# Copycat Store & Lookalike Domain Suspect Checker (`jwaiworks/copycat-store-checker`) Actor

Find possible copycat stores and lookalike domains from public CT, DNS typosquats, RDAP, homepage signals and optional BYOK search. Every result is an unverified suspect — not confirmed infringement. No auto-takedowns.

- **URL**: https://apify.com/jwaiworks/copycat-store-checker.md
- **Developed by:** [JW AI Works](https://apify.com/jwaiworks) (community)
- **Categories:** Business, E-commerce
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 unverified suspect delivereds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

**Find possible copycat stores and lookalike domains for any brand — from public sources only.** Every result is clearly labeled an **unverified suspect**, with a confidence level, reasons and evidence links. Not confirmed infringement. No auto-takedowns, no outreach, no personal WHOIS data.

*Not affiliated with or endorsed by Certificate Transparency operators, any DNS registry, Shopify, WooCommerce, Squarespace, BigCommerce, Bing, Brave, or SerpAPI; names are used only to describe compatibility or public data sources.*

### What does this copycat store & lookalike domain checker do?

Given a **brand name**, its **official domain** and (optionally) a few **product titles**, it builds a candidate list from permitted public sources and scores each one:

1. **Certificate Transparency (crt.sh JSON)** — hostnames whose certificates contain the brand string.
2. **Typosquat / lookalike generation** (dnstwist-style) — omission, swap, homoglyph, adjacent-key, hyphenation, TLD swaps, and brand+keyword forms (`shop`, `store`, `official`, `outlet`, `sale`, …), then **DNS resolution** via Cloudflare DNS-over-HTTPS.
3. **RDAP** — creation date and registrar name only. No registrant personal data (no name, email, phone or street address).
4. **Public homepage fetch** (one light request per resolving domain, respects `robots.txt`) — brand name on the page, product-title text similarity, title reuse, and storefront signals (Shopify, WooCommerce, Squarespace, BigCommerce).
5. **Shopify `/products.json`** when the storefront exposes it and robots.txt allows it — compare product titles to your list. No cart, checkout or customer data.
6. **Optional BYOK search** (Bing, Brave or SerpAPI with **your own key**) — works with no key; search is skipped when empty.

### Confidence levels (always unverified)

| Confidence | Typical signals |
|---|---|
| **high** | Brand or product titles on the page / `/products.json`, plus a resolving lookalike or CT hit, often with a recent RDAP date |
| **medium** | Resolving lookalike with storefront signals and/or CT evidence, or strong search hit |
| **low** | Weaker combination (e.g. CT hit that does not resolve, or a young resolving lookalike with little page content) |

Every row includes `label: "unverified_suspect"` and a fixed disclaimer. **A lookalike domain alone is not proof of a scam or of infringement.**

### Example output

| confidence | domain | brandNameFound | storefrontSignals | rdapCreated | label |
|---|---|---|---|---|---|
| high | acme-trail-outlet.shop | true | \["shopify"] | 2026-03-01 | unverified_suspect |
| medium | acme-trai1.example | false | \["woocommerce"] | 2025-11-12 | unverified_suspect |
| low | acmetrail.xyz | false | \[] | null | unverified_suspect |

### Pricing

Users on the free Apify plan get up to 100 results per run (then the run stops with a clear status message).

Pay per event: **$0.01 per unverified suspect delivered**, **$0.001 per candidate domain checked** (DNS, and RDAP/homepage when it resolves). Domains that are generated but never checked are free. Example: check 80 candidates and deliver 12 suspects → 12 × $0.01 + 80 × $0.001 = **$0.20**.

### Input

`brandName` (required), `officialDomain` (required), `productTitles`, `maxSuspects`, `maxDomainsToCheck`, `includeTldSwaps`, `fetchHomepages`, `checkShopifyProductsJson`, `searchProvider`, `searchApiKey` (optional secret).

### FAQ

**Does it file takedowns or contact anyone?** No. It only returns evidence for you to review. Filing is your decision and your responsibility.

