We ran our own anti-impersonation product on our own domain

TL;DR — we ran BossBot Anti-Impersonation against bossbot.uk
this afternoon (2026-07-20). In 30 seconds it found 5 registered
bossbot.* domains, ran WHOIS on each to resolve the registrar's
abuse contact, and generated a signed takedown package for the
most-suspicious one. Then we ran HTTP GET on each to separate parked
squatters from active infrastructure. Two out of five look like
genuine post-launch impersonation attempts. Full data below.

The rest of this post walks through the raw findings, how the workflow
resolved contacts, and what we learned about our own scanner while
running it on ourselves.

Why we did this

We built the Anti-Impersonation module to give SMBs the same
brand-protection workflow that Bolster ($8K+/yr) and PhishLabs
($20K+/yr) reserve for enterprise. Before selling it, the honest
test is: does it work on our own brand?

Answer: yes — with two caveats we found and fixed during the run.

The scan (30 seconds)

$ python -m bossbot.anti_impersonation run_scan \
    --client bossbot_sales --domain bossbot.uk --name BossBot
[antiimp] bossbot.uk: 5 typosquats registered, 0 social handles

Five results, all registered:

• bossbot.org
• bossbot.co
• bossbot.net
• bossbot.io
• bossbot.biz

Registered ≠ impersonating. Some are old squatters; some are recent
registrations that could actually be impersonation attempts. Without
context, they look identical. So the tool ran WHOIS on each and we
ran HTTP GET on each to separate the piles.

WHOIS enrichment

The takedown module shells out to whois and extracts registrar,
creation date, and abuse contact via four fallback regex patterns:

Domain	Registrar	Created	Abuse contact
bossbot.biz	Global Domain Group LLC	2026-06-19	[email protected]
bossbot.org	NameCheap, Inc.	2025-02-26	[email protected]
bossbot.co	GoDaddy.com, LLC	2016-10-07	[email protected]
bossbot.net	GoDaddy.com, LLC	2016-10-07	[email protected]
bossbot.io	Network Solutions	2023-11-21	[email protected]

Two things jumped out:

1. .biz was registered a month ago. Post-BossBot-launch. High
   suspicion.
2. .co and .net were registered on the exact same day in 2016
   by the same registrar. Same owner, bulk-registered, decade-old
   squatters — not impersonators.

We also found a coverage gap: our first pass didn't parse .co
because the default whois server (whois.nic.co) DNS-resolved
inconsistently on our VPS. We added a per-TLD fallback map
(.co → whois.godaddy.com, .io → whois.nic.io, etc.) and got
100 % parse coverage. Fix is in the linked commit.

Live-or-parked check

WHOIS says who owns a domain, but not what they're doing with it.
Curl'ing each domain says a lot more:

Domain	HTTP status	Body
bossbot.biz	520 (Cloudflare error)	Cloudflare-fronted, origin unreachable
bossbot.org	403 (awselb/2.0)	AWS Elastic Load Balancer with auth wall
bossbot.co	200 → /lander	GoDaddy parked domain landing page
bossbot.net	200 → /lander	Same GoDaddy parked landing (byte-identical to .co)
bossbot.io	406 (Apache)	Old misconfigured server

New ranking after HTTP verification:

• 🔴 bossbot.biz — recent registration + Cloudflare front +
  origin down. Classic infrastructure setup for a
  domain-being-prepared-for-something. Highest priority.
• 🟡 bossbot.org — AWS ELB behind a 403 auth wall. Someone
  deployed real infrastructure at this hostname. Could be legit
  (staging, personal project) or could be impersonation behind a
  login screen. Needs a manual look.
• ⚪ bossbot.co / .net — parked, same owner, decade-old. Not
  urgent.
• ⚪ bossbot.io — pre-brand misconfigured server, ambient noise.

The takedown package

We hit "Start takedown" on bossbot.biz in the dashboard. In a few
hundred milliseconds:

1. Contact resolved — [email protected] (via WHOIS).
2. Email template rendered with our real business context
   (BossBot (KZENOFFRAME STUDIO LLC), bossbot.uk) — subject
   Trademark abuse / phishing report — bossbot.biz impersonating bossbot.uk.
3. HMAC signature over
   (takedown_id, client_id, target, initiated_at) — cryptographic
   receipt that BossBot generated this at 2026-07-20 12:55 UTC.
   Tampering with any of those four fields invalidates the signature.
4. Evidence pack — signed PDF (~30 KB) with cover page,
   structured tables, HMAC watermark on every page footer, and raw
   WHOIS output at generation time. Suitable for registrar abuse
   forms or attaching to legal counsel briefings. Plain-text
   fallback available at .txt endpoint for callers that can't
   handle PDF.

The customer's workflow ends here: open the mail client (mailto: link
pre-fills subject + body), send the abuse message, attach the
evidence pack, come back to the dashboard, mark as sent. Status
transitions all the way through sent → responded → resolved.

What we're actually doing with these findings

Transparency, not marketing:

• bossbot.biz — the takedown package is ready in our dashboard
  as a draft. We're not sending it yet. Cloudflare+520 is
  suspicious but not proof of impersonation. Before filing an abuse
  complaint we'll: (a) monitor DNS + HTTP daily for a week, (b) see
  if origin ever recovers, (c) check MX records for phishing-prep
  patterns.
• bossbot.org — we're going to email the AWS ELB endpoint's
  Registrant Organization directly (from NameCheap WHOIS) and ask
  what they're doing. Might be a legit hobby project.
• .co, .net, .io — no action. Squatting is legal; if we
  want them we'd buy them, not report them.

What the run told us about our own product

Two real improvements landed the same day:

1. .co WHOIS parser — added TLD-specific fallback server map.
2. Social handle scanner returned 0 for bossbot.uk — either we
   have no active social presence to compare against (possible: our
   brand is very new) or the scanner needs coverage improvements.
   Manual audit next week.

Two things worked exactly as designed:

1. Idempotency — running the scan twice creates ONE row per
   finding, not five. scan_count bumps, first_seen_at stays put.
2. HMAC receipts — regenerated the evidence pack a minute later,
   byte-identical to the first. Deterministic signing means the
   customer can prove exactly what BossBot generated at exactly what
   time, months later.

The pitch

If you own a domain that customers depend on, some fraction of the
character-substitution variants are already registered. Some are
harmless squatters. Some aren't. The difference matters.

BossBot Anti-Impersonation: $29/month. Weekly scans, WHOIS-
enriched findings, mailto-ready abuse templates, HMAC-signed evidence
packs. The workflow that comparable enterprise tools charge
$8,000+/year for, delivered in the SMB tier.

Sign up: bossbot.uk/antiimp-signup

Or email [email protected] and we'll run a free scan on your
domain first. Same output as above — 30 seconds, honest report.

---

Written 2026-07-20 by the founder. Commit refs:
315248a6 (data model), 84655d72 (findings UI), 871a7afb (takedown
workflow), b5766b04 (alerts + digest), 3ee0714e (product un-gated
for sale).