BlackDome Brand Monitoring
BlackDome watches two live signal sources for your brand: ThreatDrop email analysis and BlackDome honeypot telemetry. Matching detections become dashboard alerts, email or webhook notifications, and tracked provider-notification, reply, and observed takedown-workflow status.
How It Works
1. BlackDome parses ThreatDrop email assessments for impersonated brands and phishing infrastructure.
2. BlackDome scans honeypot HTTP captures for monitored brand terms, domains, and lure copy.
3. Matching detections create `blackdome_brand_alerts` records and notify your configured destinations.
4. Eligible workflows record provider-notification attempts, replies, and observed status through the existing ThreatDrop abuse-report flow.
Setup Guide
1. Start from the signup flow and choose a Brand Monitoring tier.
2. Provide the brand name plus the legitimate domains your team controls.
3. Set the alert mailbox. Webhook delivery can be added later from the dashboard.
4. After Stripe confirms payment, BlackDome creates your first monitor and emails your API key, docs link, and dashboard URL.
API Endpoints
Use `Authorization: Bearer bd_<48_hex_chars>` when integrating programmatically.
Alert Format
Email alerts include the impersonating domain, captured URL, source, and evidence summary. Webhooks receive the full alert object:
{
"type": "blackdome.brand_alert",
"alert": {
"id": 42,
"alert_type": "brand_impersonation",
"source_type": "threatdrop_email",
"impersonating_domain": "acme-login-security.example",
"impersonating_url": "https://acme-login-security.example/login",
"status": "new",
"takedown_requested": false,
"monitor": {
"brand_name": "Acme",
"brand_domains": ["acme.com"],
"alert_frequency": "daily",
"provider_notification_status": "not_requested"
},
"evidence": {
"subject": "Reset your account",
"threat_type": "phishing",
"urls": ["https://acme-login-security.example/login"]
}
}
}Takedown Workflow Status
Pro plans can track provider-notification attempts, replies, and observed takedown-workflow status through the existing ThreatDrop abuse-report workflow. Candidate Enterprise pilots are contact-led and scoped before any delivery commitment. The workflow records available contact and evidence context against the alert; it does not guarantee a provider action.
Starter customers can review observed evidence and request workflow follow-up from the dashboard on a per-alert basis after upgrading.
Tier Comparison
| Tier | Price | Brands | Alerting | Takedown |
|---|---|---|---|---|
| Starter | $29/mo | 1 | Weekly | Manual request from dashboard |
| Pro | $99/mo | Up to 5 | Daily | Tracked provider-notification workflow + manual request |
| Candidate Enterprise pilot | Contact us | Scope agreed in pilot | Scope agreed in pilot | Contact-led evidence-workflow discussion |