# Typosquatting & Phishing Domain Monitor - New Domain Alerts (`dabomb1177/brand-domain-threat-monitor`) Actor

Brand protection monitoring that checks your brand names against every domain actually registered in the last 24 hours plus new TLS certificates. Detects typosquats, homoglyph/IDN impersonation and combosquatting, and scores each domain 0-100 by phishing risk.

- **URL**: https://apify.com/dabomb1177/brand-domain-threat-monitor.md
- **Developed by:** [Mazen Khalil](https://apify.com/dabomb1177) (community)
- **Categories:** Other, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Typosquatting & Phishing Domain Monitor — New Domain Alerts

Every day roughly **70,000 new domains** are registered. A handful of them are built to
impersonate your brand: `paypal-billing.online`, `paypaal.store`, `rnicrosoft.com`. This
actor checks your brand names against the domains that were **actually registered in the
last 24 hours** — plus freshly issued TLS certificates — and returns the ones that look
like impersonation, scored 0–100 by phishing risk.

Run it on a daily schedule and you get an early-warning feed for brand abuse, typically
days before the domain is weaponised into a phishing campaign.

### Why this is different from typosquat generators

Most typosquatting tools take your brand and generate thousands of *hypothetical*
permutations, then test whether each one resolves. That approach has two problems: it
floods you with domains nobody ever registered, and it misses real threats that do not
fit its permutation rules — like `microsoft365usa.com` or a Cyrillic homograph.

This actor works the other way round. It starts from the **real newly-registered-domain
feed** and asks which of those actual registrations resemble your brand. Every result is
a domain that genuinely exists, registered on a date you can see.

### What it detects

| Detection | Example (brand: `paypal`) | Why it matters |
|---|---|---|
| **Exact** | `paypal.shop` | Your brand grabbed under a new TLD |
| **Homoglyph / IDN** | `pаypal.com` (Cyrillic `а`), `paypa1.com` | Visually identical in a browser bar |
| **Typosquat** | `paypaal.store`, `pypal.cc` | One or two keystrokes from your domain |
| **Combosquat** | `paypal-billing.online`, `login-paypal.top` | The classic phishing-hostname pattern |
| **Embedded** | `paypalsecure.com` | Brand buried in a longer name |

Matching folds both your brand and each domain to a *visual skeleton*, so look-alike
characters (`0`/`o`, `1`/`l`, `rn`/`m`, Cyrillic `р`/Latin `p`) collapse together. That
catches homograph attacks without you having to enumerate them.

#### How the threat score works

Each match starts from a base score for its detection type, then gains points for
corroborating evidence: phishing keywords in the label (`login`, `verify`, `billing`,
`secure`), a TLD with elevated abuse rates (`.top`, `.xyz`, `.cfd`), non-ASCII IDN
characters, hyphen padding, and digits bolted onto a brand. The result is bucketed into
`low` / `medium` / `high` / `critical`, and every item carries a plain-English `reasons`
array explaining exactly why it was flagged.

### Input

| Field | Type | Default | Description |
|---|---|---|---|
| `brands` | array | `["paypal","microsoft","binance"]` | Brand names or keywords. Use the distinctive part only — `paypal`, not `paypal.com`. |
| `lookbackDays` | integer | `1` | Daily feeds to scan, counting back from yesterday (max 7). |
| `maxEditDistance` | integer | `2` | Typo sensitivity. 1 = conservative, 2 = recommended, 3 = noisy. |
| `minThreatScore` | integer | `35` | Only report domains at or above this score. |
| `includeCertificateTransparency` | boolean | `true` | Also search crt.sh for new certificates naming your brand. |
| `ignoreDomains` | array | `[]` | Domains you own, so your own registrations never alert. Subdomains included. |
| `maxItems` | integer | `100` | Cap on results; the highest-scoring are kept. |

Short brands are handled carefully: names of four characters or fewer are matched
strictly (exact, homoglyph and whole-word only) so a brand like `ups` does not match
every domain containing those three letters.

### Sample output

```json
{
  "domain": "paypal-billing.online",
  "registrableDomain": "paypal-billing.online",
  "label": "paypal-billing",
  "tld": "online",
  "isIdn": false,
  "brand": "paypal",
  "matchType": "combosquat",
  "editDistance": 0,
  "threatScore": 57,
  "threatLevel": "high",
  "reasons": [
    "Brand name used as a whole word alongside other terms (combosquatting)",
    "Contains phishing-style keyword(s): billing",
    "Hyphenated label, a common way to pad a brand name"
  ],
  "source": "whoisds-nrd",
  "firstSeen": "2026-07-26T00:00:00.000Z",
  "feedDate": "2026-07-26",
  "whoisUrl": "https://www.whois.com/whois/paypal-billing.online",
  "virusTotalUrl": "https://www.virustotal.com/gui/domain/paypal-billing.online",
  "urlscanUrl": "https://urlscan.io/domain/paypal-billing.online",
  "certificateSearchUrl": "https://crt.sh/?q=paypal-billing.online",
  "checkedAt": "2026-07-27T12:12:15.379Z"
}
```

Every item ships with WHOIS, VirusTotal, urlscan.io and crt.sh pivot links, so an analyst
can trip straight from an alert into an investigation.

### Use cases for brand protection teams

- **Daily brand monitoring** — schedule a run each morning and review overnight registrations.
- **Phishing pre-emption** — spot the domain while it is still parked, before the campaign lands.
- **Trademark & IP enforcement** — build an evidence trail with first-seen dates for UDRP filings.
- **Threat intel enrichment** — pipe results into a SIEM or blocklist via webhook or the API.
- **M\&A and product-launch defence** — watch for opportunistic registrations around a new name.

