Brand Domain Watch: Find Domains Impersonating You

Someone registers a domain with your brand in it. Your customers find it before you do. This Actor closes that window.

It scans public Certificate Transparency logs (the mandatory, public record of every SSL certificate ever issued) for domains carrying your brand name, also searches typosquat misspellings of it (on by default), and hands you a ranked list of what deserves a look.

Why Certificate Transparency: a convincing phishing site needs HTTPS. The moment it requests a certificate, it is recorded publicly, forever. That is your early warning.

What it finds

A real scan for revolut on 27 September 2026 (default input, with revolut.com as official domain) returned 44 domains, 31 of them suspicious, including:

{
  "domain": "revolut--casino.de",
  "firstSeen": "2026-09-08T08:07:52",
  "lastIssued": "2026-09-08T08:07:52",
  "expiresOn": "2026-12-07T08:07:51",
  "issuer": "YE1",
  "registrableDomain": "revolut--casino.de",
  "isOfficial": false,
  "riskFlags": ["brand-in-domain", "hyphenated", "first-seen-last-30-days"],
  "riskScore": 3
}

Alongside the same casino name on .pl, .com and a pages.dev host, a bot domain on a .ru host, and two hits for the typosquat variant evolut. None of them belong to Revolut.

The risk flags

Each one is an observable fact, never a guess:

• brand-in-domain: carries your brand but is not a domain you listed as yours.
• suspicious-keyword:login|verify|support|billing…: the vocabulary of credential phishing.
• first-seen-last-30-days: the domain's first certificate appeared in Certificate Transparency in the last 30 days. This is not the registration date (WHOIS is out of scope), but a first certificate is usually the moment a phishing site goes live, and fresh sites are where active campaigns are.
• high-abuse-tld:top|xyz|icu|click…: TLDs with disproportionate abuse rates.
• hyphenated / digits-in-name: classic look-alike patterns when your brand has neither.
• typosquat-variant: matched a deliberate misspelling of your brand, not your brand itself.

Results are ranked by risk, newest first. Set onlySuspicious to get just the shortlist.

Input

brand (or brands for up to 5). List your officialDomains: they get marked as yours and drop out of the suspicious list, so you only review what you do not control. includeTyposquats is on by default: it also searches misspellings of your brand (omissions, doubled letters, swapped letters, neighbouring keys and look-alike characters), up to maxVariants (default 4). Each variant adds one Certificate Transparency query, so turn it off if you only want a fast scan of the exact brand.

Use cases

• Brand protection: catch impersonation and phishing domains while the campaign is still young.
• Trademark enforcement: pair it with a trademark watch: one guards the registers, this one guards the internet.
• Security monitoring: schedule it weekly and diff the results; a domain appearing with first-seen-last-30-days is worth an immediate look.
• AI agents: exposed as an MCP tool, so an agent can answer "any new domains impersonating us this month?" directly.

Pricing

Pay per event: charged once per brand scanned that returns domains. Brands with no results are free.

Use with AI agents (MCP)

https://mcp.apify.com?tools=jdepablos/brand-domain-watch

FAQ

Does this find domains without HTTPS? No. It relies on Certificate Transparency, so a domain only appears once it requests a certificate. In practice, any impersonation site meant to fool a human gets one.

Is Certificate Transparency official? Yes: it is an industry standard enforced by browsers. Every public certificate authority must log every certificate it issues.

Why are some of my own subdomains listed? Anything not in officialDomains is reported. Add your domains there and they will be marked official with no risk flags.

Is firstSeen the date the domain was registered? No. It is the date its first certificate was logged in Certificate Transparency. A domain can be registered earlier and stay parked without HTTPS; what firstSeen tells you is when it became usable as a convincing website.

Can it tell me who registered a domain? No. WHOIS ownership is out of scope (and largely redacted since GDPR). This Actor answers "which domains exist that look like mine, and which ones smell wrong".