# Typosquat Monitor — Find Fake Lookalike Domains (`alaudinburki/typosquat-brand-abuse-monitor`) Actor

Generate every plausible lookalike of your domain using 11 attack techniques (homoglyphs, keyboard slips, TLD swaps, combosquatting) and find which are registered - and critically, which have MX records and can receive phishing or invoice-fraud email. Free DNS, no key, no login.

- **URL**: https://apify.com/alaudinburki/typosquat-brand-abuse-monitor.md
- **Developed by:** [alaudin burki](https://apify.com/alaudinburki) (community)
- **Categories:** Business, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Typosquat Monitor — Find Fake Lookalike Domains

Find the domains impersonating your brand — **before your customers or your accounts-payable team fall
for one**. Generates every plausible lookalike using **11 attack techniques**, resolves each one, and
flags the dangerous ones: those that can **receive email**.

Free public DNS. **No API key, no login, no anti-bot.**

### Why this works differently

Most domain-monitoring tools **scrape a feed** of new registrations and match it against your brand —
so they only see what's already been registered *and* indexed, and they miss anything older.

This does the opposite: it **generates the threat universe from your brand**, then asks DNS which of
those actually exist. You get the complete lookalike space for your name, not a feed's leftovers.

#### The finding that actually matters

A lookalike that merely resolves is squatting — annoying, usually harmless.
A lookalike with **MX records can receive email**. That's the setup for:

- **Invoice fraud** — a supplier emails your finance team from `yourcompany-billing.com`
- **Credential phishing** — a "password reset" from a domain that looks identical

So `hasMailServer` is weighted far above mere registration in the threat score. That single column is
the reason to run this.

### The 11 techniques

| Technique | Example (`example.com`) |
|---|---|
| Omission | `exmple.com` |
| Repetition | `exaample.com` |
| Transposition | `exapmle.com` |
| Keyboard slip | `wxample.com` |
| Insertion | `exqample.com` |
| **Homoglyph** | `g0ogle.com`, `rnodern.com` (rn→m) |
| Vowel swap | `exemple.com` |
| Hyphenation | `ex-ample.com` |
| **TLD swap** | `example.cm`, `example.om`, `example.net` |
| **Combosquat** | `example-login.com`, `secure-example.com` |
| Bitsquat | single-bit flips (real hardware-error typos) |

Bolded ones are the deliberate-imitation classes, and they score higher than finger slips.

### What you get

| Field | Description |
|---|---|
| `domain` | The lookalike found |
| **`threatScore`** | 0–100, weighted by capability not just existence |
| **`threatLevel`** | `critical` · `high` · `medium` · `low` · `unregistered` |
| **`capability`** | `web_and_email` · `email_only` · `web_only` · `registered_only` |
| **`hasMailServer`** | ⚠️ the important one — can it receive phishing email? |
| `hasWebsite` / `ipAddresses` | Does it resolve, and where |
| `mailServers` | The MX records themselves |
| `technique` | Which attack class produced it |
| **`recommendation`** | Plain-language next action for that exact finding |
| `watchedDomain` / `checkedAt` | What was protected, and when |

### Input

```json
{
  "domains": ["yourcompany.com"],
  "checkEmailCapability": true,
  "registeredOnly": true,
  "maxVariantsPerDomain": 800
}
```

### Sample output

```json
[
  {
    "domain": "yourcompany-billing.com",
    "threatScore": 97,
    "threatLevel": "critical",
    "capability": "web_and_email",
    "hasMailServer": true,
    "hasWebsite": true,
    "technique": "combosquat",
    "registered": true,
    "watchedDomain": "yourcompany.com",
    "ipAddresses": "203.0.113.44",
    "mailServers": "10 mail.protonmail.ch.",
    "recommendation": "URGENT: resolves AND accepts email — capable of hosting a clone site and sending invoice/credential phishing. Investigate and file an abuse/UDRP complaint.",
    "status": "ok"
  }
]
```

### Typical uses

- **Brand protection** — find impersonators and send takedowns / UDRP complaints.
- **Finance fraud prevention** — hand the `email_only` list to your AP team as a blocklist. This is the
  cheapest invoice-fraud control you can run.
- **Pre-launch defensive registration** — turn `registeredOnly` **off** to see which close variants are
  still free, and buy the handful that matter.
- **Scheduled monitoring** — squatters register *after* you launch or get press. Run it monthly.
- **Agency service** — run it across a client portfolio and sell the report.

