IMPOSTR: Digital Risk Protection for Social & App Monitoring
IMPOSTR finds fake social-media profiles, fake brand pages, scam accounts and look-alike mobile apps that impersonate a brand. It scores each one from 0 to 100, explains every flag in plain words, and never flags the brand's own accounts and apps. The app runs in the browser at https://impostr.live; no account is needed: choose "Continue as demo" on the sign-in page, or create a free company account (work email required) to keep your work. Each workspace starts with the demo brand PhonePe, monitored on live data only.
Start here
How each requirement is met
- Brand Profile: a three-step setup records the legitimate assets: brand name, aliases, official logo, description, keywords, official social accounts, official apps, publisher and domains. Each official app is validated on Google Play or the App Store (developer ID, store title, icon), and the profile drives every check.
- Official assets are excluded first: every candidate is checked against the profile before any scoring (official app ID or handle, official link, verified developer account, publisher name with supporting details, the same app on the other store). Official and likely official items get risk 0 and are never stored as threats; the allowlist is checked again just before a detection is saved.
- Social Media Monitoring: impersonation accounts, fake brand pages and scam profiles found live (Telegram directly, YouTube through its official API, Instagram, Facebook, X, LinkedIn, Threads, Pinterest, Quora, Snapchat and ShareChat through a web search for public pages), found by look-alike name, copied logo (perceptual hash, including mirrored and recoloured copies), copied bio, "official/helpline" claims and scam behaviour (requests for OTP or fees, lures, moving to WhatsApp, brand-new accounts).
- App Store Monitoring: Google Play and the Apple App Store are searched live. Suspicious apps are found by similar name, copied icon, a different developer or publisher (including fakes that copy the company name under another developer account) and a resembling description. The brand's official apps and their sibling apps are recognised and not flagged.
- Look-alike names (bonus): character swaps, missing or doubled letters, look-alike characters (0 for o, 3 for e, Cyrillic letters), added words and spacing changes, while ordinary words, other companies' names and openly labelled fan, news or third-party pages stay Low.
- User experience: setup in three steps or straight from a search; each detection shows its reasons, a score breakdown and evidence checks, with actions to confirm, request a takedown, mark a false positive or mark official. Each source has its own timeout and retries and falls back to cached results, so an unavailable source never stops a scan.
Evidence you can open directly (JSON)
- https://impostr.live/api/accuracy: the labelled PhonePe test set run live through the engine: 31 of 31 cases correct, precision 1.0, recall 1.0, 0 of 8 official assets flagged.
- https://impostr.live/api/search?query=PhonePe&platforms=google_play,app_store: a live search of both app stores; PhonePe's official apps are listed under "official" with risk 0, look-alikes under "results" with reasons, signals and evidence checks.
- https://impostr.live/api/search?query=paytm&platforms=telegram,instagram,facebook,x,youtube: live social search: real impersonation and scam accounts scored, with the brand's official accounts excluded.
- https://impostr.live/api/search?query=ph0nepe_support: look-alike name analysis step by step (field "nameAnalysis").
- https://impostr.live/api/sources: every source with its mode (live, or not connected) and health.
Data disclosure: everything shown is found live; there is no sample data. WhatsApp, Discord, Moj and Josh have no search API, so their public pages are found through web search. A source whose API key is not set is shown as not connected, never filled with made-up results. The Accuracy page runs a separate labelled test set, marked as such.
