Domain Typosquatting Audit

Audit lookalike-domain mutations with bounded, DNS-only evidence. The Actor returns observed A, AAAA, MX, and NS records plus an explicit UNKNOWN state for resolver failures. It does not determine domain availability, use HTTP or browser scanning, query WHOIS/RDAP, recommend purchases, or make a phishing verdict.

Use it as a typosquat checker, lookalike-domain inventory, domain impersonation review, brand-protection input, or reproducible DNS audit. Treat every result as a point-in-time DNS observation, not as ownership, intent, or registrability evidence.

Input

Field	Required	Default	Contract
domains	Yes	example.com in the Store UI	One to five ICANN registrable root domains
mutationFamilies	No	bitsquatting, hyphenation, omission, transposition	Allowlisted dnstwist mutation families
maxVariantsPerDomain	No	200	Deterministic hard cap, range 25–400
dnsTimeoutMs	No	1000	Per-record timeout, capped by the remaining run deadline
overallDeadlineSec	No	60	One absolute deadline for the full batch, range 5–300

Example:

{
  "domains": ["example.com"],
  "mutationFamilies": ["bitsquatting", "hyphenation"],
  "maxVariantsPerDomain": 100,
  "dnsTimeoutMs": 1000,
  "overallDeadlineSec": 60
}

Domains are normalized to lowercase ASCII IDNA. The Actor accepts only an ICANN eTLD+1 recognized by the offline Public Suffix List bundled with pinned tld==0.13.2. It rejects URLs, credentials, ports, IPs, subdomains, public suffixes, unknown or reserved suffixes, and PSL PRIVATE-section hosting suffixes before mutation generation or DNS work.

Dataset rows

Each variant row contains:

• normalized inputDomain, generated variantDomain, and fuzzer;
• status: REGISTERED_EVIDENCE, NO_DNS_EVIDENCE, or UNKNOWN;
• DNS arrays dnsA, dnsAAAA, dnsMX, and dnsNS;
• hasMx, evidenceAt, latencyMs, and exact queryCount;
• domain-level scanStatus, stable failureCode, and truncation state.

REGISTERED_EVIDENCE means at least one target DNS record was observed without a resolver anomaly. NO_DNS_EVIDENCE means a complete NODATA pass or authoritative NXDOMAIN produced no target record. It does not mean the domain is available. Timeout, SERVFAIL, REFUSED, missing nameservers, and other DNS faults remain UNKNOWN; they are never rewritten as no-evidence results.

Non-result conditions use the same flat schema with rowType = DIAGNOSTIC. Trustworthy rows are retained when a later deadline, billing, or runtime failure stops the run.

OUTPUT summary

The OUTPUT key-value record contains run and per-domain completeness, generated/selected/scanned/query counts, typed status counts, and:

{
  "billing": {
    "pricingModel": "FREE",
    "eventName": "domain-audit-completed",
    "eligibleDomainCount": 1,
    "chargedDomainCount": 0,
    "billingLimitReached": false,
    "billingFailureCode": null
  }
}

No price, user budget, token, account information, raw resolver exception, or monitoring payload is emitted.

Pay per event behavior

The same source supports private FREE operation and pay-per-event operation. Charging is dormant unless the effective Apify pricing model is PPE. When PPE is active, the only custom event is domain-audit-completed, issued at most once for one domain after its dataset rows and latest OUTPUT are durable.

A domain is eligible only when it is COMPLETE, generated and scanned at least one variant, has unknownCount == 0, and was not truncated or stopped by a deadline, generator, PSL, billing, or persistence failure. The exact Store daily test—one example.com with all schema defaults—is non-billable. Diagnostics, summaries, UNKNOWN, incomplete domains, and synthetic events are not separately charged.

Before each PPE domain, the Actor checks the remaining event budget. If it cannot fund another event, it performs no mutation or DNS work for that domain or any remaining domain, returns BILLING_LIMIT_REACHED, and preserves an INCOMPLETE summary. A failed charge never changes the DNS status and fails the run with BILLING_CHARGE_FAILED after preserving the result.

Determinism, safety, and limits

• Python 3.14, 512 MiB, and a 360-second platform timeout are the release contract; the Actor's own maximum input deadline is 300 seconds.
• Mutations come from official elceef/dnstwist tag 20250130, commit 4e6e477e95049067a7fe41fd8512e332abe26e95, then are normalized, deduplicated, sorted, and capped.
• The Actor uses platform DNS only. There is no user-controlled resolver, executable, argument list, URL, proxy, secret, task, schedule, or Standby mode.
• A durable same-run execution guard blocks resurrection or retry from repeating DNS work or billing.

Attribution and validation

The upstream Apache-2.0, tld tri-license, and Public Suffix List MPL-2.0 notices are preserved in NOTICE. Runtime dependencies and the Python 3.14 base image are pinned by exact versions, hashes, and image digest.

In a full source checkout, the dependency-free contract suite is:

~/.codex/bin/codex-python -m unittest discover -s tests -v
~/.codex/bin/codex-python -m compileall -q dnstwist_actor tests scripts

Dependency installation, apify run, Docker, live DNS canaries, benchmarks, private cloud builds, and browser QA run only through the registered OpenClaw workspace. Tests, operational scripts, receipts, GO cards, and monitor state are excluded from the Actor upload.