Brand Impersonation Domain Monitor: Look-alikes

What does Brand Impersonation Domain Monitor do?

Brand Impersonation Domain Monitor is built for the security or fraud team of an online shop, bank, SaaS or any brand customers log in to. Phishers register look-alike domains (paypa1.com, acme-support.shop) and get TLS certificates for them days before the first phishing e-mail. You give the Actor your brand and its official domains; it generates look-alike names (typos, homoglyphs, trust words like login or support, other TLDs), searches certificate transparency logs for names that contain your brand, and checks which ones are really registered. For each one you get the registration date and registrar, DNS and mail servers, what the homepage does (login or card form?) and a 0–100 risk score with reasons. Run it daily in monitor mode, and send only the new domains to Slack, e-mail, your ticket system or SIEM with an Apify integration or webhook, so you can report them for takedown before customers are phished.

Per flagged domain you get:

• 🔎 how it was found: typo, homoglyph, keyword, TLD swap or certificate
• 📅 registered on, registrar, and whether it resolves and has mail servers
• 🔐 certificate first seen (certificate transparency)
• 🌐 HTTP status, final URL, page title, login form and payment form detected
• 🚦 risk score (high 60+, medium 35+) with the reasons
• ✨ isNew in monitor mode

No API key, no proxy, no login.

Who is it for?

• Security and fraud teams at shops, banks, fintechs, SaaS and marketplaces.
• Brand protection and legal teams collecting evidence for takedowns and UDRP cases.
• Agencies watching several client brands at once.

How to use it

1. Click Try for free. The prefilled input checks 100 look-alikes of one well-known brand plus its certificates.
2. Enter your Brands: [{"name": "Acme", "domains": ["acme.com", "acme.shop"]}]. List every domain you own so they are never reported.
3. Optional: Extra keywords that phishers use in your market, TLDs, Max candidates per brand.
4. For a daily watch set Mode to monitor, give it a Monitor name, save as a task and schedule it. Add an integration to deliver the new rows.

Input example

{
    "brands": [{ "name": "Acme", "domains": ["acme.com", "acme.shop"] }],
    "extraKeywords": ["refund", "rewards"],
    "tlds": ["com", "net", "shop", "online", "app"],
    "checkCertificates": true,
    "mode": "monitor",
    "monitorName": "acme-brand-watch",
    "maxCandidatesPerBrand": 300
}

Output example

Real rows from a run on 7 October 2026 for PayPal (shortened). The first is a third-party domain with a password field on its homepage; the second is a PayPal-owned domain that the scan also lists (add your own domains to Brands to keep them out):

[
    {
        "brand": "PayPal",
        "domain": "supportpaypal.com",
        "foundBy": "keyword",
        "foundByDetail": "with \"support\"",
        "registered": true,
        "createdAt": "2026-09-15T23:33:01.000Z",
        "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
        "resolves": true,
        "hasMx": true,
        "live": 200,
        "loginFormDetected": true,
        "paymentFormDetected": false,
        "riskScore": 78,
        "riskLevel": "high",
        "riskReasons": ["brand name plus a trust word (login, support ...)", "registered 21 days ago", "resolves in DNS", "has mail servers (can send e-mail as the brand)", "website answers (HTTP 200)", "page has a password field"]
    },
    {
        "brand": "PayPal",
        "domain": "xoom.com",
        "foundBy": "certificate",
        "registrar": "MarkMonitor Inc.",
        "certificateFirstSeen": "2026-05-22T00:00:00.000Z",
        "pageTitle": "Xoom, a PayPal Service | Send Money Online",
        "riskScore": 58,
        "riskLevel": "medium"
    }
]

That run checked 200 candidates (100 generated plus 100 from certificates) and flagged 180 registered ones in a few minutes. The risk score is a triage aid, not proof of fraud: many look-alikes are parked, for sale or defensively registered.

Unregistered candidates are only listed when you ask (Also list unregistered candidates) and are free. Info rows (invalid-input, certificate-search-failed, rdap-unavailable, no-results) are free too.

How is the risk score calculated?

Points for: how the name resembles your brand (look-alike characters 25, trust word 20, typo 15, other TLD 10); a young registration (under 7 days 25, 30 days 15, 90 days 8); a TLS certificate (10–15); resolving (10) and mail servers (8); a live website (5) with a password field (20) or card fields (25) and your brand in the page title (10). Minus 25 when the site redirects to your official domain. Every row lists its reasons.

How much does it cost?

This Actor uses pay per event:

Event	Price
Domain flagged (registered or certificate-seen look-alike)	$0.003 per domain
Unregistered candidates, info rows and error rows	free

• A monitor that finds 5 new look-alikes a week costs about $0.015 per week.
• Apify also charges a tiny standard start fee per run.
• Set Max candidates per brand or Maximum cost per run to cap the cost.

Data sources and terms

• Generated look-alikes: computed locally from your brand name (no source involved).
• Certificate transparency via crt.sh (Sectigo's public search of the CT logs), polite, one request at a time. crt.sh is free but can be slow or down; the run continues with partial or no certificate results and says so in a free info row.
• RDAP (the IANA bootstrap and each registry's public RDAP server) for registration date and registrar. Contact data is redacted by most registries and is not collected.
• DNS-over-HTTPS (Cloudflare, then 1.1.1.1, then Google) for A, AAAA, NS and MX.
• One GET of each registered domain's homepage (public addresses only, redirects checked, at most 512 KB, nothing submitted) for title, final URL and form detection.
• Only publicly available registration and certificate data is used. This Actor is not affiliated with any registry, registrar, crt.sh or the brands you monitor.