### Pricing

**$2.00 / 1,000 domains checked** (`$0.002` per result), plus a near-zero start fee. A typical 800-variant
scan of one brand costs well under a dollar. Never charged beyond `maxItems`.

### ⚠️ Read before you act on a hit

- **Registration is not proof of malice.** A lookalike may be an unrelated legitimate business, a
  reseller, or a defensive registration by someone else. **Confirm intent before you accuse anyone.**
- Treat this as **detection, not adjudication**. The MX-capable rows deserve human investigation; the
  rest are usually monitoring-only.
- **Homoglyph coverage is ASCII-based** (`0/o`, `1/l`, `rn/m`). It does not yet generate full Unicode/IDN
  punycode homographs (е.g. Cyrillic "е"), which are a real and separate attack class.
- Absence of a hit is not proof of safety — the generated set is broad but finite.

### FAQ & limitations

- **Do I need an API key?** No. It uses Cloudflare's public DNS-over-HTTPS.
- **Does it check WHOIS / registration dates?** Not yet — it infers registration from DNS. A parked
  domain with no records may still be registered, so `registeredOnly` can under-report slightly.
- **Does it screenshot the lookalike sites?** No. Pair it with the **Screenshot** actor for visual proof
  of a cloned site before filing a takedown.
- **How long does a scan take?** ~800 variants at 10 parallel lookups runs in a couple of minutes.
- **Can I narrow it?** Yes — pick specific `techniques` (homoglyph + combosquat + tld-swap are the
  highest-signal three) for a fast, cheap scan.

### Related actors

- **Website Screenshot** — capture visual evidence of a cloned site for your takedown request.
- **SSL Certificate Checker** — see what certificate a lookalike is presenting.
- **DNS Lookup** · **HTTP Header Analyzer** — dig further into a specific offender.

# Actor input Schema

## `domains` (type: `array`):

The domains to protect. Lookalikes are generated from these.

## `techniques` (type: `array`):

Leave empty to use all 11. Fewer techniques = faster, cheaper runs.

## `checkEmailCapability` (type: `boolean`):

Strongly recommended. A lookalike with MX records can RECEIVE EMAIL — that is invoice-fraud and credential-phishing infrastructure, and it is the single most important finding this actor produces.

## `registeredOnly` (type: `boolean`):

On by default. Turn off to also list unregistered variants you may want to defensively register.

## `minThreatScore` (type: `integer`):

Filter out low-signal hits. 40+ = medium, 60+ = high, 80+ = critical.

## `maxVariantsPerDomain` (type: `integer`):

Caps how wide the net goes. 800 is thorough; lower it for a fast scan.

## `tlds` (type: `array`):

Leave empty for the commonly abused defaults (.com .co .cm .om .net .org .io .app …).

## `comboWords` (type: `array`):

Leave empty for the defaults (login, secure, verify, billing, support …).

## `concurrency` (type: `integer`):

10 is a good balance.

## `maxItems` (type: `integer`):

Hard limit, strictly enforced.

## Actor input object example

```json
{
  "domains": [
    "yourcompany.com"
  ],
  "techniques": [],
  "checkEmailCapability": true,
  "registeredOnly": true,
  "minThreatScore": 0,
  "maxVariantsPerDomain": 800,
  "tlds": [],
  "comboWords": [],
  "concurrency": 10,
  "maxItems": 5000
}
```

# Actor output Schema

## `results` (type: `string`):

Registered lookalike domains with threat scores.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "yourcompany.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("alaudinburki/typosquat-brand-abuse-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": ["yourcompany.com"] }

# Run the Actor and wait for it to finish
run = client.actor("alaudinburki/typosquat-brand-abuse-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "yourcompany.com"
  ]
}' |
apify call alaudinburki/typosquat-brand-abuse-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,alaudinburki/typosquat-brand-abuse-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/GaI3Joa7cNo13wiLY/builds/Pkvwal4dLp08K7KG7/openapi.json