URL Category Data for Digital Risk Protection Platforms
Digital risk protection platforms watch the open web for threats to a brand: lookalike domains, fake shops, impersonation pages and leaked data. Their monitors find far more candidates than any analyst team can review.
This guide shows how URL category data sorts those candidates, which categories carry the signal, and how daily data catches an impersonation site before it goes live.
examplebank-secure-login.examplePhishingTakedown nowexamp1ebank.exampleParkedWatch dailyexamplebank-outlet.exampleShoppingReview for fakesexamplebakery.exampleFood & DrinkLikely unrelatedWhere category data plugs into digital risk protection
A digital risk platform already generates lookalike patterns and collects mentions of its customers' brands. Category data answers the next question for every hit: what kind of site is this, and how urgent is it?
Lookalike triage
Every domain that resembles a brand gets a category, so parked, live phishing, shop and unrelated sites go to different queues.
Impersonation detection
Sites in banking, finance or shopping categories with a brand in the name deserve faster review than blogs or local businesses.
Fake shops and counterfeits
Shopping and marketplace categories on lookalike domains point to counterfeit stores and fake outlet sales.
Leak monitoring context
Mentions found on file hosts, paste sites, forums or file sharing services get weighted by where they appear.
Takedown priority
Categories feed a priority score, so the request queue starts with the sites doing harm today.
Customer reporting
Monthly reports show lookalikes by category and how many moved from parked to live.
The life of an impersonation domain
Most impersonation domains follow a similar path. Category data shows where each one sits on that path, and the rechecks show when it moves to the next stage.
Registered
A new domain that resembles the brand appears in the daily feed.
Parked
The domain shows a parking page or nothing. It joins the watch list.
Goes live
A recheck finds a login page, a shop or brand content.
Acted on
Takedown request, blocklist entry and customer alert.
Kept in view
Taken down or parked again, but rechecked in case it returns.
Categories that matter for brand protection
The same lookalike name means very different things depending on what the site does. This table shows a sensible starting priority for each category when the domain resembles a protected brand; full definitions are on the category list.
| Category of the lookalike | Priority | What it usually means | Typical action |
|---|---|---|---|
| Malware / Phishing / Suspicious | Urgent | Live credential theft or malware delivery under the brand's name. | Takedown request, blocklist feeds, customer alert |
| Online Banking, Financial Services | Urgent | A finance site with a brand name it does not own is a strong impersonation sign. | Analyst review the same day |
| Shopping, Marketplaces / Classifieds / Auctions | High | Fake outlet stores, counterfeit goods or unauthorised resellers. | Review products and payment pages |
| Cryptocurrency | High | Fake giveaways and investment scams that borrow a well-known name. | Review and report |
| Web-based Applications | High | Fake portals and login apps built on site builders. | Check for brand logos and forms |
| Parked / For-Sale Domains | Watch | Not active yet, or held for resale. Often the stage before use. | Daily watch, defensive purchase review |
| Adult, Gambling | Watch | Brand abuse that harms reputation, or typo traffic sold on. | Reputation review, legal route |
| Business, Blogs/Personal Sites, Food & Drink and other content | Low | Often an unrelated business that shares a word with the brand. | Confirm and dismiss |
Lookalike patterns and how categories sort them
Your platform finds lookalikes through many patterns, and each pattern says how a name resembles the brand. The category says what the site actually does, and the two together give a far better ranking than either alone.
Patterns your platform detects
- Typos and swapped or doubled letters
- Look-alike characters, including international characters
- Brand plus words such as login, secure, support or outlet
- The brand under a different top-level domain
- Hyphenated and subdomain tricks
- Brand names combined with product, campaign or country words
What the category adds
- Whether the site is live at all, or parked
- Whether it is a shop, a finance site or a login page
- Whether it is a shared platform where only one page is abusive
- Whether it is an unrelated business with a similar name
- Changes over time from the daily feed and rechecks
- The content theme from the IAB labels, such as personal finance or travel
Leak monitoring: where mentions surface
Leaked documents, credentials and code tend to surface on a few site types. Category data tells your platform which type of site a mention came from, which shapes urgency and the right response.
Shared documents left open by mistake or posted on purpose.
Source code, keys and configuration files pushed to public projects.
Discussions offering data or access, and posts sharing samples.
Archives of documents or software spread outside official channels.
Groups and boards where data is traded or discussed.
Press reports about a breach, which change how a customer responds.
Short links that hide where a leak is hosted. Expand and recheck.
Very new sites with no label yet. Treat with care and recheck soon.
Delivery: daily files, API and real-time lookup
Brand monitoring is a matching problem: today's new and changed domains against every customer's watch list. Local files make that match fast, and the API covers single checks; formats are described on the web filtering database page.
Database and daily deltas
- CSV, Parquet or JSON
- Match each delta against all watch lists
- Track category changes per domain
- Runs inside your platform
Lookup API
- Included with licences
- On-demand checks during investigations
- Batch checks for new customer onboarding
- See the API documentation
Real-time lookup
- Local index inside your matching service
- Labels hits as monitors find them
- No outside call for each hit
- Same data as the files
Freshness: catching the switch from parked to live
In brand protection, a day can decide whether customers lose money. The update stream is built around new domains, with rechecks timed for when parked sites usually change.
