Skip to content
Brand Protect Docs

Quickstart

This guide walks you through the first scan: completing your brand profile, starting a scan, and reading the results.

1. Complete your brand profile

Section titled “1. Complete your brand profile”

The platform gates scanning on a complete profile. Open the Account page (/account) and fill in:

  • Identity — your brand name.
  • Owned domains — the domains you control (e.g. oktoboot.io). These are the seeds for lookalike generation.
  • Brand names — alternate names an attacker might impersonate.
  • Social handles — your official handles (PLATFORMS = twitter, linkedin, instagram, facebook, youtube, tiktok, github).
  • Keywords — terms associated with your brand, e.g. product names. The AI keyword expansion can infer these for you.
  • Webhook URL — optional; receives scan-completion notifications.

2. Start a scan

Section titled “2. Start a scan”

On the dashboard, click Start scan.

The scan runs through the eight pipeline stages. The dashboard’s “nerve center” shows a seven-phase SVG timeline (domain enumeration → auditing), a progress bar, and per-stage progress. Findings stream into the tables live over ActionCable (with a 2-second JSON poll as a fallback).

3. Read the results

Section titled “3. Read the results”

Domain findings table

Section titled “Domain findings table”

Sortable, filterable, resizable columns; 15 rows per page; a column-visibility dropdown. Click [ + ] on a row to expand its debug panel: signal strengths/weights/contributions, phishing flags, the AI summary, notes, and per-signal evidence.

Social media section

Section titled “Social media section”

Monitored handles plus social findings, with detection method, match signals, and cross-links. 10 rows per page.

Infrastructure campaigns

Section titled “Infrastructure campaigns”

Domains sharing a host IP or DNS A-record are clustered into campaigns. After the scan, LLM-written narratives explain each campaign.

Reports

Section titled “Reports”

When the scan completes, the platform automatically generates:

  • A full client report (PDF).
  • A one-page executive summary (PDF).

Both are served from the dashboard and are also delivered to your webhook as base64.

4. Triage the findings

Section titled “4. Triage the findings”

Open the Triage page to review findings as an analyst:

  • Filter by severity, unlabeled vs all, and AI-flagged false positives.
  • Mark each finding confirmed or benign (optionally with a reason).
  • Bulk-label with the checkboxes.
  • Generate a takedown email draft for a confirmed finding.

Your labels feed the adaptive learner, which tunes the scoring weights over time.

What you should see

Section titled “What you should see”

A healthy first scan produces:

  • A handful of lookalike domains (more for busy brand names).
  • Enrichment data on each (registrar, IP/ASN, HTTP fingerprint, screenshot).
  • A severity score and AI audit for medium+ findings.
  • Two PDF reports.
  • Campaign clusters for domains sharing infrastructure.

Next steps

Section titled “Next steps”