Typosquat & Brand Domain Monitor: Find the Fakes Before Your Customers Do

Generate every plausible lookalike of your domain, find out which are already registered, and see which of those can serve a website or send email. Run it on a schedule and you hear about a new lookalike the day it is registered — usually days before it is pointed at your customers.

Built for brand, security and legal teams who currently find out about a phishing domain from a customer complaint.

How it works

flowchart LR
    A["yourbrand.com"] --> B["Generate lookalikes:<br/>typos, homoglyphs,<br/>login-yourbrand, other TLDs"]
    B --> C["DNS: does it exist?"]
    C -->|no| D["available"]
    C -->|yes| E["RDAP: registrar, age"]
    E --> F["Website? Mail records?"]
    F --> G["Risk score"]
    G --> H[("Newly registered<br/>= the alert")]

DNS does the cheap first pass, so thousands of candidates reduce to the handful that actually exist before anything heavier runs. A real run checked 105 lookalikes of apify.com in under 4 seconds and found 34 registered.

The score is about capability, not similarity

A parked domain nobody has wired up is a nuisance. One with both a website and mail records is a phishing kit waiting for a target list. The score weights exactly that:

Signal	Why it matters
Registered	Someone owns it
Has a website	It can serve a fake login page
Has mail records	It can send email that looks like it came from you
Homoglyph pattern	Using rn for m or 0 for o is deliberate, not a typo
login- / -secure affix	Built to look like your sign-in page
Registered in the last 30 days	Fresh registrations are the ones that get used

Built for

• Security teams watching for phishing infrastructure before a campaign starts
• Brand and legal teams building evidence for a UDRP complaint or takedown
• Ecommerce operators whose customers get targeted with fake stores
• Anyone deciding which defensive registrations are actually worth paying for

Input

{
  "domains": ["yourbrand.com"],
  "onlyRegistered": true,
  "onlyChanged": true
}

Setting	What it does
domains	The brand domains to protect
strategies	Which typo patterns to generate
extraTlds	Check your exact name under other extensions
includeAffixes	Also generate login-yourbrand.com style names
onlyRegistered	Turn off to see what is still available to register defensively
onlyChanged	Only newly registered lookalikes — the scheduled-alert setting

Output

{
  "brand": "apify.com",
  "candidate": "appify.com",
  "strategy": "repetition",
  "isRegistered": true,
  "hasWebsite": true,
  "hasMx": true,
  "registrar": "GoDaddy.com, LLC",
  "registeredAt": "2019-04-02T10:15:00Z",
  "ageDays": 2725,
  "riskScore": 80,
  "riskLevel": "high",
  "riskReasons": [
    "The domain is registered.",
    "It serves a website.",
    "It has mail records, so it can send email that looks like yours."
  ],
  "changeType": "unchanged",
  "checkedAt": "2026-09-17T18:33:10.442Z"
}

riskReasons is written in plain language so a row can be pasted straight into a ticket or a takedown request without translation.

Turn it into a brand alert

{
  "domains": ["yourbrand.com"],
  "onlyChanged": true
}

Schedule it daily. The first run maps what already exists. Every run after returns only newly-registered, website-appeared and mail-configured — the three transitions that mean someone is preparing to use a domain against you.

Run it as an API

curl -X POST "https://api.apify.com/v2/acts/arched_friend~typosquat-monitor/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["yourbrand.com"],
    "onlyRegistered": true
  }'

Pricing

You pay $0.02 for each brand domain monitored, however many hundreds of lookalikes that generates.

Watching 3 brand domains daily	Monthly cost
Checking by hand	not realistically possible
Brand protection services	$200 to $2,000 per month
This Actor	$1.80 per month

Common questions

Does a registered lookalike mean I am being attacked? No. Many are owned by domain investors, by your own company, or by someone with a genuinely similar name. That is why the output separates parked domains from ones with a website and mail configured.

Why is a domain "registered" when nothing loads? Because it resolves — it has nameservers even if no web server answers. That is the normal parked state, and it is worth knowing about before a page appears on it.

Can it check every TLD? It checks your name under the extensions you list, plus typo variants of your existing extension. Checking all 1,500 extensions would be slow and mostly noise; the list defaults to the ones squatters actually use.

Does it work for .co.uk? Yes. Two-part suffixes are handled properly, so yourbrand.co.uk generates yourbrnad.co.uk rather than nonsense.

Related products

• Domain & SSL Monitor to watch expiry and certificates on the domains you own
• Website Change Monitor to watch a lookalike once it starts serving a page
• Email Deliverability Checker to confirm your own SPF and DMARC are strong enough to blunt a lookalike sender
• Tech Stack Checker to profile what a suspicious lookalike is actually running