Brand Domain Watch — Find Domains Impersonating You

Someone registers a domain with your brand in it. Your customers find it before you do. This Actor closes that window.

It scans public Certificate Transparency logs — the mandatory, public record of every SSL certificate ever issued — for domains carrying your brand name, optionally adds typosquat misspellings, and hands you a ranked list of what deserves a look.

Why Certificate Transparency: a convincing phishing site needs HTTPS. The moment it requests a certificate, it is recorded publicly, forever. That is your early warning.

What it finds

A real scan for revolut returned 39 domains, including:

{
  "domain": "revolut--casino.com",
  "firstSeen": "2026-06-24",
  "issuer": "Let's Encrypt",
  "isOfficial": false,
  "riskFlags": ["brand-in-domain", "hyphenated"],
  "riskScore": 2
}

Alongside a bot domain on a .ru host and a phishing page on pages.dev. None of them belong to Revolut.

The risk flags

Each one is an observable fact, never a guess:

• brand-in-domain — carries your brand but is not a domain you listed as yours.
• suspicious-keyword:login|verify|support|billing… — the vocabulary of credential phishing.
• registered-last-30-days — brand-new. Fresh domains are where active campaigns live.
• high-abuse-tld:top|xyz|icu|click… — TLDs with disproportionate abuse rates.
• hyphenated / digits-in-name — classic look-alike patterns when your brand has neither.
• typosquat-variant — matched a deliberate misspelling of your brand, not your brand itself.

Results are ranked by risk, newest first. Set onlySuspicious to get just the shortlist.

Input

brand (or brands for up to 5). List your officialDomains — they get marked as yours and drop out of the suspicious list, so you only review what you do not control. Turn on includeTyposquats to also search misspellings (omissions, doubled letters, swapped letters, neighbouring keys and look-alike characters).

Use cases

• Brand protection — catch impersonation and phishing domains while the campaign is still young.
• Trademark enforcement — pair it with a trademark watch: one guards the registers, this one guards the internet.
• Security monitoring — schedule it weekly and diff the results; a domain appearing with registered-last-30-days is worth an immediate look.
• AI agents — exposed as an MCP tool, so an agent can answer "any new domains impersonating us this month?" directly.

Pricing

Pay per event: charged once per brand scanned that returns domains. Brands with no results are free.

Use with AI agents (MCP)

https://mcp.apify.com?tools=jdepablos/brand-domain-watch

FAQ

Does this find domains without HTTPS? No. It relies on Certificate Transparency, so a domain only appears once it requests a certificate. In practice, any impersonation site meant to fool a human gets one.

Is Certificate Transparency official? Yes — it is an industry standard enforced by browsers. Every public certificate authority must log every certificate it issues.

Why are some of my own subdomains listed? Anything not in officialDomains is reported. Add your domains there and they will be marked official with no risk flags.

Can it tell me who registered a domain? No. WHOIS ownership is out of scope (and largely redacted since GDPR). This Actor answers "which domains exist that look like mine, and which ones smell wrong".