# Domain Typosquatting Checker — Phishing Lookalike Scanner (`ntriqpro/dnstwist-osint`) Actor

Enter your domain and get back the look-alike domains that are actually registered — typos, homoglyph (IDN) spoofs, TLD swaps and bitsquatting — each flagged for a live mail server, the signal it can send phishing email. Public DNS data only. For brand-protection and SOC teams.

- **URL**: https://apify.com/ntriqpro/dnstwist-osint.md
- **Developed by:** [daehwan kim](https://apify.com/ntriqpro) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 91 total users, 9 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $15.60 / 1,000 registered domain founds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Domain Typosquatting & Phishing Detector (dnstwist)

**Give it 1 domain and get up to 500 registered look-alike domains back, 1 row each with its live A, MX and NS records.** Find **registered look-alike domains that impersonate your brand** — typosquatting, homoglyph (IDN) spoofs, TLD swaps, bitsquatting, and more — powered by [dnstwist](https://github.com/elceef/dnstwist) (Apache-2.0), a widely used open-source domain permutation engine. The Actor generates thousands of permutations of your domain and resolves **which ones are actually registered**, so you see the real phishing and brand-impersonation threats instead of a noisy wordlist.

Built for **brand-protection teams, security analysts, fraud investigators, and SOC/CTI teams** who need to monitor domain abuse with zero setup. Public DNS data only — this Actor never logs into or scrapes the content of any target domain.

> **Legal Disclaimer:** This Actor is an unofficial integration of dnstwist (elceef/dnstwist) and is not affiliated with or endorsed by the original project. It uses publicly available DNS data for defensive brand-protection and authorized security research. Comply with all applicable laws in your jurisdiction.

***

### What does this Actor do?

Give it a domain (e.g. `yourbrand.com`) and it will:

1. Generate thousands of **permutations** — typos, character swaps, missing/added letters, homoglyphs (e.g. `yourbrаnd.com` with a Cyrillic "а"), hyphenation, TLD substitutions (`.com` → `.net`, `.co`, ...), and bitsquatting.
2. Resolve each permutation's **live DNS records** (A, AAAA, MX, NS).
3. Return the ones that are **actually registered** — the genuine impersonation risk — including whether they have a **mail server (MX)**, which signals possible phishing-email capability.

Running on Apify gives you scheduling, a REST API, dataset exports (JSON/CSV/Excel), and monitoring — so you can watch for newly registered look-alikes on a recurring schedule.

### Why use this Actor?

- **Brand protection** — discover domains squatting on your brand before customers get phished.
- **Anti-phishing** — `hasMailServer` flags look-alikes configured to *send* email (the dangerous ones).
- **M\&A / due diligence** — map the domain footprint and impersonation exposure of any company.
- **Continuous monitoring** — schedule weekly scans to catch newly registered copycats.

### How to use it

1. Enter your **domain** (just the domain, e.g. `example.com` — no `http://`, no path).
2. Leave **Registered domains only** on to see just the real threats (recommended).
3. Run it. Each registered look-alike becomes one row in the dataset.
4. Export to CSV/JSON/Excel or pull via the API. Schedule it for ongoing monitoring.

### Input

| Field | Type | Description |
|---|---|---|
| `domain` | string | The domain to protect, e.g. `example.com`. **Required.** |
| `registeredOnly` | boolean | Only return permutations that actually resolve (default `true`). |
| `maxResults` | integer | Cap on look-alikes returned/charged (default 200, max 500). |
| `timeout` | integer | Max scan time in seconds (default 300). |
| `monitorMode` | boolean | Return only what changed since your previous run (default `false`). See **Monitor mode** below. |
| `monitorKey` | string | Optional name for the watch, e.g. `acme-brand-weekly`. Empty = derived from your input. |
| `includeUnchanged` | boolean | Monitor mode only — also return look-alikes that did not change (default `false`). |

Invalid input ends the run as SUCCEEDED with a notice row.

### Output

Each registered look-alike domain is one dataset record. You can download the dataset in JSON, HTML, CSV, or Excel.

```json
{
  "inputDomain": "example.com",
  "variantDomain": "example.com",
  "fuzzer": "omission",
  "registered": true,
  "hasMailServer": true,
  "dnsA": ["203.0.113.10"],
  "dnsMX": ["mail.example.com"],
  "dnsNS": ["ns1.somehost.com"],
  "scannedAt": "2026-06-29T00:00:00+00:00"
}
```

