Brand Abuse Takedowns: Lookalike Domains and Fake Accounts Handled by Policy

Lookalike domains, fake recruiters and a queue that changes weekly

Brand abuse reports come from customers, staff and monitoring: a domain one letter off the company's, a login page that copies the real one, an account on X using the logo to sell fakes, a LinkedIn page posting jobs in the company's name. The takedown policy sorts each report into urgent phishing, standard takedown, monitor or no action, using what the report shows, how many people it reaches and how long it has been open.

The report register is in Attio, the policy and weekly notices are in Google Drive, the evidence sits on X and LinkedIn themselves, filings and status requests run through Gmail, and the team talks in Slack. When counsel widens the phishing definition mid-week, the reports it now covers have to be found and filed that day, not at the next weekly filing.

Who works in the room

The takedown queue runs in one Kylon room, and an automation opens the weekly filing every Monday morning. As the default agent, Ryan picks up any message that names no one, which is usually a question about how a report was classified. Filings and status replies go to Fin, and the weekly digest is Myco's to check. When Ryan moves a report to urgent, it mentions Fin with the evidence links and the policy clause, and Fin prepares the filing for the lead to approve and send.

One week of the queue

Every notice is read against the policy the room guidelines point to. Ryan reads X and LinkedIn for evidence only and never posts there.

A memo, a sweep and two resellers

A wider phishing definition changes the queue in one step. Counsel's memo might say a page that collects any personal details, not only passwords, now counts. Ryan re-checks every open report against the full policy, not only the ones the memo mentions, and any report that becomes urgent goes straight to Fin for a filing that day. A registrar sweep works the same way: confirmed suspensions are marked, and the rest of the queue is re-checked in case the sweep changed anything else.

An authorized reseller notice is the opposite case. The partnerships manager confirms that two accounts are legitimate resellers, and Ryan marks them in Attio. That does not close them. A reseller can still run a domain that copies the login page, so each one goes through the full policy again, and only what the policy clears comes off the queue.

What the checks catch

• A domain report judged from a screenshot in an email instead of the fields on its Attio record
• A report that became urgent under the wider phishing definition but is waiting for the weekly filing
• An authorized reseller closed without a full re-check of its other activity
• A status reply that rounds the reach figure or skips the ticket status, or a second reply on a thread that already has one

What stays with people

• Approving every disposition and filing before Attio changes or anything is sent
• Interpreting a policy memo when a report sits on the line
• Sending every takedown request and status reply, which Fin drafts in Gmail
• Confirming which accounts are authorized resellers

Integrations in this workflow

Kylon is not a brand protection service and it does not replace one. It sits across the register, the evidence and the mailbox the team already uses, and the room is where those pieces meet.

• Attio
• Gmail
• Google Drive
• LinkedIn
• Slack
• X (Twitter)

• Attio holds the report register with disposition, reach, days since report and ticket status, plus the close-out records
• X (Twitter) is read for evidence posts and account details, never posted to
• LinkedIn is read for evidence on company pages that claim the brand
• Google Drive keeps the takedown policy and every weekly notice and memo
• Gmail carries takedown requests and status replies through drafts a person sends
• Slack is where staff flag new reports and counsel posts urgent changes

Where to start

Start with one week of reports. Connect Attio and the Drive folder that holds the policy, and the room guidelines need one rule: any change to the policy or to a report's facts re-checks the whole open queue, and the brand protection lead approves every filing before it goes out.

“A wider definition only helps if the reports it now covers are filed the same day.”

Set it up with your agent

Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.