Typosquatting & Phishing Domain Monitor — New Domain Alerts

Every day roughly 70,000 new domains are registered. A handful of them are built to impersonate your brand: paypal-billing.online, paypaal.store, rnicrosoft.com. This actor checks your brand names against the domains that were actually registered in the last 24 hours — plus freshly issued TLS certificates — and returns the ones that look like impersonation, scored 0–100 by phishing risk.

Run it on a daily schedule and you get an early-warning feed for brand abuse, typically days before the domain is weaponised into a phishing campaign.

Why this is different from typosquat generators

Most typosquatting tools take your brand and generate thousands of hypothetical permutations, then test whether each one resolves. That approach has two problems: it floods you with domains nobody ever registered, and it misses real threats that do not fit its permutation rules — like microsoft365usa.com or a Cyrillic homograph.

This actor works the other way round. It starts from the real newly-registered-domain feed and asks which of those actual registrations resemble your brand. Every result is a domain that genuinely exists, registered on a date you can see.

What it detects

Detection	Example (brand: paypal)	Why it matters
Exact	paypal.shop	Your brand grabbed under a new TLD
Homoglyph / IDN	pаypal.com (Cyrillic а), paypa1.com	Visually identical in a browser bar
Typosquat	paypaal.store, pypal.cc	One or two keystrokes from your domain
Combosquat	paypal-billing.online, login-paypal.top	The classic phishing-hostname pattern
Embedded	paypalsecure.com	Brand buried in a longer name

Matching folds both your brand and each domain to a visual skeleton, so look-alike characters (0/o, 1/l, rn/m, Cyrillic р/Latin p) collapse together. That catches homograph attacks without you having to enumerate them.

How the threat score works

Each match starts from a base score for its detection type, then gains points for corroborating evidence: phishing keywords in the label (login, verify, billing, secure), a TLD with elevated abuse rates (.top, .xyz, .cfd), non-ASCII IDN characters, hyphen padding, and digits bolted onto a brand. The result is bucketed into low / medium / high / critical, and every item carries a plain-English reasons array explaining exactly why it was flagged.

Input

Field	Type	Default	Description
brands	array	["paypal","microsoft","binance"]	Brand names or keywords. Use the distinctive part only — paypal, not paypal.com.
lookbackDays	integer	1	Daily feeds to scan, counting back from yesterday (max 7).
maxEditDistance	integer	2	Typo sensitivity. 1 = conservative, 2 = recommended, 3 = noisy.
minThreatScore	integer	35	Only report domains at or above this score.
includeCertificateTransparency	boolean	true	Also search crt.sh for new certificates naming your brand.
ignoreDomains	array	[]	Domains you own, so your own registrations never alert. Subdomains included.
maxItems	integer	100	Cap on results; the highest-scoring are kept.

Short brands are handled carefully: names of four characters or fewer are matched strictly (exact, homoglyph and whole-word only) so a brand like ups does not match every domain containing those three letters.

Sample output

{
  "domain": "paypal-billing.online",
  "registrableDomain": "paypal-billing.online",
  "label": "paypal-billing",
  "tld": "online",
  "isIdn": false,
  "brand": "paypal",
  "matchType": "combosquat",
  "editDistance": 0,
  "threatScore": 57,
  "threatLevel": "high",
  "reasons": [
    "Brand name used as a whole word alongside other terms (combosquatting)",
    "Contains phishing-style keyword(s): billing",
    "Hyphenated label, a common way to pad a brand name"
  ],
  "source": "whoisds-nrd",
  "firstSeen": "2026-07-26T00:00:00.000Z",
  "feedDate": "2026-07-26",
  "whoisUrl": "https://www.whois.com/whois/paypal-billing.online",
  "virusTotalUrl": "https://www.virustotal.com/gui/domain/paypal-billing.online",
  "urlscanUrl": "https://urlscan.io/domain/paypal-billing.online",
  "certificateSearchUrl": "https://crt.sh/?q=paypal-billing.online",
  "checkedAt": "2026-07-27T12:12:15.379Z"
}

Every item ships with WHOIS, VirusTotal, urlscan.io and crt.sh pivot links, so an analyst can trip straight from an alert into an investigation.

Use cases for brand protection teams

• Daily brand monitoring — schedule a run each morning and review overnight registrations.
• Phishing pre-emption — spot the domain while it is still parked, before the campaign lands.
• Trademark & IP enforcement — build an evidence trail with first-seen dates for UDRP filings.
• Threat intel enrichment — pipe results into a SIEM or blocklist via webhook or the API.
• M&A and product-launch defence — watch for opportunistic registrations around a new name.

How to run it on a schedule

Set your brands, then use Apify's scheduler to run the actor daily. Connect a webhook or integration to push new alerts into Slack, email, or a ticketing system. Results are available through the Apify API in JSON, CSV or Excel.

Because the daily feed is published in the evening UTC, the actor scans from yesterday backwards. A daily schedule therefore covers every registration with no gaps and no duplicates between runs.

FAQ

Where does the data come from? The WhoisDS public daily newly-registered-domains list, and crt.sh Certificate Transparency logs. Both are public, free, and require no login.

Is this legal? Yes. Domain registrations and Certificate Transparency logs are public records — CT is an open standard specifically designed for exactly this kind of monitoring. The actor reads public data only; it does not perform WHOIS lookups on personal data, bypass any protection, or visit the flagged domains.

Why did crt.sh return nothing? crt.sh is a free community service that is often overloaded and returns HTTP 502. The actor retries, then continues on the registration feed alone — a crt.sh outage never fails your run. Set includeCertificateTransparency to false to skip it entirely.

Can it find subdomain phishing like paypal.login.attacker.com? Yes, via the Certificate Transparency source — those hostnames appear in CT logs when the attacker issues a certificate. The registration feed only sees registrable domains.

I'm getting too many / too few results. Raise minThreatScore (try 50) or lower maxEditDistance to 1 to cut noise. To widen the net, drop minThreatScore to 0 and raise lookbackDays.

Does it check whether the domain is live? No — deliberately. Impersonation domains usually sit parked for days before going live, and waiting for one to resolve means losing your head start.

Related actors

• Domain Typosquatting & Phishing Detector (dnstwist) — permutation-based scanning, complements this actor's feed-based approach
• Domain WHOIS & DNS Lookup — enrich a flagged domain with registrar and DNS records
• Domain Age Checker — bulk-verify how old a suspicious domain really is

Changelog

0.1

• Initial release: WhoisDS daily feed + Certificate Transparency matching, skeleton-based homoglyph/leetspeak detection, bounded edit-distance typosquat matching, 0–100 threat scoring with explanations, and investigation pivot links.