typosquats, brand prefixes, and flattened-dot variations; exclude official domains and expected alternatives to reduce noise.
Search HTTP titles and page content for brand names, login-page labels, brand assets, analytics IDs, and other unique identifiers; also inspect headers and redirect chains.
Match favicon SHA-256 hashes to find copied sites, including sites serving locally hosted copies or bare-IP pages.
Prioritize candidates using host reputation scores and phishing or deceptive threat classifications, intersected with brand matches.
Pivot from seed hosts, domains, certificates, and web properties using shared certificate, banner, body, and other uncommon attributes; use historical DNS and scan records to find rotated infrastructure.
Review owned web properties for KEV vulnerabilities, end-of-life software, and dangling DNS risks.
Check lookalike domains' DNS records, including MX and SPF-related TXT records, to assess potential email use.
Data Sources: Certificate Transparency logs and certificate history
DNS records and historical DNS resolution data
HTTP page titles, bodies, headers, redirect chains, and favicons
Host and web-property scan history
Host reputation scores, threat classifications, and related Censys intelligence signals
TLS certificates, certificate fingerprints, and issuing CA details
WHOIS contacts, autonomous-system data, and network and privacy classifications
Brand-owned analytics identifiers, templates, and other site artifacts
Rule Types: CenQL queries for certificate, hostname, web-content, favicon, reputation, and asset-risk searches
Continuously re-evaluated Censys Collections with webhook notifications
Defensive Actions: Save recurring searches as Collections and route new precertificates, likely lookalikes, high-confidence artifact matches, and owned-surface risks to appropriate triage queues.
Use brand-owned favicon hashes, analytics IDs, verification tokens, page titles, and template artifacts as high-confidence comparison signals.
Treat a suspicious finding as a seed; pivot across shared attributes and historical DNS records to identify related and rotated infrastructure.
Determine whether a reported IP is an origin, CDN edge, relay, or compromised device before selecting a takedown recipient.
Include the defanged URL, first-seen time, screenshot, certificate fingerprint, IP role, and evidence of impersonation in takedown requests.
Review abuse and administrative contacts, hosting-provider details, and certificate issuer information to direct reports to the responsible party.
Monitor owned assets for KEVs, end-of-life software, and dangling DNS, and route findings to the asset-owning team.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`account-protection-team[.]icu`	Listed as an indicator associated with the UNC1151 phishing campaign.
DOMAIN	`check-account[.]digital`	Listed as an indicator associated with the UNC1151 phishing campaign.
DOMAIN	`gta-six-leaks[.]com`	Fake CAPTCHA site used to induce ClickFix self-infection during the GTA VI leak wave.
DOMAIN	`headshotz[.]ai`	Site identified as a pixel-perfect copy of the Roblox homepage.
DOMAIN	`mail-secure-login[.]digital`	Listed as an indicator associated with the UNC1151 phishing campaign.
HOSTNAME	`beta[.]eggywall[.]cc`	Seed domain for a cluster of Roblox lookalike infrastructure identified through shared banner and body hashes.
HOSTNAME	`bigmir-net[.]cc[.]cd`	Hostname used by UNC1151 to impersonate a Ukrainian portal.
HOSTNAME	`google[.]2oauth[.]com`	Carrier host in the same MP4 malware cluster as the Binance-themed payload.
HOSTNAME	`i-ua[.]cc[.]cd`	Hostname used by UNC1151 to impersonate a Ukrainian portal.
HOSTNAME	`meta-ua[.]cc[.]cd`	UNC1151 impersonation hostname; the article describes a live impersonation page served through this infrastructure.
HOSTNAME	`r[.]oblox[.]com[.]et`	Host rendering a spoofed Roblox homepage.
HOSTNAME	`redirect[.]rbxinfra[.]net`	Roblox-impersonating hostname shared by related infrastructure and dressed to resemble Roblox plumbing.
HOSTNAME	`usps[.]xupqnqz[.]one`	SMS lure hostname in the USPS smishing investigation.
HOSTNAME	`verification-service[.]cc[.]cd`	Listed as an indicator associated with the UNC1151 phishing campaign.
IPV4	`43[.]157[.]174[.]200`	Tencent Cloud IP resolved from the initial USPS smishing link and used to pivot to related campaign hostnames.
IPV4	`45[.]194[.]44[.]46`	Campaign IP queried to retrieve the live META.UA impersonation page.
URL	`hxxp[:]//binance-idexchange[.]com/333[.]mp4`	Malicious payload-stage URL contacted by a PowerShell dropper.