What This Alert Means.
A fraudulent ad alert means a paid ad, usually in search results or a social feed, uses your name, logo or brand keywords to mislead people. The alert covers brand keyword hijacking, fake sponsored results, phishing landing pages reached through ads, and unauthorized affiliate advertising.
The ad is only the doorway. The risk sits on the landing page: a cloned login form, a counterfeit shop or a file download. MITRE calls the technique malvertising: buying ads to spread malware and place malicious pages in search results, often by impersonating known brands or cloning official websites.
Not every case is a crime. A reseller or affiliate may break your terms, or a platform's trademark rules, without stealing anything. The first job is to find out which case you face.
First 24 Hours.
Capture the ad and its destination, then find out who sees it and what it asks for.
- SOC analyst Open the alert from the Brandefense fraudulent ad detection module and save the ad text, image, advertiser name, platform and timeAds can be pulled or changed quickly
- SOC analyst Open the landing page only in an isolated browser and save each address in the click chain with screenshotsDo not enter any data
- IT admin Block the landing page domain on your web and email filtersLog the domain and its registrar
- Marketing lead Check that the ad is not from your own agency, partner or affiliateCompare the advertiser name with your approved list
- Customer support lead Prepare a reply for customers who report the adGive them your official addresses only
- Fraud team Look for customers who gave data or money through the landing pageStart your reset or refund process
- Legal Ask which platform trademark and fraud routes applyCheck with your legal counsel before any formal notice
Investigation Checklist.
Sort the ad into a type, because each type has its own removal route.
- Does the ad show your brand name or logo to a link that is not yours?This is impersonation
- Does it appear when people search your brand name, but sell something else or send people to a rival?This is keyword hijacking
- Does the landing page copy your login or payment form?Treat it as phishing and warn users
- Does it offer a file or app to download?Treat it as possible malware and test only in isolation
- Does it sell goods under your name at odd prices?Treat it as counterfeit promotion
- Is the advertiser account new, or does it run many ads across brands?Note the account name for the platform report
- Does the ad show only in some places, on some devices or at some times?MITRE notes attackers use dynamic routing to hide
- Do several ads share the same domain or page design?Report them as one network
Containment And Removal.
Report the ad and its landing page together, since removing one often leaves the other. Keep a log of each report, date and reply. If a report stalls, add evidence instead of sending it again.
- Ad platform report: use the report option on the ad, and the platform's form for scams, impersonation or trademark misuse. Give the advertiser name, ad text, landing page address and screenshots. Ask your legal counsel whether the brand owner should file the trademark complaint.
- Search or social feed report: if the same ad shows in both, report it on each platform, because they act on their own.
- Registrar abuse contact: report the landing page domain. ICANN says accredited registrars must publish an abuse contact and respond to reports.
- Hosting provider abuse contact: ask the host to disable the page and keep its logs.
- Affiliate program or network owner: for rogue affiliates, report to the program that pays them and to the network that tracks their sales.
- National CERT or law enforcement: in Turkiye, report through USOM (usom.gov.tr). USOM says its cyber reporting services are moving to www.siberguvenlik.gov.tr. In the US, file with the FBI IC3 if people lost money. In the UK, the NCSC takes reports of scam adverts and websites.
Longer-Term Hardening.
Ads happen outside your network, so prevention is limited. MITRE says as much. The goal is faster detection and a smoother report.
- Register your trademarks with ad platforms where they offer it, after you ask your legal counsel which marks apply.
- Write an affiliate and reseller policy that says what brand terms partners may bid on, and keep a list of approved advertisers.
- Track your own brand terms in search and social results on a routine, including common misspellings. MITRE notes attackers use intentional typos.
- Block known bad domains in your web filter and consider adblockers on managed devices, which MITRE says can help at the later stage.
- Tell customers where you advertise and that you never ask for passwords through ad links.
- Keep a report pack with your trademark details, official domains and contacts, so each report is quick.
How To Measure That It Worked.
Use figures from your own log. Do not rely on a general target.
- Live fraudulent ads: the number still running each week, by platform.
- Time to removal: days between your report and the ad coming down, per platform.
- Landing pages down: share of reported domains disabled by the registrar or host.
- Return rate: how often a removed advertiser comes back under a new account.
- Customer impact: support tickets, fraud cases or lost sales linked to the ads.
- Brand search clicks: traffic from your own brand terms that still reaches your site.
Common Mistakes.
These errors slow removal or hurt customers.
- Clicking the ad on a normal work device.
- Reporting only the ad and leaving the landing page and domain live.
- Treating every case as fraud. A partner or reseller may need a contract notice, not a takedown.
- Bidding against the ad instead of reporting it, which adds cost and leaves the fake online.
- Posting the landing page address in a public warning as a live link.
- Sending one screenshot when the ad shows only to some viewers.
- Sending legal notices without advice. Check with your legal counsel first.
Questions.
-
How do I report a scam ad that uses my brand?
Use the report option on the ad itself, or the ad platform's form for scams, impersonation or trademark misuse. Attach screenshots, the advertiser name and the landing page address. Ask your legal counsel whether a trademark complaint should come from your brand owner.
-
What is brand keyword hijacking?
It is when someone buys ads that show up when people search for your brand name, then sends them to their own site. It can be an affiliate, a reseller or a scammer. Some cases break platform rules and some do not, so check each platform's trademark policy.
-
Should I click the scam ad to see where it goes?
Not on a normal device. Ads can be tailored by place, device and time, and the landing page may carry malware. MITRE notes attackers use evasion such as dynamic routing. Use an isolated browser, and save the full chain of addresses with screenshots.
-
Can I stop ads before they run?
Mostly no. MITRE says this activity happens outside enterprise defenses, so prevention is hard. What you can do is register your trademarks with the platforms where possible, watch for misuse and report fast. Ask your legal counsel what trademark steps apply.
-
Who do I report to besides the ad platform?
Report the landing page domain to the registrar and the site to its hosting provider. In Turkiye use USOM, in the US the FBI IC3 if people lost money, and in the UK the NCSC, which takes reports of scam adverts.
Sources
This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.