# Domain Typosquat Scanner — Lookalikes & MX Risk (`bakos_bence/domain-typosquat-scanner`) Actor

Find registered look-alike domains that impersonate your brand — typos, homoglyphs, TLD swaps, and bitsquatting — with live DNS, MX intercept checks, and 0–100 risk scores. Schedule weekly monitor mode to surface only new or changed threats. Public DNS only; no login required for brand protection.

- **URL**: https://apify.com/bakos\_bence/domain-typosquat-scanner.md
- **Developed by:** [Bakos Bence](https://apify.com/bakos_bence) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: 5.00 out of 5 stars

## Pricing

from $12.50 / 1,000 look-alike domains

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Domain Typosquat Scanner — Lookalikes & MX Risk

Find **registered look-alike domains** that impersonate your brand — typos, homoglyph (IDN) spoofs, TLD swaps, bitsquatting, and more — then score which ones can send email.

Powered by [dnstwist](https://github.com/elceef/dnstwist) (Apache-2.0), the industry-standard domain permutation engine. This Actor is an unofficial integration and is not affiliated with or endorsed by the dnstwist authors. It resolves **public DNS** (and optional public WHOIS) — it never logs into target sites or scrapes private content.

> Use results for defensive brand protection and authorized security research. Comply with laws in your jurisdiction.

### What you get

Give it a domain (e.g. `yourbrand.com`) and it will:

1. Generate thousands of permutations (typos, swaps, homoglyphs, hyphenation, TLD substitutions, bitsquatting, …).
2. Resolve live DNS (`A` / `AAAA` / `MX` / `NS`).
3. Flag mail-capable look-alikes and **MX intercept risk** (whether mail hosts can catch mail meant for your domain).
4. Attach a **0–100 risk score** with plain-language reasons.
5. Optionally run in **monitor mode** so a weekly schedule returns only what is new, changed, or gone.

### Why teams run it

- Brand protection — catch domains squatting on your name before customers get phished
- Anti-phishing triage — prioritize rows with MX + intercept risk
- M\&A / vendor diligence — map impersonation exposure around a company domain
- Continuous monitoring — schedule weekly diffs without re-reading the full noise floor

### How to use

1. Enter your domain (`example.com` — no `http://`, no path).
2. Leave **Registered domains only** on.
3. Click **Start**. Each registered look-alike is one dataset row.
4. Export JSON / CSV / Excel, or pull via API. Add a schedule for monitor mode.
5. If a run fails, open the **Issues** tab on this Store page.

### Input

| Field | Description |
| --- | --- |
| `domain` | Brand domain to protect (required) |
| `registeredOnly` | Only resolving look-alikes (default `true`) |
| `maxResults` | Cap on billed rows (default 200) |
| `mailServerOnly` | Keep rows with MX records |
| `minRiskScore` | Drop rows below this score |
| `mxcheck` | Probe MX intercept risk (default `true`) |
| `whois` | Attach public WHOIS created/registrar (slower) |
| `fuzzers` | Optional comma-separated algorithm list |
| `timeout` | Scan timeout in seconds (default 300) |
| `threads` | Parallel DNS workers (default 16) |
| `monitorMode` | Diff vs previous run for the same monitor key |
| `monitorKey` | Optional watch name |
| `includeUnchanged` | Also return unchanged rows in monitor mode |

### Output

```json
{
  "inputDomain": "example.com",
  "variantDomain": "examp1e.com",
  "fuzzer": "homoglyph",
  "registered": true,
  "hasMailServer": true,
  "mxInterceptRisk": false,
  "riskScore": 60,
  "riskReasons": ["fuzzer:homoglyph", "mail_server"],
  "dnsA": ["203.0.113.10"],
  "dnsAAAA": null,
  "dnsMX": ["mail.example.net"],
  "dnsNS": ["ns1.example.net"],
  "whoisCreated": null,
  "whoisRegistrar": null,
  "scannedAt": "2026-08-30T12:00:00+00:00"
}
```

Monitor mode adds `changeType` (`new` / `changed` / `removed` / `unchanged`) and `changeDetail`.

### Pricing

Pay per look-alike row delivered (plus a small Actor-start fee). Store plan discounts apply — see the **Pricing** tab. Quiet monitor weeks that deliver no change rows bill the start fee only.

### Tips

- Watch `hasMailServer` and `mxInterceptRisk` first — those are the phishing-shaped hits.
- Use `minRiskScore` (e.g. 40) to keep exports tight for SOC ticketing.
- Schedule monitor mode weekly; leave `monitorKey` empty for a single automatic watch per domain.
- Raise `timeout` for huge brands or when `whois` is on.

### Attribution

Includes [dnstwist](https://github.com/elceef/dnstwist) © Marcin Ulikowski, licensed under the Apache License 2.0. See the project license for terms.

# Actor input Schema

## `domain` (type: `string`):

Enter the brand domain to protect (e.g. <code>paypal.com</code>). Omit <code>http://</code> and any path.

## `registeredOnly` (type: `boolean`):

Keep look-alikes that resolve in live DNS. Turn off to include unregistered permutations as well.

## `maxResults` (type: `integer`):

Cap how many look-alike rows to deliver and bill in this run.

## `mailServerOnly` (type: `boolean`):

Keep only look-alikes that publish MX records (can send email).

## `minRiskScore` (type: `integer`):

Drop rows below this 0–100 score. Homoglyph, MX, and intercept flags raise the score.

## `mxcheck` (type: `boolean`):

Probe whether look-alike mail hosts can intercept mail meant for your domain.

## `whois` (type: `boolean`):

Attach public WHOIS creation date and registrar when available. Slows the run.

## `fuzzers` (type: `string`):

Limit algorithms with a comma list, e.g. <code>homoglyph,addition,omission,tld-swap</code>. Leave empty for the full engine.

## `timeout` (type: `integer`):

Stop the DNS scan after this many seconds.

## `threads` (type: `integer`):

Set parallel DNS workers from 1 to 32.

## `monitorMode` (type: `boolean`):

Return only changes since the previous run for the same monitor key: new, changed DNS/MX, or removed.

## `monitorKey` (type: `string`):

Name this watch (e.g. <code>acme-weekly</code>). Leave empty to derive a key from the domain.

## `includeUnchanged` (type: `boolean`):

Also deliver look-alikes that did not change. Each delivered row is billed.

## Actor input object example

```json
{
  "domain": "dm.hu",
  "registeredOnly": true,
  "maxResults": 5,
  "mailServerOnly": false,
  "minRiskScore": 0,
  "mxcheck": true,
  "whois": false,
  "timeout": 300,
  "threads": 16,
  "monitorMode": false,
  "includeUnchanged": false
}
```

# Actor output Schema

## `overview` (type: `string`):

Default dataset items.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domain": "dm.hu",
    "registeredOnly": true,
    "maxResults": 5,
    "mxcheck": true,
    "timeout": 300
};

// Run the Actor and wait for it to finish
const run = await client.actor("bakos_bence/domain-typosquat-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domain": "dm.hu",
    "registeredOnly": True,
    "maxResults": 5,
    "mxcheck": True,
    "timeout": 300,
}

# Run the Actor and wait for it to finish
run = client.actor("bakos_bence/domain-typosquat-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domain": "dm.hu",
  "registeredOnly": true,
  "maxResults": 5,
  "mxcheck": true,
  "timeout": 300
}' |
apify call bakos_bence/domain-typosquat-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,bakos_bence/domain-typosquat-scanner"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/3jq2RHHZSTv68KqJW/builds/ahrxNAsrl5pejdIBb/openapi.json