#!/usr/bin/env python3 """Brand impersonation monitoring agent. Monitors for brand impersonation by checking Certificate Transparency logs for suspicious domain registrations, performing DNS lookups for typosquatting domains, and scanning social media profile names. Uses crt.sh API and DNS resolution to identify potential phishing domains. """ import argparse import json import os import socket import sys from datetime import datetime, timezone try: import requests except ImportError: print("[!] 'requests' required: pip install requests", file=sys.stderr) sys.exit(1) def generate_typosquat_variants(domain): """Generate common typosquatting domain variants.""" name, tld = domain.rsplit(".", 1) if "." in domain else (domain, "com") variants = set() chars = "abcdefghijklmnopqrstuvwxyz0123456789" # Character omission for i in range(len(name)): variants.add(f"{name[:i]}{name[i+1:]}.{tld}") # Character swap for i in range(len(name) - 1): swapped = list(name) swapped[i], swapped[i+1] = swapped[i+1], swapped[i] variants.add(f"{''.join(swapped)}.{tld}") # Character replacement (adjacent keys) adjacent = {"a": "sq", "e": "wr", "i": "uo", "o": "ip", "u": "yi", "s": "ad", "n": "bm", "r": "et", "t": "ry", "l": "kp"} for i, c in enumerate(name): for adj in adjacent.get(c, ""): variants.add(f"{name[:i]}{adj}{name[i+1:]}.{tld}") # Character doubling for i in range(len(name)): variants.add(f"{name[:i]}{name[i]}{name[i:]}.{tld}") # Homoglyph substitution homoglyphs = {"o": "0", "l": "1", "i": "1", "e": "3", "a": "4", "s": "5"} for i, c in enumerate(name): if c in homoglyphs: variants.add(f"{name[:i]}{homoglyphs[c]}{name[i+1:]}.{tld}") # TLD variants for alt_tld in ["com", "net", "org", "io", "co", "info", "biz", "xyz"]: if alt_tld != tld: variants.add(f"{name}.{alt_tld}") # Prefix/suffix for prefix in ["my", "the", "get", "go", "login", "secure", "account"]: variants.add(f"{prefix}{name}.{tld}") variants.add(f"{name}{prefix}.{tld}") # Hyphen insertion for i in range(1, len(name)): variants.add(f"{name[:i]}-{name[i:]}.{tld}") variants.discard(domain) return sorted(variants) def check_domain_resolution(domains, max_check=200): """Check which typosquat domains actually resolve.""" resolved = [] checked = 0 for domain in domains[:max_check]: checked += 1 try: ip = socket.gethostbyname(domain) resolved.append({ "domain": domain, "ip": ip, "resolves": True, "severity": "HIGH", }) except socket.gaierror: pass print(f"[+] Checked {checked} domains, {len(resolved)} resolve to an IP") return resolved def search_certificate_transparency(domain): """Search crt.sh for certificates containing the brand name.""" print(f"[*] Searching Certificate Transparency for: {domain}") findings = [] try: resp = requests.get( f"https://crt.sh/?q=%25{domain}%25&output=json", timeout=30, ) if resp.status_code == 200: certs = resp.json() seen_names = set() for cert in certs: common_name = cert.get("common_name", "") if common_name not in seen_names and domain not in common_name.split(".")[-2:]: seen_names.add(common_name) findings.append({ "type": "ct_log", "common_name": common_name, "issuer": cert.get("issuer_name", ""), "not_before": cert.get("not_before", ""), "not_after": cert.get("not_after", ""), "severity": "MEDIUM", }) print(f"[+] Found {len(findings)} suspicious certificates") except requests.RequestException as e: print(f"[!] CT search error: {e}") return findings def format_summary(domain, variants_count, resolved, ct_findings): """Print monitoring summary.""" print(f"\n{'='*60}") print(f" Brand Impersonation Monitoring Report") print(f"{'='*60}") print(f" Brand Domain : {domain}") print(f" Typosquat Variants : {variants_count}") print(f" Resolved Domains : {len(resolved)}") print(f" CT Log Matches : {len(ct_findings)}") if resolved: print(f"\n Active Typosquat Domains (resolving):") for r in resolved[:20]: print(f" [{r['severity']:6s}] {r['domain']:40s} -> {r['ip']}") if ct_findings: print(f"\n Certificate Transparency Findings:") for f in ct_findings[:15]: print(f" {f['common_name']:40s} (issued: {f['not_before'][:10]})") def main(): parser = argparse.ArgumentParser(description="Brand impersonation monitoring agent") parser.add_argument("--domain", required=True, help="Brand domain to monitor (e.g., example.com)") parser.add_argument("--max-check", type=int, default=200, help="Max domains to DNS-check") parser.add_argument("--skip-ct", action="store_true", help="Skip Certificate Transparency search") parser.add_argument("--skip-dns", action="store_true", help="Skip DNS resolution check") parser.add_argument("--output", "-o", help="Output JSON report") parser.add_argument("--verbose", "-v", action="store_true") args = parser.parse_args() variants = generate_typosquat_variants(args.domain) print(f"[*] Generated {len(variants)} typosquat variants for {args.domain}") resolved = [] if not args.skip_dns: resolved = check_domain_resolution(variants, args.max_check) ct_findings = [] if not args.skip_ct: ct_findings = search_certificate_transparency(args.domain.split(".")[0]) format_summary(args.domain, len(variants), resolved, ct_findings) report = { "timestamp": datetime.now(timezone.utc).isoformat(), "tool": "Brand Monitor", "domain": args.domain, "variants_generated": len(variants), "resolved_domains": resolved, "ct_findings": ct_findings, "risk_level": ( "CRITICAL" if len(resolved) > 10 else "HIGH" if resolved else "MEDIUM" if ct_findings else "LOW" ), } if args.output: with open(args.output, "w") as f: json.dump(report, f, indent=2) print(f"\n[+] Report saved to {args.output}") elif args.verbose: print(json.dumps(report, indent=2)) if __name__ == "__main__": main()