Brand Impersonation Domain Monitor: Look-alikes avatar

Brand Impersonation Domain Monitor: Look-alikes

Pricing

from $3.00 / 1,000 domain flaggeds

Try for free
Go to Apify Store
Brand Impersonation Domain Monitor: Look-alikes

Brand Impersonation Domain Monitor: Look-alikes

Try for free

Find look-alike domains and TLS certificates that impersonate your brand: typos, homoglyphs and "brand-login" names, with registration date, registrar, DNS, mail servers, a login or payment form check and a 0-100 risk score. Monitor mode reports only new ones.

Pricing

from $3.00 / 1,000 domain flaggeds

Rating

0.0

(0)

Developer

SiteCheck Tools

SiteCheck Tools

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

10 hours ago

Last modified

Categories

Developer tools

Security

Limited permissions

Share

What does Brand Impersonation Domain Monitor do?

Brand Impersonation Domain Monitor is built for the security or fraud team of an online shop, bank, SaaS or any brand customers log in to. Phishers register look-alike domains (paypa1.com, acme-support.shop) and get TLS certificates for them days before the first phishing e-mail. You give the Actor your brand and its official domains; it generates look-alike names (typos, homoglyphs, trust words like login or support, other TLDs), searches certificate transparency logs for names that contain your brand, and checks which ones are really registered. For each one you get the registration date and registrar, DNS and mail servers, what the homepage does (login or card form?) and a 0–100 risk score with reasons. Run it daily in monitor mode, and send only the new domains to Slack, e-mail, your ticket system or SIEM with an Apify integration or webhook, so you can report them for takedown before customers are phished.

Per flagged domain you get:

  • 🔎 how it was found: typo, homoglyph, keyword, TLD swap or certificate
  • 📅 registered on, registrar, and whether it resolves and has mail servers
  • 🔐 certificate first seen (certificate transparency)
  • 🌐 HTTP status, final URL, page title, login form and payment form detected
  • 🚦 risk score (high 60+, medium 35+) with the reasons
  • ✨ isNew in monitor mode

No API key, no proxy, no login.

Who is it for?

  • Security and fraud teams at shops, banks, fintechs, SaaS and marketplaces.
  • Brand protection and legal teams collecting evidence for takedowns and UDRP cases.
  • Agencies watching several client brands at once.

How to use it

  1. Click Try for free. The prefilled input checks 100 look-alikes of one well-known brand plus its certificates.
  2. Enter your Brands: [{"name": "Acme", "domains": ["acme.com", "acme.shop"]}]. List every domain you own so they are never reported.
  3. Optional: Extra keywords that phishers use in your market, TLDs, Max candidates per brand.
  4. For a daily watch set Mode to monitor, give it a Monitor name, save as a task and schedule it. Add an integration to deliver the new rows.

Input example

{
    "brands": [{ "name": "Acme", "domains": ["acme.com", "acme.shop"] }],
    "extraKeywords": ["refund", "rewards"],
    "tlds": ["com", "net", "shop", "online", "app"],
    "checkCertificates": true,
    "mode": "monitor",
    "monitorName": "acme-brand-watch",
    "maxCandidatesPerBrand": 300
}

Output example

Real rows from a run on 7 October 2026 for PayPal (shortened). The first is a third-party domain with a password field on its homepage; the second is a PayPal-owned domain that the scan also lists (add your own domains to Brands to keep them out):