### Data fields

| Field | Description |
|---|---|
| `variantDomain` | The look-alike domain found |
| `fuzzer` | Permutation technique (omission, homoglyph, tld-swap, addition, ...) |
| `registered` | Whether the domain resolves (has DNS records) |
| `hasMailServer` | Whether it has an MX record (can send/receive email → phishing risk) |
| `dnsA` / `dnsAAAA` | IPv4 / IPv6 addresses |
| `dnsMX` / `dnsNS` | Mail servers / nameservers |
| `changeType` | Monitor mode only — `new`, `changed`, `removed` or `unchanged` |
| `changeDetail` | Monitor mode only — what moved, e.g. `gained an MX record` |

### Monitor mode (weekly change alerts)

Brand protection is not a one-off question — the look-alike that matters is the one **registered last night**. Turn on **Monitor mode** and the Actor compares this run with your previous run and returns only what moved:

| `changeType` | Meaning |
|---|---|
| `new` | A look-alike domain that was not registered the last time you ran this |
| `changed` | It gained or lost an A / MX record — `changeDetail` says which. **A look-alike that just gained an MX record can send mail as your brand.** |
| `removed` | It stopped resolving since the previous run |
| `unchanged` | Same as last time — withheld by default, set `includeUnchanged` to receive it |

Every run also returns one free change-report row, e.g. `12 new look-alike domains since 2026-08-19, 3 now have MX records`, with `newCount`, `removedCount`, `changedCount` and `unchangedCount`.

#### Put it on a weekly schedule (3 steps)

1. Run the Actor once with **Monitor mode** on — the first run saves a baseline and returns everything it found.
2. On the run's page click **Actions ▸ Schedule Actor**, and pick `Every week`.
3. Add an integration on the schedule (Slack, email, webhook) so a week with new look-alikes reaches you without opening Apify.

Runs are matched by **monitor key**. Leave `monitorKey` empty and it is derived from your input, so one schedule keeps one history automatically; set it (e.g. `acme-brand-weekly`) to keep several independent watches. State is kept in a named key-value store holding only domain names and a three-character DNS signature — never page content.

### Pricing / Cost estimation

**Run start fee — from 10 September 2026:** $0.010 is charged once per run, when the run starts and performs the investigation. Existing per-result prices are unchanged.

This Actor charges for the work it does, per event. Apify platform usage is included in these prices.

| Event | Charged when | Free plan | Bronze | Silver | Gold and above |
|---|---|---|---|---|---|
| `run-started` | Once per run, when the run starts and performs the scan | $0.01 | $0.008 | $0.0065 | $0.0052 |
| `domain-scanned` | Once per domain whose look-alike permutation scan completed, **including when no registered look-alike domain was found**. Not charged when the scan failed or timed out on our side, or when the domain was rejected as invalid. **Applies when this event is on the run's price list.** | $0.05 | $0.04 | $0.0325 | $0.026 |
| `registered-domain-found` | Once per look-alike domain row delivered | $0.03 | $0.024 | $0.0195 | $0.0156 |

A typical brand has a handful to a few dozen registered look-alikes, so most scans cost a few cents to under a dollar. A scan that finds no look-alikes still generated and resolved thousands of permutations to establish that answer: it costs the run start fee, plus the scan fee when `domain-scanned` is on the run's price list. Invalid input is **free** (no event is charged). New Apify users get free monthly credits to start.

What "completed" means for `domain-scanned`: dnstwist exited cleanly and its whole result parsed. A scan that crashes, is cut off, or runs past the `timeout` you set is not charged the scan fee. Before the scan starts, the run's log and status message state the scan fee for your plan, so you know the figure up front. Runs whose price list does not carry `domain-scanned` are charged exactly as before.

**Free plan:** each run returns up to 25 results. Paid Apify plans receive the full
result set. A free-plan run that reaches the sample limit finishes successfully with a
`free-plan-cap` notice row — it is a plan limit, not an error. That notice counts the
look-alike domains the scan found but held back and gives an estimated list-price total
for the whole scan (an estimate, not a quote; it includes the scan fee when
`domain-scanned` is on the run's price list).

In **Monitor mode** the same $0.03 applies to each delivered change row — `new`, `changed` and `removed` alike, because a look-alike that disappeared is exactly the answer you scheduled the run for. A quiet week delivers no result rows and therefore costs nothing beyond the run start fee and, when `domain-scanned` is on the run's price list, the scan fee for the completed scan. The change-report row is a notice and is never charged.

### Tips & advanced options

- Keep `registeredOnly: true` for signal over noise — unregistered permutations are not an active threat.
- Watch the `hasMailServer` flag: a look-alike with MX records is set up to send email and is a high-priority phishing risk.
- Schedule a weekly run and diff the results to catch **newly registered** copycats early.

### FAQ, disclaimers & support

**Is this legal?** Yes — it only generates name permutations and queries **public DNS**, the same data any DNS resolver returns. It does not access private data or the target domains' content. Use it for defensive brand protection and authorized research.

