Brand Reputation Monitor

Comprehensive brand reputation threat intelligence engine that runs 8 sub-actors in parallel and applies four proprietary scoring models -- Brand Threat Assessment, Domain Impersonation Detection, Review Authenticity Analysis, and Narrative Drift Tracking -- to produce a DEFCON-rated threat report with immediate action items and monitoring recommendations. Optionally compares your brand's threat profile against competitors.

Features

• Monitors brand protection alerts, social media mentions (Bluesky), multi-platform reviews, and Trustpilot reviews for threat signals
• Detects domain impersonation campaigns by analyzing SSL certificate transparency logs for recently issued lookalike certificates and WHOIS records for newly registered squatting domains
• Analyzes review authenticity using rating distribution patterns (J-curve detection), review burst detection (48-hour clustering), duplicate content analysis, and single-review account detection
• Tracks narrative drift through Wayback Machine historical snapshots and real-time website change monitoring to detect messaging shifts and content manipulation
• Produces a composite DEFCON threat level (1-5) with prioritized immediate actions and ongoing monitoring recommendations
• Supports competitor brand analysis for comparative threat benchmarking

Use Cases

• Brand Managers: Monitor your brand's reputation health across reviews, social media, and domain impersonation. The DEFCON rating provides an at-a-glance threat assessment, while the individual scoring models pinpoint exactly where threats originate.
• Corporate Communications Teams: Detect coordinated negative review campaigns before they escalate. Review burst detection and authenticity analysis identify fake review attacks within hours of launch.
• Legal and IP Protection Teams: Identify domain squatting and impersonation campaigns. The impersonation detection model flags recently registered lookalike domains and fraudulent SSL certificates for takedown action.
• Crisis Management Teams: Track narrative drift and messaging changes that signal an emerging crisis. Major content revisions and website changes are surfaced with alerts for rapid response.
• Digital Risk Protection Services: Provide clients with quantified brand threat assessments. The structured DEFCON output, signal list, and action items translate directly into client-facing risk reports.

How to Use

1. Click Try for free on this page
2. Enter the brand name to monitor (e.g., "Nike")
3. Optionally provide the brand's primary domain and competitor brand names
4. Click Start and wait for the run to finish
5. Download results from the Dataset tab in JSON, CSV, or Excel

Input Parameters

Parameter	Type	Required	Description
brand	string	Yes	Brand or company name to monitor for reputation threats (e.g., "Nike")
domain	string	No	Primary brand website domain for WHOIS lookup, SSL certificate analysis, and content monitoring (e.g., "nike.com")
competitors	array	No	Optional list of competitor brand names to include in comparative analysis

Output Example

{
  "brand": "Nike",
  "domain": "nike.com",
  "compositeScore": 42,
  "overallThreat": "DEFCON_3",
  "brandThreat": {
    "score": 38,
    "defconLevel": 4,
    "impersonationDomains": 6,
    "negativeSentiment": 4,
    "reviewAttacks": 8
  },
  "impersonation": {
    "score": 55,
    "riskLevel": "MODERATE",
    "recentCertificates": 8,
    "newRegistrations": 3
  },
  "reviewAuthenticity": {
    "score": 35,
    "authenticityLevel": "MOSTLY_AUTHENTIC",
    "reviewBurstDetected": false,
    "suspiciousReviews": 4
  },
  "narrativeDrift": {
    "score": 28,
    "driftLevel": "MINOR_DRIFT",
    "contentChanges": 5,
    "majorRevisions": 1
  },
  "socialSentiment": { "positive": 45, "negative": 12, "neutral": 38 },
  "immediateActions": ["File domain takedown requests for impersonating domains immediately"],
  "monitoringRecommendations": ["Set up domain monitoring alerts for new lookalike registrations"]
}

Scoring Model

The composite score is a weighted average of four scoring models, mapped to a DEFCON threat level:

