Social Media Monitoring
Brand Impersonation Detection
Brand Impersonation Detection
// Overview
A production module inside a Security Command Center (SCC) platform that watches social media for accounts and posts impersonating the organization's brands, fake support handles, scam giveaways, lookalike profiles, scores each one with an AI reasoning agent, groups related activity into campaigns, and feeds confirmed impersonations straight into the takedown queue.
// Background
The challenge
Thousands of social-media alerts per day, genuine
impersonations buried, coordinated attacks invisible.
Volume buried the signal
Keyword feeds surfaced thousands of posts; genuine
impersonations got lost in fan accounts and brand content.
Real threats hidden in a sea of noise
The judgment is genuinely hard
Telling an official account from a convincing impersonation
needs brand context, handles, logos, tone, not keywords.
Text alone can't make this call
Images carried the scam
Much of the fraud lived in the picture, fake promo
banners, cloned logos; text-only triage missed it.
Visual fraud invisible to text-only filters
Coordinated campaigns looked like noise
A single actor running dozens of lookalike accounts
appeared as disconnected alerts; no operation view.
One campaign, a hundred unlinked alerts
Net effect
Analysts were hand-reviewing a keyword firehose
with no multimodal tools and no campaign view.
// Solution
Social media triage, multimodal agent + campaign clustering
Data sources
Brand-protection feed
commercial brand-mention alerts
ingest → raw landing
Brand knowledge base
handles · products · cases
Qdrant vector index
Pipeline
Ingest
Airflow · ingest
raw landing
Ingest
Classify
BERT
Ray Serve
Classify
Analyze
DSPy ReAct
text + vision
Analyze
Materialize
campaign cluster
atomic fact swap
Fact
Portal
Vue 3 + FastAPI
+ feedback
Serve
↳ other alert classes → routed to their own flows
Airflow · BERT precheck (Ray Serve) · multimodal agent (text + vision + RAG) · campaign clustering · feedback overlay
// Impact
Triage: manual → automated agent
Before · by hand
hand-review keyword firehose · text-onlyAfter · agent verdict
text + image + brand RAG → verdict6
verdict classes, explainable
Operational impact
Multimodal accuracy
image + text catches logo/banner fraud
Campaigns made visible
clusters lookalikes into one case
Grounded, explainable verdicts
brand-RAG: citable, auditable calls
Closed loop to remediation
confirmed cases → takedown queue
Non-destructive feedback
overrides kept, source data intact
Every run traced
agent steps replayable for audit
Results
Verdict classes
6
Coverage
100%
Reasoning steps
~5
Autonomous triage
24/7
Verdict · scores · keywords per
alert · campaign grouping.
// Tech Stack
| Layer | Technologies |
|---|---|
| Orchestration | Apache Airflow (ingest → precheck → analyze → fact stages), Papermill |
| Ingestion | Commercial brand-protection feed, Python requests, pandas |
| ML precheck | Fine-tuned BERT (Transformers), MLflow (champion), Ray Serve |
| Analysis agent | DSPy ReAct agent, LLM reasoning, vision LLM for image analysis, Qdrant brand-knowledge RAG tool, Laminar trace capture |
| Data store | PostgreSQL (raw landing + OLAP fact tables), psycopg / SQLAlchemy |
| Backend API | FastAPI, in-memory CacheStore, async workers |
| Frontend | Vue 3, Quasar, Vite, TypeScript, Pinia, TanStack Vue Query, ECharts |
// Architecture & Diagrams
Posts and accounts are pulled from threat-intel vendors, analysed by an AI agent for sentiment and relation to the brand, prioritised, aggregated and served to analysts.
Disclaimer: sample visuals may contain anonymized, simulated, or non-production values for presentation purposes.