Copycat Store & Lookalike Domain Suspect Checker

Find possible copycat stores and lookalike domains for any brand — from public sources only. Every result is clearly labeled an unverified suspect, with a confidence level, reasons and evidence links. Not confirmed infringement. No auto-takedowns, no outreach, no personal WHOIS data.

Not affiliated with or endorsed by Certificate Transparency operators, any DNS registry, Shopify, WooCommerce, Squarespace, BigCommerce, Bing, Brave, or SerpAPI; names are used only to describe compatibility or public data sources.

What does this copycat store & lookalike domain checker do?

Given a brand name, its official domain and (optionally) a few product titles, it builds a candidate list from permitted public sources and scores each one:

1. Certificate Transparency (crt.sh JSON) — hostnames whose certificates contain the brand string.
2. Typosquat / lookalike generation (dnstwist-style) — omission, swap, homoglyph, adjacent-key, hyphenation, TLD swaps, and brand+keyword forms (shop, store, official, outlet, sale, …), then DNS resolution via Cloudflare DNS-over-HTTPS.
3. RDAP — creation date and registrar name only. No registrant personal data (no name, email, phone or street address).
4. Public homepage fetch (one light request per resolving domain, respects robots.txt) — brand name on the page, product-title text similarity, title reuse, and storefront signals (Shopify, WooCommerce, Squarespace, BigCommerce).
5. Shopify /products.json when the storefront exposes it and robots.txt allows it — compare product titles to your list. No cart, checkout or customer data.
6. Optional BYOK search (Bing, Brave or SerpAPI with your own key) — works with no key; search is skipped when empty.

Confidence levels (always unverified)

Confidence	Typical signals
high	Brand or product titles on the page / /products.json, plus a resolving lookalike or CT hit, often with a recent RDAP date
medium	Resolving lookalike with storefront signals and/or CT evidence, or strong search hit
low	Weaker combination (e.g. CT hit that does not resolve, or a young resolving lookalike with little page content)

Every row includes label: "unverified_suspect" and a fixed disclaimer. A lookalike domain alone is not proof of a scam or of infringement.

Example output

confidence	domain	brandNameFound	storefrontSignals	rdapCreated	label
high	acme-trail-outlet.shop	true	["shopify"]	2026-03-01	unverified_suspect
medium	acme-trai1.example	false	["woocommerce"]	2025-11-12	unverified_suspect
low	acmetrail.xyz	false	[]	null	unverified_suspect

Pricing

Users on the free Apify plan get up to 100 results per run (then the run stops with a clear status message).

Pay per event: $0.01 per unverified suspect delivered, $0.001 per candidate domain checked (DNS, and RDAP/homepage when it resolves). Domains that are generated but never checked are free. Example: check 80 candidates and deliver 12 suspects → 12 × $0.01 + 80 × $0.001 = $0.20.

Input

brandName (required), officialDomain (required), productTitles, maxSuspects, maxDomainsToCheck, includeTldSwaps, fetchHomepages, checkShopifyProductsJson, searchProvider, searchApiKey (optional secret).

FAQ

Does it file takedowns or contact anyone? No. It only returns evidence for you to review. Filing is your decision and your responsibility.

Is a high-confidence row a confirmed clone? No. High means several public signals lined up. Authorized retailers, fan sites, parked pages and unrelated businesses can still match. Always review.

What personal data does RDAP return? Registrar name and creation/expiration dates only. Registrant name, email, phone and street address are never requested or output.

Does it scrape Google, Amazon or Shopify search HTML? No. Search is optional and only through your own Bing / Brave / SerpAPI key against those providers' official APIs. Shopify is limited to a site's own public homepage and /products.json when exposed.

Will it work with no API key? Yes. CT, typosquats, DNS, RDAP and homepage checks need no key.

Is it legal?

It's built to use only public data: Certificate Transparency logs, public DNS, RDAP (registrar and dates only), and each suspect site's own public homepage / /products.json when robots.txt allows. It does not log in, bypass CAPTCHAs, harvest personal WHOIS data, or scrape Google/Amazon/Shopify search results as HTML. You are responsible for how you use the results. This isn't legal advice.

Example input / example output

Example input

{
  "brandName": "Acme Trail Co",
  "officialDomain": "acmetrail.example",
  "productTitles": ["Trail Runner", "Summit Boot"],
  "maxSuspects": 25,
  "maxDomainsToCheck": 60,
  "fetchHomepages": true,
  "searchProvider": "none"
}

Example output (one unverified suspect)

{
  "domain": "acme-trail-outlet.shop",
  "url": "https://acme-trail-outlet.shop/",
  "confidence": "high",
  "label": "unverified_suspect",
  "disclaimer": "UNVERIFIED SUSPECT — not confirmed infringement, not a legal finding, and not a recommendation to send a takedown. Review before any action. This is not legal advice.",
  "reasons": [
    "Lookalike domain generated by a brand-hyphen-keyword permutation of the brand.",
    "Domain resolves in public DNS (A or CNAME).",
    "Brand name \"Acme Trail Co\" appears on the public homepage or title.",
    "Storefront signals: shopify."
  ],
  "evidenceLinks": ["https://acme-trail-outlet.shop/"],
  "sources": ["dns", "homepage", "storefront", "typosquat"],
  "brandNameFound": true,
  "storefrontSignals": ["shopify"],
  "rdapCreated": "2026-03-01",
  "rdapRegistrar": "Example Registrar"
}

Use it with Make, Zapier, n8n, or AI agents (Apify MCP)

• Make: In Make, add the Apify module, connect your Apify account, then run this Actor (or an Actor task) and map dataset items into your scenario. See Make integration.
• Zapier: In Zapier, use Apify as a trigger (finished Actor/task run) or action (Run Actor / Run Task / Fetch dataset items). See Zapier integration.
• n8n: Install the Apify node, authenticate, then use Run an Actor or Run an Actor and get dataset. See n8n integration.
• AI agents (Apify MCP): Connect your MCP client to https://mcp.apify.com, then use search-actors, fetch-actor-details, and call-actor. Pull results with get-dataset-items. See Apify MCP server.

Related actors: Email Auth Checker · ATS Jobs Feed · SEC Form D Funding Monitor · Texas New Business Entities Feed · PageSpeed & Core Web Vitals Monitor · Podcast Activity Monitor · SAM.gov Opportunities Monitor · USPTO Trademark New Filings Feed

Disclaimer

Provided as is. Results are unverified suspects for human review, not legal conclusions. Not affiliated with, endorsed by, or sponsored by Shopify, WooCommerce, Squarespace, BigCommerce, Cloudflare, any domain registry or registrar, Bing, Brave, SerpAPI, or any Certificate Transparency log operator; names are used only to describe compatibility or public data sources. This isn't legal advice.