### How to run it on a schedule

Set your brands, then use Apify's [scheduler](https://docs.apify.com/platform/schedules)
to run the actor daily. Connect a [webhook or integration](https://docs.apify.com/platform/integrations)
to push new alerts into Slack, email, or a ticketing system. Results are available through
the [Apify API](https://docs.apify.com/api/v2) in JSON, CSV or Excel.

Because the daily feed is published in the evening UTC, the actor scans from **yesterday**
backwards. A daily schedule therefore covers every registration with no gaps and no
duplicates between runs.

### FAQ

**Where does the data come from?**
The [WhoisDS](https://www.whoisds.com/newly-registered-domains) public daily
newly-registered-domains list, and [crt.sh](https://crt.sh) Certificate Transparency logs.
Both are public, free, and require no login.

**Is this legal?**
Yes. Domain registrations and Certificate Transparency logs are public records — CT is an
open standard specifically designed for exactly this kind of monitoring. The actor reads
public data only; it does not perform WHOIS lookups on personal data, bypass any
protection, or visit the flagged domains.

**Why did crt.sh return nothing?**
crt.sh is a free community service that is often overloaded and returns HTTP 502. The
actor retries, then continues on the registration feed alone — a crt.sh outage never fails
your run. Set `includeCertificateTransparency` to `false` to skip it entirely.

**Can it find subdomain phishing like `paypal.login.attacker.com`?**
Yes, via the Certificate Transparency source — those hostnames appear in CT logs when the
attacker issues a certificate. The registration feed only sees registrable domains.

**I'm getting too many / too few results.**
Raise `minThreatScore` (try 50) or lower `maxEditDistance` to 1 to cut noise. To widen the
net, drop `minThreatScore` to 0 and raise `lookbackDays`.

**Does it check whether the domain is live?**
No — deliberately. Impersonation domains usually sit parked for days before going live, and
waiting for one to resolve means losing your head start.

### Related actors

- [Domain Typosquatting & Phishing Detector (dnstwist)](https://apify.com/ntriqpro/dnstwist-osint) — permutation-based scanning, complements this actor's feed-based approach
- [Domain WHOIS & DNS Lookup](https://apify.com/santamaria-automations/domain-whois-dns) — enrich a flagged domain with registrar and DNS records
- [Domain Age Checker](https://apify.com/automation-lab/domain-age-checker) — bulk-verify how old a suspicious domain really is

### Changelog

#### 0.1

- Initial release: WhoisDS daily feed + Certificate Transparency matching, skeleton-based
  homoglyph/leetspeak detection, bounded edit-distance typosquat matching, 0–100 threat
  scoring with explanations, and investigation pivot links.

# Actor input Schema

## `brands` (type: `array`):

Brand names or keywords to watch for. Use the distinctive part only — enter "paypal", not "paypal.com". Names shorter than 3 characters are ignored, and names of 4 characters or fewer are matched strictly to avoid noise.

## `lookbackDays` (type: `integer`):

How many daily registration feeds to scan, counting back from yesterday. Today's feed is not published until roughly 19:00 UTC, so day 1 = yesterday. Each extra day adds about 70,000 domains to scan.

## `maxEditDistance` (type: `integer`):

How many character edits a domain may be from your brand and still count as a typosquat. 1 = conservative, 2 = recommended, 3 = noisy. Automatically capped at 1 for brands of 4 characters or fewer.

## `minThreatScore` (type: `integer`):

Only report domains scoring at or above this threshold (0-100). Raise it to cut noise, lower it to see every match. 35 keeps genuine impersonation attempts while dropping coincidental look-alikes.

## `includeCertificateTransparency` (type: `boolean`):

Query crt.sh for freshly issued TLS certificates mentioning your brands. Catches subdomain abuse such as 'paypal-login.attacker.com' that the registration feed cannot see. crt.sh is a free community service and is sometimes unavailable — the run continues normally without it.

## `ignoreDomains` (type: `array`):

Domains you legitimately own, so your own registrations never appear as threats. Subdomains are covered automatically — listing "paypal.com" also ignores "shop.paypal.com".

## `maxItems` (type: `integer`):

Maximum number of threats to return. The highest-scoring domains are kept.

## `proxyConfiguration` (type: `object`):

Optional. Both sources are public and need no proxy; use one only if your account is being rate-limited by crt.sh.

## Actor input object example

```json
{
  "brands": [
    "paypal",
    "microsoft",
    "binance"
  ],
  "lookbackDays": 1,
  "maxEditDistance": 2,
  "minThreatScore": 35,
  "includeCertificateTransparency": true,
  "ignoreDomains": [],
  "maxItems": 100,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "brands": [
        "paypal",
        "microsoft",
        "binance"
    ],
    "ignoreDomains": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("dabomb1177/brand-domain-threat-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "brands": [
        "paypal",
        "microsoft",
        "binance",
    ],
    "ignoreDomains": [],
}

# Run the Actor and wait for it to finish
run = client.actor("dabomb1177/brand-domain-threat-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "brands": [
    "paypal",
    "microsoft",
    "binance"
  ],
  "ignoreDomains": []
}' |
apify call dabomb1177/brand-domain-threat-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=dabomb1177/brand-domain-threat-monitor",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/acts/u3vv5Nm0PYyWGCCsS/builds/TjKhl4XKmqsoAaUxE/openapi.json