Lookalike & Typosquat Domain Finder — Phishing & Brand Watch

Find the look-alike domains attackers register to impersonate your brand. Give your domain and it generates the common typosquat permutations (missing/extra/swapped/mistyped letters, homoglyphs like l→1 and o→0, hyphenations, extra TLDs) and resolves each over keyless DNS to find which are actually registered — flagging the ones with a live site and working mail (phishing-ready), with a risk signal. Passive DNS only, read-only — agent-callable.

For security / brand-protection teams, anti-phishing monitoring, and AI agents that watch a brand's domain surface.

What it does

• Generates look-alike permutations of your domain (the standard typosquat fuzzers: omission, insertion, repetition, replacement, transposition, homoglyph, hyphenation, extra TLDs).
• Resolves each over DNS-over-HTTPS (keyless) to find which are registered.
• For each registered look-alike, checks a live site (A record) and mail capability (MX) — a domain that can receive mail is phishing-capable — plus its nameservers.
• Returns a risk signal per look-alike and a per-domain summary.

Output field	Meaning
permutationsTested / registeredFound / phishingCapable	summary counts
lookalikes[]	each registered look-alike: domain, hasA+ips, hasMail+mx, nameservers, risk, riskReason
signal	phishing-capable-lookalikes / registered-lookalikes-found / no-registered-lookalikes

Passive & defensive by design

It performs only public DNS lookups of the permutations — it never visits, probes, scans or attacks the look-alike sites. It's the passive, defensive essence of tools like dnstwist, built for protecting your own brand. A registered look-alike is a signal to review, not proof a domain is malicious (many are defensively owned by the brand itself, e.g. via MarkMonitor).

Why not just ask an AI agent?

Generating ~100–200 look-alike permutations, resolving A/MX/NS for each, and classifying phishing-readiness is tedious and error-prone to do by hand. This actor does it deterministically and at once, and returns a clean, structured, risk-ranked list.

Input

Field	Type	Required	Description
domains	array of strings	✅	Your domains (e.g. your-brand.com).
onlyRegistered	boolean		Only return registered look-alikes (default true).
webhookUrl	string		POST the finished reports here (schedule for continuous monitoring).

Example input

{ "domains": ["paypal.com"], "onlyRegistered": true }

Output

One report per domain. Example output (trimmed, real run):

{
  "domain": "paypal.com",
  "signal": "phishing-capable-lookalikes",
  "permutationsTested": 84,
  "registeredFound": 68,
  "phishingCapable": 31,
  "lookalikes": [
    {"domain": "paaypal.com", "registered": true, "hasA": true, "hasMail": true, "mx": ["bh.markmonitor.com"], "risk": "high", "riskReason": "Registered, live site and can receive mail - phishing-capable look-alike."},
    {"domain": "paypal.app", "registered": true, "hasA": true, "hasMail": false, "risk": "medium", "riskReason": "Registered with a live site (no mail) - monitor."}
  ],
  "disclaimer": "Passive public DNS lookups only ... a registered look-alike is a signal for review, NOT proof the domain is malicious."
}

Use cases

• Brand protection — discover typosquats impersonating your domain.
• Anti-phishing monitoring — prioritise look-alikes that can receive mail (used for spoofed emails).
• Continuous watch — schedule + webhook to be alerted when a new look-alike appears.
• AI security agents — one call returns a structured, risk-ranked look-alike surface.

Alerts / scheduling

Set webhookUrl and schedule the actor (e.g. daily) — the fresh report is POSTed to Make/Zapier/your endpoint, so you're alerted when a new registered look-alike shows up.

Ready-made tasks

• Lookalike Domain Check - Registered Typosquats
• Typosquatting Domain Finder for Brand Protection
• Brand Domain Squatting Watch (Several Brands)

For AI agents / MCP

https://mcp.apify.com/?tools=actors,docs,centorprat/lookalike-domain-finder

Loads as centorprat--lookalike-domain-finder. Claude Code:

claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/lookalike-domain-finder

FAQ

Does it attack or scan the look-alike sites? No. It only does public DNS lookups (A/MX/NS) of the generated names. It never connects to the sites.

Does it need an API key? No — keyless DNS-over-HTTPS.

Does "registered" mean malicious? No. Many look-alikes are defensively registered by the brand itself or are parked. The result is a signal to review, not an accusation.

What makes a look-alike "phishing-capable"? It's registered, has a live site (A) and can receive mail (MX) — the setup needed to run a convincing spoof. That's risk: high.

How many permutations? Up to ~220 per domain (bounded for speed), covering the common typo and homoglyph patterns plus extra TLDs.

How fast / how much? A few seconds per domain. Pay-per-event, one charge per domain analyzed.

Data & attribution

Uses only public DNS, resolved via the keyless Google DNS-over-HTTPS endpoint. No keys, no site contact, no personal data. Signals for brand-protection review, not legal advice.

Related actors

• Domain Expiry & Registration Check
• Email Auth (DMARC/SPF/DKIM) Check
• DNS Health Check