Update stream
What to do with it
Building a takedown priority score
Takedown teams have limited capacity, so the order of the queue matters. A simple score that adds pattern strength, category and change signals works well as a starting point; the weights below are illustrative.
| Signal | Source | Example weight | Reason |
|---|---|---|---|
| Exact brand string plus a login or payment word | Your pattern engine | +30 | Names built to deceive customers at the point of trust. |
| Category is Malware / Phishing / Suspicious | Category data | +40 | Active harm, so it should top the queue. |
| Category is a finance, banking or shop type | Category data | +25 | The site does what the brand does, a strong sign of impersonation. |
| Changed from parked to live since the last delta | Category change | +20 | Fresh activity, often the start of a campaign. |
| Registered in the last 30 days | Your registration data | +10 | New domains carry more risk than old ones. |
| Established unrelated business category | Category data | minus 30 | Likely a name clash, not an attack. |
Category data in takedown evidence and customer portals
Customers and hosting providers both want to understand why a domain was flagged. A clear category label makes evidence packs and portal views easier to read.
Evidence packs
Show the category history next to screenshots and registration details, so the change from parked to live is plain to see.
Portal filters
Let customers filter their lookalikes by category, for example "show only live shops and login pages".
Alert wording
"A lookalike domain now runs a shop" tells a brand owner more than a generic risk score.
Partner sharing
Confirmed phishing domains can go into blocklist formats your partners accept, as covered in blocklist formats.
Defensive buying
Parked lookalikes held for sale can be flagged to the customer as purchase candidates.
Closure tracking
After a takedown, rechecks confirm whether the site stays down or returns under the same name.
Good practice and common mistakes
Brand protection teams that add category data tend to learn the same lessons. These are worth building in from the first release.
Good practice
- Look up the full host as well as the registered domain
- Keep every category change with its date for evidence
- Recheck taken-down domains for several months
- Tune priorities per customer sector
- Explain the category in every customer alert
Common mistakes
- Dismissing parked lookalikes instead of watching them
- Filing takedowns on unrelated businesses with similar names
- Treating a shared platform domain as fully malicious
- Updating the data monthly when deltas arrive daily
- Reading "no category" as "no risk"
Examples from digital risk platforms
These scenarios show how category data changes the daily work of a brand protection team. The brand names are invented for illustration.
A bank's weekend lookalike
A new domain with the bank's name and the word "verify" appears on Friday as parked. Monday's recheck shows a login page, and the takedown request goes out before the first phishing message lands.
Counterfeit outlet season
Before a holiday, dozens of lookalike shops appear for a fashion brand. The Shopping category puts them at the top of the queue, ahead of fan blogs that only mention the brand.
Keys in public code
A mention of a customer's internal hostname appears on a code hosting site. The category tells the analyst this is likely a configuration leak, not a news story, and the right team gets the alert.
Fewer false alarms
A brand with a common word in its name gets hundreds of lookalike hits a week. Filtering out established unrelated businesses leaves a short list that analysts can actually review.
Travel booking clones
An airline's monitor finds a cluster of new domains with booking words in the name. Two are categorized as Travel with payment forms, and the rest are parked, so the two live sites go to takedown and the others join the daily watch list.
Integration steps
These steps add category data to a digital risk platform. Most teams start with lookalike triage and add leak context and reporting later.
Load the database
Import the file, keyed by host and registered domain, next to your watch lists.
Label every hit
Add ranked categories to every lookalike and mention your monitors find.
Set priorities
Combine pattern strength and category into one priority score per hit.
Run the delta match
Match each daily delta against all customer watch lists and alert on changes.
Show the category
Display categories in analyst queues, customer portals and takedown evidence.
Report trends
Monthly counts of lookalikes by category and stage for each customer.
Digital risk protection FAQ
How does URL category data help digital risk protection?
Lookalike monitoring finds many domains that resemble a brand. Categories show which are parked, which host phishing, which run a shop and which are unrelated, so analysts can rank them.
Does the category database generate lookalike domains?
No, your platform generates and matches lookalike patterns. The category data tells you what each matching domain actually is.
Why does a parked lookalike domain matter?
Many impersonation domains sit parked before use. A change from parked to live content is one of the clearest signs that an attack is about to start.
How fresh is the data for brand monitoring?
About 300,000 newly registered domains are categorized every day as daily delta files. Each is checked again after a week and after a month, and all other domains are refreshed monthly.
Which categories matter most for brand impersonation?
Malware / Phishing / Suspicious, Parked / For-Sale Domains, Shopping, Marketplaces / Classifieds / Auctions, Online Banking, Financial Services, Cryptocurrency and Web-based Applications.
Can category data help find leaked data?
It helps you know where to look and how to weigh a hit. Leaks usually surface on file hosts, code sites, forums and file sharing services, and the site's category shapes urgency.
Is a lookalike domain always malicious?
No, many share a word with a brand by chance, such as a local business or a blog. Categories help separate those from real impersonation before anyone files a takedown.
Which licence fits a digital risk protection vendor?
An OEM licence, because the categories run inside a platform you sell. Group-wide licences cover vendors with several products.
Should we look up domains through the API or keep a local copy?
Keep a local copy for matching daily deltas against every watch list, and use the included lookup API for on-demand checks of domains your copy does not hold.
Can category data help with executive and social impersonation?
Partly, it labels the websites that impersonators link to, such as fake investment pages or login forms, which helps rank those cases. Monitoring social profiles themselves remains a job for your own collection tools.
Know what every lookalike domain really is
Tell us how many brands you protect, how your monitors find lookalikes and where your platform runs. We will suggest the data layout and licence that fit.
License the database OEM licensing