Limitations

• It guesses look-alikes (up to 2,000 per brand) and finds others through certificates; a domain that matches neither will be missed. Domains without a certificate are only found if the name is guessed.
• Certificate search finds domains that contain your brand name as typed; crt.sh may time out on very common words.
• RDAP is not available for every TLD; then DNS decides if a domain exists and the registration date stays empty.
• Form detection reads the homepage HTML only; pages that build the form with JavaScript, or phishing kits that only show a form on a sub-page or to certain visitors, are not seen.
• A flagged domain is not proof of abuse. Check it before you act.

FAQ

How do I stop my own domains showing up?

Put them in the brand's domains list. Domains in that list (and their subdomains) are never reported.

Does it check subdomains such as login.acme.example.com?

It reports registrable domains. A certificate for a subdomain on someone else's domain leads to that domain being flagged.

How do I reset a monitor?

Use a new Monitor name or delete the named key-value store impersonation-<name>.

More tools from the same developer

All pay-per-result, no proxy or login needed, built and maintained by the same developer:

Website audits

• Website Accessibility Checker: WCAG 2.2 & EAA: accessibility issues with fixes, SEO basics and security headers.
• Cookie & Tracker Audit: GDPR Consent Checker: cookies and tracking tags that load before consent.
• AI Crawler Access Checker: robots.txt & llms.txt: which AI crawlers a site allows, plus llms.txt.
• Structured Data Validator: Schema & Rich Results: JSON-LD and Microdata checked against Google's rich result rules.
• Website Change Monitor: Diffs, Prices & Alerts: get a row only when a page changes, with a clean diff.
• Policy Change Monitor: Privacy & Terms Tracker: privacy policy and terms changes, classified clause by clause.
• SaaS Pricing Monitor: Track Competitor Plans: competitor pricing plans as structured data, with price-change diffs.
• Sitemap Change Monitor: New & Removed URLs: new, removed and changed URLs from a site's sitemaps.
• Site SEO Crawler: Broken Links & On-Page Audit: site-wide crawl for broken links, redirects and on-page SEO issues.
• Website Tech Stack Detector: Bulk Lead Filters: technologies used by websites, with filters for lead lists.
• Domain Availability & Expiry Checker (RDAP): domain availability, registrar and expiry dates from RDAP.
• Status Page SLA Monitor: Uptime & Incidents: SaaS vendor uptime, incidents and a monthly SLA table from public status pages.

Company data and compliance

• Company Contact Finder: Emails, Phones & Socials: contact details published on company websites.
• UK New Companies Feed: Companies House Daily: newly incorporated UK companies with sector filters.
• EU VAT Number Validator: Bulk VIES Checker: bulk VAT checks with name, address and consultation number.
• LEI Corporate Tree: GLEIF Parents & Subsidiaries: LEI lookup with parents, subsidiaries and a KYC summary.
• UK Company Distress Watch: Insolvency Alerts: administrations, liquidations and winding-up petitions from The Gazette.
• IBAN Validator: Bulk Check & Bank Lookup: IBAN format and checksum, plus bank name and BIC where open data exists.
• Sanctions Screening: OFAC, EU, UN & UK Lists: names screened against official sanctions lists, with match scores.
• OSHA & EPA Violation Monitor: Fines by Company: US OSHA and EPA enforcement cases and penalties by company.
• Email List Precheck: Syntax, MX & Disposable Check: cheap email list hygiene before a real verification.
• UK Company Officer Changes: Director & PSC Alerts: director, owner, address and status changes for a watchlist of UK companies.
• FDA Warning Letters Monitor: By Company & Subject: FDA warning letters by company and subject, with cited regulations.
• Supplier Risk Report: Sanctions, VAT & Insolvency: one risk row per supplier from eight official registers, with changes since last run.

Media and AI

• Audio & Video Transcriber: Podcasts, SRT, Speakers: audio, video, podcasts and social links to text, SRT and VTT.
• Podcast Mention Alerts: Brand Mentions by Second: where your brand is said in new podcast episodes, with the exact second.
• News Brand Mentions Monitor: New Articles Only: new news articles about your brand, people or topics.
• YouTube Channel Monitor: New Videos & Growth: new videos and view growth of the channels you watch.

Market signals

• US WARN Layoff Notices: 12 States Daily Feed: layoff and plant closure notices from official state sources.
• US Product Recalls Monitor: FDA & CPSC Feed: FDA and CPSC recalls in one feed, with severity.
• EU Tenders Feed: TED Public Procurement Alerts: EU public tenders from TED with CPV, country and value filters.
• Liquor License Openings: New Bars & Stores (US): new US liquor licences from official state open data.
• Clinical Trials Change Monitor: Status & Updates: status, enrollment and results changes on ClinicalTrials.gov studies.
• Career Site Jobs Monitor: ATS Jobs & New Roles: open roles from company career sites, with new and closed roles since the last run.
• App Reviews Monitor: App Store & Google Play: app reviews from both stores, only new ones in monitor mode.
• US Federal Contracts Feed: SAM.gov & USAspending: SAM.gov contract opportunities with the buyer's award history.
• Grants.gov Opportunities: US Federal Grants Feed: US federal grant opportunities by keyword, eligibility and agency.
• Federal Register Monitor: US Rules & Notices Feed: new US rules, proposed rules and notices by agency or topic.
• B2B Sales Trigger Feed: Hiring + Tech Leads: companies hiring for a role and using (or not using) a technology, with contacts.
• Local Business Leads: OpenStreetMap, No Website: local businesses by city and category, including those with no website.
• Solana Token Pair Monitor: New & Trending Pairs: new and trending Solana pairs with liquidity, volume and safety flags.

Feedback

Missing a source, a filter or a field? Open an issue on the Issues tab.