[
    {
        "brand": "PayPal",
        "domain": "supportpaypal.com",
        "foundBy": "keyword",
        "foundByDetail": "with \"support\"",
        "registered": true,
        "createdAt": "2026-09-15T23:33:01.000Z",
        "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
        "resolves": true,
        "hasMx": true,
        "live": 200,
        "loginFormDetected": true,
        "paymentFormDetected": false,
        "riskScore": 78,
        "riskLevel": "high",
        "riskReasons": ["brand name plus a trust word (login, support ...)", "registered 21 days ago", "resolves in DNS", "has mail servers (can send e-mail as the brand)", "website answers (HTTP 200)", "page has a password field"]
    },
    {
        "brand": "PayPal",
        "domain": "xoom.com",
        "foundBy": "certificate",
        "registrar": "MarkMonitor Inc.",
        "certificateFirstSeen": "2026-05-22T00:00:00.000Z",
        "pageTitle": "Xoom, a PayPal Service | Send Money Online",
        "riskScore": 58,
        "riskLevel": "medium"
    }
]

That run checked 200 candidates (100 generated plus 100 from certificates) and flagged 180 registered ones in a few minutes. The risk score is a triage aid, not proof of fraud: many look-alikes are parked, for sale or defensively registered.

Unregistered candidates are only listed when you ask (Also list unregistered candidates) and are free. Info rows (invalid-input, certificate-search-failed, rdap-unavailable, no-results) are free too.

How is the risk score calculated?

Points for: how the name resembles your brand (look-alike characters 25, trust word 20, typo 15, other TLD 10); a young registration (under 7 days 25, 30 days 15, 90 days 8); a TLS certificate (10–15); resolving (10) and mail servers (8); a live website (5) with a password field (20) or card fields (25) and your brand in the page title (10). Minus 25 when the site redirects to your official domain. Every row lists its reasons.

How much does it cost?

This Actor uses pay per event:

EventPrice
Domain flagged (registered or certificate-seen look-alike)$0.003 per domain
Unregistered candidates, info rows and error rowsfree
  • A monitor that finds 5 new look-alikes a week costs about $0.015 per week.
  • Apify also charges a tiny standard start fee per run.
  • Set Max candidates per brand or Maximum cost per run to cap the cost.

Data sources and terms

  • Generated look-alikes: computed locally from your brand name (no source involved).
  • Certificate transparency via crt.sh (Sectigo's public search of the CT logs), polite, one request at a time. crt.sh is free but can be slow or down; the run continues with partial or no certificate results and says so in a free info row.
  • RDAP (the IANA bootstrap and each registry's public RDAP server) for registration date and registrar. Contact data is redacted by most registries and is not collected.
  • DNS-over-HTTPS (Cloudflare, then 1.1.1.1, then Google) for A, AAAA, NS and MX.
  • One GET of each registered domain's homepage (public addresses only, redirects checked, at most 512 KB, nothing submitted) for title, final URL and form detection.
  • Only publicly available registration and certificate data is used. This Actor is not affiliated with any registry, registrar, crt.sh or the brands you monitor.

Limitations

  • It guesses look-alikes (up to 2,000 per brand) and finds others through certificates; a domain that matches neither will be missed. Domains without a certificate are only found if the name is guessed.
  • Certificate search finds domains that contain your brand name as typed; crt.sh may time out on very common words.
  • RDAP is not available for every TLD; then DNS decides if a domain exists and the registration date stays empty.
  • Form detection reads the homepage HTML only; pages that build the form with JavaScript, or phishing kits that only show a form on a sub-page or to certain visitors, are not seen.
  • A flagged domain is not proof of abuse. Check it before you act.

FAQ

How do I stop my own domains showing up?

Put them in the brand's domains list. Domains in that list (and their subdomains) are never reported.

Does it check subdomains such as login.acme.example.com?

It reports registrable domains. A certificate for a subdomain on someone else's domain leads to that domain being flagged.

How do I reset a monitor?

Use a new Monitor name or delete the named key-value store impersonation-<name>.

More tools from the same developer

All pay-per-result, no proxy or login needed, built and maintained by the same developer:

Website audits

Company data and compliance

Media and AI

Market signals

Social media

Jobs and talent

E-commerce and marketplaces

Travel, sports and places

Finance and crypto

Research and public data

Feedback

Missing a source, a filter or a field? Open an issue on the Issues tab.

