# Brand Domain Watch — Find Domains Impersonating You (`jdepablos/brand-domain-watch`) Actor

- **URL**: https://apify.com/jdepablos/brand-domain-watch.md
- **Developed by:** [Juan de Pablos](https://apify.com/jdepablos) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $50.00 / 1,000 brand scans

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Brand Domain Watch — Find Domains Impersonating You

**Someone registers a domain with your brand in it. Your customers find it before you do.** This Actor closes that window.

It scans public **Certificate Transparency logs** — the mandatory, public record of every SSL certificate ever issued — for domains carrying your brand name, optionally adds typosquat misspellings, and hands you a ranked list of what deserves a look.

Why Certificate Transparency: a convincing phishing site needs HTTPS. The moment it requests a certificate, it is recorded publicly, forever. That is your early warning.

### What it finds

A real scan for `revolut` returned 39 domains, including:

```json
{
  "domain": "revolut--casino.com",
  "firstSeen": "2026-06-24",
  "issuer": "Let's Encrypt",
  "isOfficial": false,
  "riskFlags": ["brand-in-domain", "hyphenated"],
  "riskScore": 2
}
```

Alongside a bot domain on a `.ru` host and a phishing page on `pages.dev`. None of them belong to Revolut.

### The risk flags

Each one is an observable fact, never a guess:

- **`brand-in-domain`** — carries your brand but is not a domain you listed as yours.
- **`suspicious-keyword:login|verify|support|billing…`** — the vocabulary of credential phishing.
- **`registered-last-30-days`** — brand-new. Fresh domains are where active campaigns live.
- **`high-abuse-tld:top|xyz|icu|click…`** — TLDs with disproportionate abuse rates.
- **`hyphenated` / `digits-in-name`** — classic look-alike patterns when your brand has neither.
- **`typosquat-variant`** — matched a deliberate misspelling of your brand, not your brand itself.

Results are ranked by risk, newest first. Set `onlySuspicious` to get just the shortlist.

### Input

`brand` (or `brands` for up to 5). **List your `officialDomains`** — they get marked as yours and drop out of the suspicious list, so you only review what you do not control. Turn on `includeTyposquats` to also search misspellings (omissions, doubled letters, swapped letters, neighbouring keys and look-alike characters).

### Use cases

- **Brand protection** — catch impersonation and phishing domains while the campaign is still young.
- **Trademark enforcement** — pair it with a [trademark watch](https://apify.com/jdepablos/trademark-watch-tmview): one guards the registers, this one guards the internet.
- **Security monitoring** — schedule it weekly and diff the results; a domain appearing with `registered-last-30-days` is worth an immediate look.
- **AI agents** — exposed as an MCP tool, so an agent can answer "any new domains impersonating us this month?" directly.

### Pricing

Pay per event: charged once per brand scanned that returns domains. Brands with no results are free.

### Use with AI agents (MCP)

```
https://mcp.apify.com?tools=jdepablos/brand-domain-watch
```

### FAQ

**Does this find domains without HTTPS?** No. It relies on Certificate Transparency, so a domain only appears once it requests a certificate. In practice, any impersonation site meant to fool a human gets one.

**Is Certificate Transparency official?** Yes — it is an industry standard enforced by browsers. Every public certificate authority must log every certificate it issues.

**Why are some of my own subdomains listed?** Anything not in `officialDomains` is reported. Add your domains there and they will be marked official with no risk flags.

**Can it tell me who registered a domain?** No. WHOIS ownership is out of scope (and largely redacted since GDPR). This Actor answers "which domains exist that look like mine, and which ones smell wrong".

# Actor input Schema

## `brand` (type: `string`):

The brand or product name to watch, e.g. "revolut". Any domain with an SSL certificate containing this name will be found.

## `brands` (type: `array`):

Up to 5 brands per run. Certificate Transparency queries are slow, so keep batches small.

## `officialDomains` (type: `array`):

Domains you legitimately own, e.g. \["revolut.com"]. They are marked as official and excluded from the suspicious list, so you only review what you do not control.

## `includeTyposquats` (type: `boolean`):

Generate misspellings of the brand (omissions, doubled letters, swapped letters, neighbouring keys, look-alike characters) and search each one. Slower but catches domains that do not contain your brand spelled correctly.

## `maxVariants` (type: `integer`):

How many misspellings to check when the option above is on (each one is an extra slow query).

## `onlySuspicious` (type: `boolean`):

Return only domains you do not own that carry at least one risk flag — the actionable shortlist.

## Actor input object example

```json
{
  "brand": "revolut",
  "officialDomains": [
    "revolut.com"
  ],
  "includeTyposquats": false,
  "maxVariants": 4,
  "onlySuspicious": false
}
```

# Actor output Schema

## `results` (type: `string`):

Domains carrying the brand name, each with first-seen date, issuer, risk flags and whether it is one of your official domains.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "brand": "revolut",
    "officialDomains": [
        "revolut.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("jdepablos/brand-domain-watch").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "brand": "revolut",
    "officialDomains": ["revolut.com"],
}

# Run the Actor and wait for it to finish
run = client.actor("jdepablos/brand-domain-watch").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "brand": "revolut",
  "officialDomains": [
    "revolut.com"
  ]
}' |
apify call jdepablos/brand-domain-watch --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,jdepablos/brand-domain-watch"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/WPOXrTAmIxRop6zli/builds/EVPAK5up8Qyj6YWhy/openapi.json