**Privacy & data responsibility.** **You are the data controller** for every scan you run with this Actor; ntriqpro is a **data processor** acting solely on your instructions. You are responsible for having a lawful basis and a legitimate, purpose-limited reason for each scan, and for complying with GDPR, PIPA, CCPA, and other applicable privacy laws. **We do not store your results** — output is written only to your own run's dataset and is never retained on our side. Use this Actor only for lawful purposes and only on domains you own or are authorized to assess.

**Known limitations:** DNS results depend on resolver propagation; very large brands may exceed the result cap (raise `maxResults`). Homoglyph detection follows dnstwist's database.

- Found a bug or need a custom OSINT/brand-protection solution? Open an issue in the **Issues** tab.

***

### 🔗 Related Actors by ntriqpro

Build your full OSINT & brand-protection stack:

- [**maigret-actor**](https://apify.com/ntriqpro/maigret-actor) — Username OSINT across 3000+ sites
- [**email-osint-search**](https://apify.com/ntriqpro/email-osint-search) — Find which 120+ sites an email is registered on
- [**theharvester-osint**](https://apify.com/ntriqpro/theharvester-osint) — Subdomains, hosts & emails for a domain
- [**whois-domain-lookup**](https://apify.com/ntriqpro/whois-domain-lookup) — WHOIS registration intelligence

### ⭐ Love it? Leave a Review

Your rating helps other defenders discover this Actor. [Rate it here](https://apify.com/ntriqpro/dnstwist-osint/reviews).

### Works well with

- **[subfinder-osint](https://apify.com/ntriqpro/subfinder-osint)** — Map the real subdomains of your own domain, so you know what you are defending before chasing look-alikes.
- **[whois-domain-lookup](https://apify.com/ntriqpro/whois-domain-lookup)** — Pull registrar, creation date and registrant contact for any look-alike domain found here.

Every run of this Actor also returns these suggestions in the `nextSteps` field of its summary row.

# Actor input Schema

## `domain` (type: `string`):

The domain to protect, e.g. "example.com" (no http://, no path). The Actor generates thousands of permutations and checks which are registered. Free plan: each run returns up to 25 results. Paid Apify plans receive the full result set. Pricing: when the run's price list includes the scan fee (domain-scanned), a domain whose scan completes is charged once, even if no registered look-alike is found; a scan that fails or times out on our side is not charged. The run's status message states the scan fee before the scan starts.

## `registeredOnly` (type: `boolean`):

Only return permutations that are actually registered (have DNS records) — the real threats. Turn off to also list unregistered permutations.

## `maxResults` (type: `integer`):

Maximum look-alike domains to return and charge for (hard cap 500). Free plan: each run returns up to 25 results. Paid Apify plans receive the full result set.

## `timeout` (type: `integer`):

Maximum time for the DNS permutation scan.

## `monitorMode` (type: `boolean`):

Compare this run with the previous run for the same monitor key and return only what changed — newly registered look-alikes, ones that gained an MX record (ready to send phishing mail), and ones that disappeared. Every row gets a changeType of new / changed / removed / unchanged. Schedule this Actor weekly to get only what changed. The first run saves a baseline and returns everything.

## `monitorKey` (type: `string`):

Name this watch, e.g. "acme-brand-weekly". Runs sharing a key are compared with each other, so you can keep several independent watches. Leave empty and the key is derived from your input automatically — which is what you want when one schedule always sends the same input.

## `includeUnchanged` (type: `boolean`):

Monitor mode only. Off by default, so a quiet week returns just the change report. Turn on to also receive every unchanged look-alike domain (each one is a result row and is charged).

## Actor input object example

```json
{
  "domain": "example.com",
  "registeredOnly": true,
  "maxResults": 200,
  "timeout": 300,
  "monitorMode": false,
  "includeUnchanged": false
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domain": "example.com",
    "maxResults": 200,
    "timeout": 300,
    "monitorMode": false,
    "includeUnchanged": false
};

// Run the Actor and wait for it to finish
const run = await client.actor("ntriqpro/dnstwist-osint").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domain": "example.com",
    "maxResults": 200,
    "timeout": 300,
    "monitorMode": False,
    "includeUnchanged": False,
}

# Run the Actor and wait for it to finish
run = client.actor("ntriqpro/dnstwist-osint").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domain": "example.com",
  "maxResults": 200,
  "timeout": 300,
  "monitorMode": false,
  "includeUnchanged": false
}' |
apify call ntriqpro/dnstwist-osint --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,ntriqpro/dnstwist-osint"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Dr0bmuiZjpn9Nkyzh/builds/dnTV7fk4rhugOoi5G/openapi.json