# Brand Impersonation Domain Monitor: Look-alikes (`offerastudio/brand-impersonation-domain-monitor`) Actor

Find look-alike domains and TLS certificates that impersonate your brand: typos, homoglyphs and "brand-login" names, with registration date, registrar, DNS, mail servers, a login or payment form check and a 0-100 risk score. Monitor mode reports only new ones.

- **URL**: https://apify.com/offerastudio/brand-impersonation-domain-monitor.md
- **Developed by:** [Offera Studio](https://apify.com/offerastudio) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.00 / 1,000 domain flaggeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

### What does Brand Impersonation Domain Monitor do?

**Brand Impersonation Domain Monitor** is built for the **security or fraud team of an online shop, bank, SaaS or any brand customers log in to**. Phishers register look-alike domains (`paypa1.com`, `acme-support.shop`) and get TLS certificates for them days before the first phishing e-mail. You give the Actor your brand and its official domains; it **generates look-alike names** (typos, homoglyphs, trust words like login or support, other TLDs), **searches certificate transparency logs** for names that contain your brand, and checks which ones are **really registered**. For each one you get the registration date and registrar, DNS and mail servers, what the homepage does (**login or card form?**) and a **0–100 risk score with reasons**. Run it daily in **monitor mode**, and send only the **new** domains to **Slack, e-mail, your ticket system or SIEM** with an Apify integration or webhook, so you can report them for takedown before customers are phished.

Per flagged domain you get:

- 🔎 **how it was found**: typo, homoglyph, keyword, TLD swap or certificate
- 📅 **registered on**, **registrar**, and whether it **resolves** and has **mail servers**
- 🔐 **certificate first seen** (certificate transparency)
- 🌐 **HTTP status**, **final URL**, **page title**, **login form** and **payment form** detected
- 🚦 **risk score** (high 60+, medium 35+) with the **reasons**
- ✨ **isNew** in monitor mode

No API key, no proxy, no login.

### Who is it for?

- **Security and fraud teams** at shops, banks, fintechs, SaaS and marketplaces.
- **Brand protection and legal teams** collecting evidence for takedowns and UDRP cases.
- **Agencies** watching several client brands at once.

### How to use it

1. Click **Try for free**. The prefilled input checks 100 look-alikes of one well-known brand plus its certificates.
2. Enter your **Brands**: `[{"name": "Acme", "domains": ["acme.com", "acme.shop"]}]`. List **every domain you own** so they are never reported.
3. Optional: **Extra keywords** that phishers use in your market, **TLDs**, **Max candidates per brand**.
4. For a daily watch set **Mode** to `monitor`, give it a **Monitor name**, save as a **task** and **schedule** it. Add an integration to deliver the new rows.

### Input example

```json
{
    "brands": [{ "name": "Acme", "domains": ["acme.com", "acme.shop"] }],
    "extraKeywords": ["refund", "rewards"],
    "tlds": ["com", "net", "shop", "online", "app"],
    "checkCertificates": true,
    "mode": "monitor",
    "monitorName": "acme-brand-watch",
    "maxCandidatesPerBrand": 300
}
```

### Output example

Real rows from a run on 7 October 2026 for PayPal (shortened). The first is a third-party domain with a password field on its homepage; the second is a PayPal-owned domain that the scan also lists (add your own domains to **Brands** to keep them out):

```json
[
    {
        "brand": "PayPal",
        "domain": "supportpaypal.com",
        "foundBy": "keyword",
        "foundByDetail": "with \"support\"",
        "registered": true,
        "createdAt": "2026-09-15T23:33:01.000Z",
        "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
        "resolves": true,
        "hasMx": true,
        "live": 200,
        "loginFormDetected": true,
        "paymentFormDetected": false,
        "riskScore": 78,
        "riskLevel": "high",
        "riskReasons": ["brand name plus a trust word (login, support ...)", "registered 21 days ago", "resolves in DNS", "has mail servers (can send e-mail as the brand)", "website answers (HTTP 200)", "page has a password field"]
    },
    {
        "brand": "PayPal",
        "domain": "xoom.com",
        "foundBy": "certificate",
        "registrar": "MarkMonitor Inc.",
        "certificateFirstSeen": "2026-05-22T00:00:00.000Z",
        "pageTitle": "Xoom, a PayPal Service | Send Money Online",
        "riskScore": 58,
        "riskLevel": "medium"
    }
]
```

That run checked 200 candidates (100 generated plus 100 from certificates) and flagged 180 registered ones in a few minutes. **The risk score is a triage aid, not proof of fraud**: many look-alikes are parked, for sale or defensively registered.

Unregistered candidates are only listed when you ask (**Also list unregistered candidates**) and are free. Info rows (`invalid-input`, `certificate-search-failed`, `rdap-unavailable`, `no-results`) are free too.

### How is the risk score calculated?

Points for: how the name resembles your brand (look-alike characters 25, trust word 20, typo 15, other TLD 10); a **young registration** (under 7 days 25, 30 days 15, 90 days 8); a **TLS certificate** (10–15); **resolving** (10) and **mail servers** (8); a **live website** (5) with a **password field** (20) or **card fields** (25) and **your brand in the page title** (10). **Minus 25** when the site redirects to your official domain. Every row lists its reasons.

