Set up Brand Monitor
Create a watcher, tune its threshold and allowlist, and know what to expect in the first days.
A watcher takes a minute to create. Getting it quiet enough to trust usually takes a few days of tuning — this page covers both.
Create a watcher
Open Watchers
DomainRadar → Brand Monitor → Watchers → New Watcher — "Monitor Certificate Transparency logs for domains containing this keyword."
Fill in the form
- Keyword — your brand term ("e.g. norcube"). Minimum 3
characters; a duplicate of an existing watcher's keyword is rejected.
Distinctive beats generic:
norcubeis a great keyword,cubewill bury you in noise. Note that fuzzy matching only kicks in from 5 characters. - Notification email — "[email protected]" — where alerts go. Leave empty to collect hits without emailing.
- Minimum notification score — 0–100, default 30. "Only notify for hits with a score above this threshold."
- Allowlist — "e.g. norcube.com, norcu.be" — comma-separated domains to ignore entirely. Start with everything you own.
- Enable AI content check — "Use AI to analyze detected domains for brand impersonation risk." Recommended whenever the keyword isn't rare — see why.
Create
Click Create Watcher. It's live within about half a minute and matches new certificates from then on (no historical scan). First hits — if the keyword is at all common — usually appear the same day in Brand Monitor → Detections.
Tune the threshold
Start at the default 30 and adjust to your email volume:
- Too many emails → raise it (50, 70). Below-threshold hits still land in Detections for periodic review — you lose noise, not visibility.
- Afraid of missing something → keep it low and enable AI content check; the AI verdict pushes real impersonations far above the threshold while coincidences stay put.
- Persistent false positives from specific domains → add them to the allowlist as they appear. The allowlist is exact-match, so each legitimate domain needs its own entry.
For high-noise brand words, several narrow watchers beat one broad
one: norcube- (with the hyphen) catches norcube-login.com without
matching every mention of the bare word.
Edit, pause, delete
From the watcher's detail page (click it in the list):
- Edit opens the same form plus an Enabled checkbox — the pause switch. Disabled watchers stop matching (the list shows Paused) but keep their configuration and full hit history.
- Delete removes the watcher and all its detections — the dialog says exactly that, and it cannot be undone. Pause instead if you might come back.
Config changes (keyword, allowlist, threshold) take effect within about half a minute — the matcher reloads watchers continuously.
What it costs
Enabled watchers are metered while active; paused ones aren't. AI content checks bill per run, only when a hit triggers one. Reviewing detections is free. Rates: pricing.
Related
- Watchers and hits — reading and triaging what the watcher produces.
- Configure alerts — routing and reducing the emails.