# Lookalike / Typosquat Domain Scan (`advx/lookalert-domain-scan`) Actor Scan for registered lookalike and typosquatted domains impersonating a brand. Generates homoglyph, typo, TLD-swap and bitsquat permutations, verifies live registration via DNS and RDAP, checks liveness, and scores phishing risk. Allowlist-aware. JSON output for CI, monitoring and threat intel. - **URL**: https://apify.com/advx/lookalert-domain-scan.md - **Developed by:** [Sevastian Z](https://apify.com/advx) (community) - **Categories:** Developer tools, Automation - **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing $500.00 / 1,000 domain scans This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Lookalike & Typosquat Domain Scanner Find domains that impersonate your brand before they are used for phishing. Give it one brand domain; the Actor generates lookalike permutations, keeps the ones that are actually registered, enriches them, scores the phishing risk, and suppresses your own and allowlisted domains. ### What it does - **Permutations**: homoglyph, typo, transposition, omission, insertion, repetition, bitsquatting, hyphenation, TLD swap and addition. Multi-label TLDs (`co.uk`, `com.au`, ...) are handled. - **Registration check**: live DNS (NS, A, MX) plus RDAP for registrar and registration date. - **Liveness**: whether the lookalike actually serves content. - **Risk score** (0-100, low / medium / high) weighting registration, live status, mail records, certificate presence, recency and permutation confidence. - **Allowlist**: suppresses your own infrastructure and any domains you trust, so the results stay actionable. ### Input | Field | Type | Description | |-------|------|-------------| | `domain` | string, required | Brand domain to protect, e.g. `example.com` | | `depth` | `shallow` \| `medium` | `shallow` (default) does DNS + RDAP. `medium` also probes HTTP, TLS certificate and favicon to surface active phishing. | | `allowlist` | string[] | Known-legitimate domains to never flag (CDNs, partners) | | `checkCerts` | boolean | Also query Certificate Transparency per candidate (slower) | ```json { "domain": "example.com", "depth": "medium", "allowlist": ["cdn.example.com"] } ```` ### Depth levels - **Shallow** (default): is it registered, does it resolve, who is the registrar, when was it registered, does it answer HTTP at all. Fast. - **Medium**: shallow plus full HTTP response (status, Server header, final redirect target), TLS certificate (issuer, SAN count, expiry, valid yes/no) and favicon SHA-256 compared against your brand's favicon. A favicon match is the single strongest brand-impersonation signal and weights heavily in the risk score. Pricing is the same per run for both depths during this iteration. ### Output One dataset item per registered lookalike, highest risk first: | Field | Description | |-------|-------------| | `lookalike` | the impersonating domain | | `permutation_type` | how it was derived | | `score` / `band` | risk 0-100 and low / medium / high | | `registered` / `live` | registration and liveness | | `mx` / `ips` | mail and address records | | `registrar` / `created` | RDAP registrar and registration date | | `has_cert` | a TLS certificate was seen for it | When `depth=medium` the dataset gains: `http_status`, `http_server`, `http_final_url`, `tls_issuer`, `tls_san_count`, `tls_not_after`, `favicon_sha256`, `favicon_matches_brand`. ### Pricing Pay per event: **$0.50 per scan run**. One run scans a brand across all permutations and returns every registered lookalike found, regardless of how many domains were checked. ### Use cases - Brand and anti-phishing monitoring for security teams. - Pre-launch checks before a product or marketing campaign. - Feeding a SIEM or threat-intel pipeline with candidate phishing domains. ### Development ``` pip install -e ".[dev]" python -m pytest -q python -m lookalert.cli scan example.com python -m lookalert.cli lookup example.com ``` # Actor input Schema ## `domain` (type: `string`): Registrable domain to protect, e.g. example.com ## `depth` (type: `string`): shallow = DNS + RDAP only (fast). medium = also probe HTTP, TLS certificate and favicon to surface active phishing. ## `allowlist` (type: `array`): Known-legitimate domains to never flag (CDNs, partners) ## `checkCerts` (type: `boolean`): Also query Cert Spotter for each candidate (slower) ## Actor input object example ```json { "domain": "example.com", "depth": "shallow", "allowlist": [], "checkCerts": false } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("advx/lookalert-domain-scan").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("advx/lookalert-domain-scan").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call advx/lookalert-domain-scan --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=advx/lookalert-domain-scan", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Lookalike / Typosquat Domain Scan", "description": "Scan for registered lookalike and typosquatted domains impersonating a brand. Generates homoglyph, typo, TLD-swap and bitsquat permutations, verifies live registration via DNS and RDAP, checks liveness, and scores phishing risk. Allowlist-aware. JSON output for CI, monitoring and threat intel.", "version": "0.2", "x-build-id": "V6rb6dgwJnS1Y4cIC" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/advx~lookalert-domain-scan/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-advx-lookalert-domain-scan", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/advx~lookalert-domain-scan/runs": { "post": { "operationId": "runs-sync-advx-lookalert-domain-scan", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/advx~lookalert-domain-scan/run-sync": { "post": { "operationId": "run-sync-advx-lookalert-domain-scan", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domain" ], "properties": { "domain": { "title": "Brand domain", "type": "string", "description": "Registrable domain to protect, e.g. example.com" }, "depth": { "title": "Scan depth", "enum": [ "shallow", "medium" ], "type": "string", "description": "shallow = DNS + RDAP only (fast). medium = also probe HTTP, TLS certificate and favicon to surface active phishing.", "default": "shallow" }, "allowlist": { "title": "Allowlisted domains", "type": "array", "description": "Known-legitimate domains to never flag (CDNs, partners)", "default": [], "items": { "type": "string" } }, "checkCerts": { "title": "Check Certificate Transparency", "type": "boolean", "description": "Also query Cert Spotter for each candidate (slower)", "default": false } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```