• Brand Threat Assessment (30% weight, 0-100): Brand protection alert severity scores up to 30 points. Impersonation via recently registered domains/certificates adds up to 25. Negative review ratio (40%+ negative) adds up to 25. Social media negative mentions with threat keywords (scam, fraud, boycott) add up to 20. DEFCON levels: 1 (critical, 80+), 2 (60-79), 3 (40-59), 4 (20-39), 5 (all clear, 0-19).
• Impersonation Detection (25% weight, 0-100): SSL certificate velocity (certificates issued in last 7 days) scores up to 40 points. WHOIS new domain registrations in last 90 days add up to 35. Total domain/certificate volume adds up to 25. Risk levels: CLEAR, LOW, MODERATE, HIGH, CRITICAL.
• Review Authenticity (25% weight, 0-100): Rating distribution analysis (polarized 1-star and 5-star clusters versus natural J-curve) scores up to 30 points. Review burst detection (5+ reviews in a 48-hour window) adds up to 25. Suspicious content patterns (very short reviews, generic language, duplicates) add up to 25. Single-review account prevalence adds up to 20. Levels: AUTHENTIC, MOSTLY AUTHENTIC, SUSPICIOUS, LIKELY FAKE, CAMPAIGN DETECTED.
• Narrative Drift (20% weight, 0-100): Wayback Machine content changes score up to 35 points, with major content revisions adding more. Recent website changes from the change monitor add up to 35. Historical snapshot depth adds up to 30. Levels: STABLE, MINOR DRIFT, MODERATE DRIFT, MAJOR DRIFT, NARRATIVE SHIFT.

DEFCON Threat Levels: DEFCON 5 (0-19, all clear), DEFCON 4 (20-39, low threat), DEFCON 3 (40-59, moderate threat), DEFCON 2 (60-79, high threat), DEFCON 1 (80-100, critical -- brand under active attack).

How Much Does It Cost?

Each brand analysis uses approximately $0.08-$0.12 in platform credits. Each competitor added runs a subset of 4 actors at approximately $0.04-$0.06 additional. On the Apify free tier you can run approximately 35-50 brand analyses per month.

Programmatic Access

Python

from apify_client import ApifyClient
client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("ryanclinton/brand-reputation-monitor").call(run_input={
    "brand": "Nike",
    "domain": "nike.com",
    "competitors": ["Adidas", "New Balance"]
})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript

import { ApifyClient } from "apify-client";
const client = new ApifyClient({ token: "YOUR_API_TOKEN" });
const run = await client.actor("ryanclinton/brand-reputation-monitor").call({
    brand: "Nike",
    domain: "nike.com",
    competitors: ["Adidas", "New Balance"]
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

FAQ

What is the DEFCON threat rating? Inspired by military readiness levels, the DEFCON rating provides an at-a-glance brand threat assessment. DEFCON 5 means all clear. DEFCON 1 means the brand is under active attack from multiple threat vectors (impersonation, fake reviews, negative social campaigns). DEFCON 1 and 2 trigger immediate action items.

How does review burst detection work? The algorithm scans review timestamps using a sliding 48-hour window. If 5 or more reviews appear within any 48-hour period, it flags a review burst as likely coordinated activity. Combined with single-review account detection and generic language patterns, this identifies fake review campaigns with high confidence.

What social media platforms are monitored? Currently monitors Bluesky for social sentiment. The social analysis uses keyword-based sentiment detection, flagging posts containing threat keywords like "scam", "fraud", "boycott", "lawsuit", and "ripoff" as negative signals.

How does domain impersonation detection work? It queries Certificate Transparency logs for recently issued SSL certificates matching the brand domain, and checks WHOIS records for newly registered lookalike domains. A spike in certificate issuance (3+ in 7 days) indicates an active impersonation campaign. Privacy-protected registrations with budget registrars are flagged as additionally suspicious.

Can I use this for continuous brand monitoring? Yes. Schedule the actor to run daily via Apify's scheduling feature. Integrate with Zapier or Make to send alerts when the DEFCON level changes or when specific threat scores exceed your thresholds.

Integrations

Use this actor with:

• Zapier for automated workflows
• Make for complex automations
• Google Sheets for spreadsheet export
• The Apify API for programmatic access