**Is a high-confidence row a confirmed clone?** No. High means several public signals lined up. Authorized retailers, fan sites, parked pages and unrelated businesses can still match. Always review.

**What personal data does RDAP return?** Registrar name and creation/expiration dates only. Registrant name, email, phone and street address are never requested or output.

**Does it scrape Google, Amazon or Shopify search HTML?** No. Search is optional and only through your own Bing / Brave / SerpAPI key against those providers' official APIs. Shopify is limited to a site's own public homepage and `/products.json` when exposed.

**Will it work with no API key?** Yes. CT, typosquats, DNS, RDAP and homepage checks need no key.

### Is it legal?

It's built to use only public data: Certificate Transparency logs, public DNS, RDAP (registrar and dates only), and each suspect site's own public homepage / `/products.json` when robots.txt allows. It does not log in, bypass CAPTCHAs, harvest personal WHOIS data, or scrape Google/Amazon/Shopify search results as HTML. You are responsible for how you use the results. This isn't legal advice.

### Example input / example output

**Example input**

```json
{
  "brandName": "Acme Trail Co",
  "officialDomain": "acmetrail.example",
  "productTitles": ["Trail Runner", "Summit Boot"],
  "maxSuspects": 25,
  "maxDomainsToCheck": 60,
  "fetchHomepages": true,
  "searchProvider": "none"
}
```

**Example output** (one unverified suspect)

```json
{
  "domain": "acme-trail-outlet.shop",
  "url": "https://acme-trail-outlet.shop/",
  "confidence": "high",
  "label": "unverified_suspect",
  "disclaimer": "UNVERIFIED SUSPECT — not confirmed infringement, not a legal finding, and not a recommendation to send a takedown. Review before any action. This is not legal advice.",
  "reasons": [
    "Lookalike domain generated by a brand-hyphen-keyword permutation of the brand.",
    "Domain resolves in public DNS (A or CNAME).",
    "Brand name \"Acme Trail Co\" appears on the public homepage or title.",
    "Storefront signals: shopify."
  ],
  "evidenceLinks": ["https://acme-trail-outlet.shop/"],
  "sources": ["dns", "homepage", "storefront", "typosquat"],
  "brandNameFound": true,
  "storefrontSignals": ["shopify"],
  "rdapCreated": "2026-03-01",
  "rdapRegistrar": "Example Registrar"
}
```

### Use it with Make, Zapier, n8n, or AI agents (Apify MCP)

- **Make:** In Make, add the Apify module, connect your Apify account, then run this Actor (or an Actor task) and map dataset items into your scenario. See [Make integration](https://docs.apify.com/integrations/make).
- **Zapier:** In Zapier, use Apify as a trigger (finished Actor/task run) or action (Run Actor / Run Task / Fetch dataset items). See [Zapier integration](https://docs.apify.com/integrations/zapier).
- **n8n:** Install the Apify node, authenticate, then use **Run an Actor** or **Run an Actor and get dataset**. See [n8n integration](https://docs.apify.com/integrations/n8n).
- **AI agents (Apify MCP):** Connect your MCP client to `https://mcp.apify.com`, then use `search-actors`, `fetch-actor-details`, and `call-actor`. Pull results with `get-dataset-items`. See [Apify MCP server](https://docs.apify.com/mcp).

**Related actors:** [Email Auth Checker](https://apify.com/jwaiworks/email-auth-checker) · [ATS Jobs Feed](https://apify.com/jwaiworks/ats-jobs-feed) · [SEC Form D Funding Monitor](https://apify.com/jwaiworks/sec-form-d-funding-monitor) · [Texas New Business Entities Feed](https://apify.com/jwaiworks/texas-new-business-entities) · [PageSpeed & Core Web Vitals Monitor](https://apify.com/jwaiworks/pagespeed-cwv-monitor) · [Podcast Activity Monitor](https://apify.com/jwaiworks/podcast-activity-monitor) · [SAM.gov Opportunities Monitor](https://apify.com/jwaiworks/samgov-opportunities-monitor) · [USPTO Trademark New Filings Feed](https://apify.com/jwaiworks/uspto-trademark-new-filings)

### Disclaimer

Provided as is. Results are unverified suspects for human review, not legal conclusions. Not affiliated with, endorsed by, or sponsored by Shopify, WooCommerce, Squarespace, BigCommerce, Cloudflare, any domain registry or registrar, Bing, Brave, SerpAPI, or any Certificate Transparency log operator; names are used only to describe compatibility or public data sources. This isn't legal advice.