You might also like

WhoisDS Newly Registered Domain Feed + Enrichment avatar

WhoisDS Newly Registered Domain Feed + Enrichment

jungle_synthesizer/whoisds-newly-registered-domain-feed-scraper

Daily delta of newly registered domains from the whoisds.com free NRD feed, enriched with DNS (A/MX/NS), Certificate Transparency presence, IDN punycode decoding, and keyword/typosquat matching against a brand watch-list. Fully passive.

User avatar

BowTiedRaccoon

8

5.0

(1)

G—

GuardHawk — Domain Security Audit: SSL, DNS, Takeover Risk

inexhaustible_glass/domain-health-audit

Full domain security audit in one call: SSL/TLS, DNS, SPF/DKIM/DMARC, security headers, WHOIS, blacklist, tech stack — PLUS subdomain-takeover risk and public S3-bucket exposure detection, which no other domain-audit tool checks. Returns a 0-100 health score + fix list. No API key, no login.

User avatar

Hitman studio

20

5.0

(1)

Chinese Social Listening — Weibo, RedNote, Bilibili, Douban avatar

Chinese Social Listening — Weibo, RedNote, Bilibili, Douban

zhorex/chinese-brand-monitor

Chinese social listening in one API call: brand mentions from Weibo, Bilibili and Douban groups with no login, Xiaohongshu (RedNote) and Xueqiu with your cookie, plus Black Cat (黑猫投诉) consumer complaints. Sentiment, share of voice vs competitors, deduplicated. $0.06 per mention.

User avatar

Sami

53

5.0

(1)

BP

Branding parser

convenient_weekend/branding-parser

User avatar

Yana Abalmaz

18

Perplexity AI Brand Monitor — AI Search Visibility Tracker avatar

Perplexity AI Brand Monitor — AI Search Visibility Tracker

samstorm/perplexity-brand-monitor

Track brand mentions, citation positions and citation share in Perplexity answers. Bring your own funded Perplexity API key; provider charges are paid by you separately. Export prompt-by-brand results for repeatable SEO and competitor reports.

User avatar

Sam Kleespies

5

Domain Availability Checker — Bulk DNS & WHOIS Lookup avatar

Domain Availability Checker — Bulk DNS & WHOIS Lookup

automation-lab/domain-availability-checker

Check exact domain names in bulk and return available/registered verdicts with DNS/WHOIS method, registrar, creation/expiry dates, name servers, timing, and errors in structured JSON.

User avatar

Automation Lab

207

XB

Xiaohongshu Brand Mention & Seeding Monitor

kayhermes/xiaohongshu-brand-mention-seeding-monitor

User avatar

Khoa Nguyen

3

Company Contact Finder: Emails, Phones & Socials avatar

Company Contact Finder: Emails, Phones & Socials

offerastudio/company-contact-finder

Enter company domains and get the emails, phone numbers and social profiles (LinkedIn, X, Facebook, Instagram, YouTube, GitHub) published on their own website, plus company name, description and tech. Pay only for domains where contacts are found.

User avatar

Offera Studio

3

Domain History Contact OSINT - Previous Owner + WHOIS History avatar

Domain History Contact OSINT - Previous Owner + WHOIS History

anshumanatrey/domain-history-contact-osint

Find who owned a domain and how to reach them, even after the site is gone. Emails, phones, people and organisations from archived pages, WHOIS history, DNS and certificate records, each with a source URL and capture date. Works on dead, expired and parked domains. One input field, 14 sources.

User avatar

Anshuman Atrey

9

Reddit Brand Sentiment Scraper | Complaints & Reviews avatar

Reddit Brand Sentiment Scraper | Complaints & Reviews

zen-studio/reddit-brand-sentiment-analyzer

Extract brand sentiment, complaints, and alternatives from Reddit discussions. Enter any brand name, get structured analysis with real quotes and source URLs. Competitive mode compares multiple brands side by side. Full markdown report for LLM pipelines.

User avatar

Zen Studio

8