---
title: "Find brand abuse across the IOC corpus"
method: POST
path: "/v1/metered/brand-monitor"
tags: ["Vendor and organisation risk"]
---

# Find brand abuse across the IOC corpus

`POST /v1/metered/brand-monitor`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/brand-monitor`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Scans the full IOC corpus for your brand name and classifies what it finds into phishing domains, malware C2 infrastructure, dark web mentions, and logo or image mentions extracted by OCR from infostealer-archive screenshots.

**Billing.** $0.35 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object
  - `brand` string, required: Brand name to search for. Minimum 3 characters, matched case-insensitively.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `brand` string: The lowercased brand searched.
    - `matched` boolean: True when any mention was found.
    - `total_mentions` integer: Total corpus hits, capped at 500.
    - `phishing_domains` integer: Hits classified as phishing domains or URLs.
    - `malware_c2` integer: Hits carrying a malware family attribution.
    - `dark_web_mentions` integer: Hits from criminal channels or credential dumps.
    - `image_logo_mentions` integer: Hits from OCR of screenshots in infostealer archives.
    - `hits` object: Up to 20 sample hits per category.
      - `phishing` object[]: Phishing samples.
        - `ioc_value` string: The indicator itself.
        - `ioc_type` string: Indicator type: ip, domain, url, hash, email, wallet, image_text.
        - `source` string: Feed or criminal channel it was observed in.
        - `malware` string: Malware family it was observed alongside, lowercase. Empty when unattributed.
        - `last_seen` string: Most recent sighting timestamp.
      - `malware_c2` object[]: Malware C2 samples.
        - `ioc_value` string: The indicator itself.
        - `ioc_type` string: Indicator type: ip, domain, url, hash, email, wallet, image_text.
        - `source` string: Feed or criminal channel it was observed in.
        - `malware` string: Malware family it was observed alongside, lowercase. Empty when unattributed.
        - `last_seen` string: Most recent sighting timestamp.
      - `dark_web` object[]: Dark web samples.
        - `ioc_value` string: The indicator itself.
        - `ioc_type` string: Indicator type: ip, domain, url, hash, email, wallet, image_text.
        - `source` string: Feed or criminal channel it was observed in.
        - `malware` string: Malware family it was observed alongside, lowercase. Empty when unattributed.
        - `last_seen` string: Most recent sighting timestamp.
      - `image_logo` object[]: Logo/image samples.
        - `ioc_value` string: The indicator itself.
        - `ioc_type` string: Indicator type: ip, domain, url, hash, email, wallet, image_text.
        - `source` string: Feed or criminal channel it was observed in.
        - `malware` string: Malware family it was observed alongside, lowercase. Empty when unattributed.
        - `last_seen` string: Most recent sighting timestamp.
    - `recommendation` string: Recommended action.

## Other responses

- `400`: `brand` is missing or shorter than 3 characters.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)