# Actor input Schema

## `brandName` (type: `string`):

The brand to check for possible copycat stores and lookalike domains, for example `Acme Trail Co`. Used for Certificate Transparency search, typosquat generation and homepage text matching.

## `officialDomain` (type: `string`):

The brand's real website domain, for example `acmetrail.example`. Excluded from results. Used as the base for TLD and lookalike generation.

## `productTitles` (type: `array`):

A few distinctive product titles from your catalog. When a suspect site's public homepage or Shopify `/products.json` contains similar text, confidence goes up. Example: `Trail Runner`, `Summit Boot`.

## `maxSuspects` (type: `integer`):

Stop after this many unverified suspects are written. Users on the free Apify plan are capped at 100 per run.

## `maxDomainsToCheck` (type: `integer`):

How many lookalike / CT / search candidates to resolve and (optionally) fetch. Each one charges the small domain-checked event. Keep this modest for cheap runs.

## `includeTldSwaps` (type: `boolean`):

Also generate brand lookalikes on common alternate TLDs such as .shop, .store, .online, .xyz, .io, .co.

## `fetchHomepages` (type: `boolean`):

For domains that resolve, fetch the public homepage once (respects robots.txt) to look for brand name, product-title text and storefront signals (Shopify, WooCommerce, …).

## `checkShopifyProductsJson` (type: `boolean`):

If the homepage looks like Shopify and robots.txt allows it, fetch public `/products.json` and compare titles to your product list. No cart, checkout or customer data.

## `searchProvider` (type: `string`):

Optional. Bring your own search API key to add indexed pages that mention the brand or product titles. The Actor works with no key using CT, DNS typosquats, RDAP and homepage checks only.

## `searchApiKey` (type: `string`):

Your own Bing, Brave or SerpAPI key. Used only for this run, sent only to that provider's official host, never stored, logged or written to the dataset. Leave empty to skip search.

## Actor input object example

```json
{
  "brandName": "Acme Trail Co",
  "officialDomain": "acmetrail.example",
  "productTitles": [
    "Trail Runner",
    "Summit Boot"
  ],
  "maxSuspects": 50,
  "maxDomainsToCheck": 80,
  "includeTldSwaps": true,
  "fetchHomepages": true,
  "checkShopifyProductsJson": true,
  "searchProvider": "none"
}
```

# Actor output Schema

## `overview` (type: `string`):

Default dataset items in the overview view.

## `results` (type: `string`):

Default dataset items with every field.

## `runSummary` (type: `string`):

RUN_SUMMARY record in the default key-value store (counts, confidence breakdown, free-plan cap).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "brandName": "Acme Trail Co",
    "officialDomain": "acmetrail.example",
    "productTitles": [
        "Trail Runner",
        "Summit Boot"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("jwaiworks/copycat-store-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "brandName": "Acme Trail Co",
    "officialDomain": "acmetrail.example",
    "productTitles": [
        "Trail Runner",
        "Summit Boot",
    ],
}

# Run the Actor and wait for it to finish
run = client.actor("jwaiworks/copycat-store-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "brandName": "Acme Trail Co",
  "officialDomain": "acmetrail.example",
  "productTitles": [
    "Trail Runner",
    "Summit Boot"
  ]
}' |
apify call jwaiworks/copycat-store-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,jwaiworks/copycat-store-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/C2Gvo81nK8UgGsZrS/builds/GfxGgoAZqgdwhoMfX/openapi.json