Detection
What we detect — and what we do not
A short, specific list is more useful than a long, vague one. Here is what Guardian actually finds, with examples, and an equally plain statement of what falls outside it.
Look-alike and abusive domains
Registered domains that imitate yours through character substitution, added words, alternative extensions or homoglyphs — and whether they currently resolve, serve content or hold a certificate.
- Character substitution and homoglyph variants
- Added-keyword variants such as -support or -billing
- Alternative TLDs serving cloned content
- Newly issued certificates for look-alike names
Impersonation of people and organisations
Public profiles that present themselves as you, your executives or your organisation — including cloned biographies, copied photography and profiles that solicit contact or payment.
- Cloned executive profiles on professional networks
- Fake support or recruitment accounts
- Copied biography and photography
- Profiles soliciting payment or personal data in your name
Logo and visual asset misuse
Use of your logo, product photography or visual identity on properties you do not control, including visually similar marks intended to be mistaken for yours.
- Your logo on an unaffiliated storefront
- Visually similar marks in the same category
- Reused product photography in third-party listings
Counterfeit and unauthorised listings
Marketplace listings that use your brand, images or product identifiers without authorisation.
- Listings using your brand name and imagery
- Duplicated product identifiers
- Sellers claiming an authorised-reseller relationship
Fraudulent storefronts and payment surfaces
Sites that reproduce your storefront, checkout or brand presentation in order to take payment from your customers.
- Cloned storefront templates
- Checkout pages carrying your branding on an unrelated domain
- Discount or clearance sites claiming affiliation
Reputation manipulation
Publicly observable patterns in reviews, forum activity or coordinated posting that misrepresent your organisation.
- Clustered review activity
- Coordinated posting patterns referencing your brand
- Misattributed statements in public discussion
Institutional and registry misrepresentation
Claims of registration, accreditation, partnership or official status that public registries and directories do not support.
- Unsupported accreditation claims
- Fabricated partnership or client claims
- Misrepresented corporate registration details
Limits
What Guardian cannot tell you
Every one of these is a real limit of an observation service that works only from public sources. We state them here rather than in a footnote, because they change what the report is worth to you.
- Anything occurring in private, closed or access-controlled spaces — private messages, closed groups, internal systems.
- Whether a breach of your own systems has occurred. Guardian observes the outside, not your infrastructure.
- The legal identity of whoever is behind an observed asset. We record what is publicly attributable, not who someone really is.
- Whether a given use is lawful. That is a legal determination, and we do not make it.
- Complete coverage. Sources change, content is removed and indexes lag; the absence of a finding is not proof that nothing exists.
- Whether a platform will act on a report. We prepare it as strongly as the evidence allows; the decision is theirs.