Guide
The first hour after you find a clone
What to capture before you report, why screenshots alone are usually rejected, and the order to file in.
Get the playbookHomeResources
Resources
What we know, written down.
How impersonation actually works, what platforms will and will not remove, and what to do in the first hour. No gated PDFs.
01 · Benchmark
What each platform will actually remove.
Median time from filing to written confirmation, and the share of notices that succeed. Longer bar, slower platform. Hollow tail, the ones that never come down.
- Instagram 1.2h 98% Fastest on cloned profiles with a verified original to compare against.
- TikTok 1.8h 97% Quick on likeness, slower on reposted audio.
- Facebook 2.4h 96% Consistent, and the appeal path is the clearest of the majors.
- YouTube 3.1h 95% Strike system helps; synthetic media is the slow category.
- Web & DNS 3.2h 95% Registrars vary hugely by jurisdiction; this is the blended figure.
- X 3.6h 92% Fast when it acts. Refusals are terse and rarely explained.
- LinkedIn 4.8h 98% Slowest of the majors to answer, most likely to act when it does.
- Telegram 9.4h 79% Channels move faster than reports do. Often needs a second filing.
- GitHub 11.2h 88% Hosts and code platforms: strong on credentials, slow on brand assets.
Removed
Refused or unanswered
Medians across monitored accounts. Your mileage varies by evidence quality.
And then they come back
A removal is not an ending.
Most operators rebuild. The same avatar and bio reappear on a new handle, or the same registrant takes a neighbouring domain. This is why a removed asset stays on watch instead of being closed.
Share of removed impersonations where the same operator reappears.
02 · Library
In progress.
These are the pieces being written first. Nothing is linked until it exists.
Guide
Reading a takedown refusal
What each platform's refusal language actually means, and which ones are worth appealing.
Get the playbook
Threat report
Impersonation on TikTok and Instagram
What we see across monitored creator accounts: volume, tactics and how fast clones are rebuilt after removal.
Get the playbook
Threat report
Lookalike domain economics
How typosquat portfolios are registered, monetised and recycled, and where they are cheapest to kill.
Get the playbook
Guide
Deepfakes and the evidence problem
Why synthetic media is harder to get removed than a fake profile, and what actually moves a platform.
Get the playbook
Playbook
Agency onboarding for a new roster
Getting fifty creators monitored in a week: what to collect, what to prioritise and what to ignore.
Get the playbook
03 · Reference desk
The routes that already exist.
You do not need us to use any of these. Knowing which one applies is most of the work, so here they are with what each is actually for.
Uniform Domain-Name Dispute-Resolution Policy
ICANN's process for domains registered in bad faith against a trademark you hold. Filed with an approved provider such as WIPO. Outcome is transfer or cancellation of the domain, not damages.
Use when You own the mark and the domain is being used to trade on it.
Notice and takedown
US copyright route for your own material republished without licence — video, images, text. Sent to the host's designated agent, and it must identify the work, the infringing copy and carry a good-faith statement under penalty of perjury.
Use when They are using your content, not just your name.
EU notice and action
Obliges hosting services operating in the EU to run a mechanism for reporting illegal content and to act on it with reasons given. Applies regardless of where you are, if the service serves EU users.
Use when A platform is ignoring its own reporting form.
Registrar abuse obligation
ICANN's Registrar Accreditation Agreement requires every registrar to publish an abuse contact and take reasonable steps to investigate reports sent to it. It is the lever behind most phishing-domain removals.
Use when The domain is actively phishing and you need speed, not ownership.
Impersonation reports
Every major platform has an impersonation policy separate from its copyright one. Reporting as the impersonated person, or their documented representative, is consistently treated faster than a third-party report.
Use when It is a cloned profile rather than stolen content.
Certificate Transparency
Public, append-only logs of every TLS certificate issued. A lookalike domain usually appears here the moment it gets a certificate — often days before it has any content on it.
Use when You want to see a domain before it is used against you.
General information, not legal advice. Which route applies depends on the mark you hold and where the service and the registrant sit — and on a bad day the answer is two of them at once.
04 · Glossary
The words that come up on the call.
Plain definitions for the terms you will meet in a takedown thread, a registrar reply or a security review.
- Brandjacking
- Taking over the public presence of a brand — handle, likeness, tone — to trade on the trust it has already earned.
- Certificate Transparency
- Public logs of issued TLS certificates. A lookalike domain often shows up here before it shows up anywhere else.
- Combosquatting
- A real brand name plus an extra word: yourbrand-support.com, yourbrand-login.net. No misspelling, which is why filters miss it.
- Credential harvesting
- A page built to collect logins rather than to sell anything. Usually a pixel-accurate copy of your sign-in screen.
- Deepfake
- Synthetic video or imagery generated to depict a real person doing or saying something they did not.
- Engagement farming
- A cloned account building followers on your identity first, then switching to scams once it looks credible.
- Homoglyph
- A character that looks like another — Cyrillic а for Latin a. Renders identically, resolves somewhere else entirely.
- Passive DNS
- Historical record of what a domain has resolved to over time. Shows infrastructure shared between assets that look unrelated.
- RDAP
- The structured successor to WHOIS for registration data. Same question, machine-readable answer.
- Sock puppet
- A secondary account operated by the same person to vouch for the first one.
- Typosquatting
- Registering the misspellings people actually type: yuorbrand.com, yourbrnad.com.
- UDRP
- The arbitration process for taking a bad-faith domain off a registrant. Ends in transfer or cancellation.
- Voice cloning
- A synthetic copy of a specific person's voice, typically trained on public recordings — a podcast is plenty.
- WHOIS
- The registration record for a domain: registrar, dates, and whatever contact detail is not behind a privacy service.
05 · Answers
The questions we get first.
Still unsure? Book a demo and we will run your first scan on the call.
Book a demoWhat does the free scan actually check?
Your name, brand and handles across the nine platforms we cover, plus lookalike domain registrations on every TLD. You get a ranked list with evidence for each hit, usually within a few minutes.
Do I need to hand over account access?
No. Everything we scan is public. Account access is only ever needed if you later ask us to file a platform report from your own verified account.
How long does a takedown take?
Detection to confirmed removal averages 3.2 hours. Social platforms are usually fastest; registrars and hosts vary by jurisdiction, and we chase them until we have written confirmation.
What happens when a takedown is refused?
You see the refusal and the reason in the same queue. We escalate through the platform's appeal path, and where that runs out we package the evidence so your counsel can act on it.
Can you catch deepfakes of me?
Yes — synthetic video, cloned voice and generated imagery are matched against your likeness, and each detection arrives with the source and a capture attached.
Does this work for a roster, not just one person?
Agencies run every client from one queue with per-client reporting, and white-label PDFs go out under your branding.
Is my scan data shared with anyone?
No. Detections belong to the account that ran them. Aggregate trend research never contains identifying detail from a customer account.
What happens to a threat after it is removed?
It stays on watch. Re-registration of the same domain, or a new account matching the same fingerprint, reopens the original case rather than starting a new one.
Skip the reading
Run the scan instead.
You will learn more about your own exposure in fifteen minutes than any guide can tell you.