### How much does it cost?

This Actor uses **pay per event**:

| Event | Price |
| --- | --- |
| Domain flagged (registered or certificate-seen look-alike) | **$0.003** per domain |
| Unregistered candidates, info rows and error rows | **free** |

- A monitor that finds 5 new look-alikes a week costs **about $0.015 per week**.
- Apify also charges a tiny standard start fee per run.
- Set **Max candidates per brand** or **Maximum cost per run** to cap the cost.

### Data sources and terms

- **Generated look-alikes**: computed locally from your brand name (no source involved).
- **Certificate transparency** via **crt.sh** (Sectigo's public search of the CT logs), polite, one request at a time. crt.sh is free but can be slow or down; the run continues with partial or no certificate results and says so in a free info row.
- **RDAP** (the IANA bootstrap and each registry's public RDAP server) for registration date and registrar. Contact data is redacted by most registries and is not collected.
- **DNS-over-HTTPS** (Cloudflare, then 1.1.1.1, then Google) for A, AAAA, NS and MX.
- **One GET of each registered domain's homepage** (public addresses only, redirects checked, at most 512 KB, nothing submitted) for title, final URL and form detection.
- Only publicly available registration and certificate data is used. This Actor is **not affiliated with any registry, registrar, crt.sh or the brands you monitor**.

### Limitations

- It **guesses** look-alikes (up to 2,000 per brand) and finds others through certificates; a domain that matches neither will be missed. Domains without a certificate are only found if the name is guessed.
- **Certificate search** finds domains that contain your brand name as typed; crt.sh may time out on very common words.
- **RDAP is not available for every TLD**; then DNS decides if a domain exists and the registration date stays empty.
- **Form detection** reads the homepage HTML only; pages that build the form with JavaScript, or phishing kits that only show a form on a sub-page or to certain visitors, are not seen.
- A flagged domain is **not proof of abuse**. Check it before you act.

### FAQ

#### How do I stop my own domains showing up?

Put them in the brand's `domains` list. Domains in that list (and their subdomains) are never reported.

#### Does it check subdomains such as login.acme.example.com?

It reports registrable domains. A certificate for a subdomain on someone else's domain leads to that domain being flagged.

#### How do I reset a monitor?

Use a new Monitor name or delete the named key-value store `impersonation-<name>`.

### More tools from the same developer

All pay-per-result, no proxy or login needed, built and maintained by the same developer:

**Website audits**

- [Website Accessibility Checker: WCAG 2.2 & EAA](https://apify.com/offerastudio/website-accessibility-audit): accessibility issues with fixes, SEO basics and security headers.
- [Cookie & Tracker Audit: GDPR Consent Checker](https://apify.com/offerastudio/cookie-tracker-audit): cookies and tracking tags that load before consent.
- [AI Crawler Access Checker: robots.txt & llms.txt](https://apify.com/offerastudio/ai-crawler-access-audit): which AI crawlers a site allows, plus llms.txt.
- [Structured Data Validator: Schema & Rich Results](https://apify.com/offerastudio/structured-data-validator): JSON-LD and Microdata checked against Google's rich result rules.
- [Website Change Monitor: Diffs, Prices & Alerts](https://apify.com/offerastudio/website-change-monitor): get a row only when a page changes, with a clean diff.
- [Policy Change Monitor: Privacy & Terms Tracker](https://apify.com/offerastudio/policy-change-monitor): privacy policy and terms changes, classified clause by clause.
- [SaaS Pricing Monitor: Track Competitor Plans](https://apify.com/offerastudio/saas-pricing-monitor): competitor pricing plans as structured data, with price-change diffs.
- [Sitemap Change Monitor: New & Removed URLs](https://apify.com/offerastudio/sitemap-change-monitor): new, removed and changed URLs from a site's sitemaps.
- [Site SEO Crawler: Broken Links & On-Page Audit](https://apify.com/offerastudio/site-seo-crawler-audit): site-wide crawl for broken links, redirects and on-page SEO issues.
- [Website Tech Stack Detector: Bulk Lead Filters](https://apify.com/offerastudio/website-tech-stack-detector): technologies used by websites, with filters for lead lists.
- [Domain Availability & Expiry Checker (RDAP)](https://apify.com/offerastudio/domain-whois-availability): domain availability, registrar and expiry dates from RDAP.
- [Status Page SLA Monitor: Uptime & Incidents](https://apify.com/offerastudio/status-page-sla-monitor): SaaS vendor uptime, incidents and a monthly SLA table from public status pages.

**Company data and compliance**

- [Company Contact Finder: Emails, Phones & Socials](https://apify.com/offerastudio/company-contact-finder): contact details published on company websites.
- [UK New Companies Feed: Companies House Daily](https://apify.com/offerastudio/uk-new-companies-feed): newly incorporated UK companies with sector filters.
- [EU VAT Number Validator: Bulk VIES Checker](https://apify.com/offerastudio/eu-vat-number-validator): bulk VAT checks with name, address and consultation number.
- [LEI Corporate Tree: GLEIF Parents & Subsidiaries](https://apify.com/offerastudio/gleif-lei-corporate-tree): LEI lookup with parents, subsidiaries and a KYC summary.
- [UK Company Distress Watch: Insolvency Alerts](https://apify.com/offerastudio/uk-company-distress-watch): administrations, liquidations and winding-up petitions from The Gazette.
- [IBAN Validator: Bulk Check & Bank Lookup](https://apify.com/offerastudio/iban-bank-validator): IBAN format and checksum, plus bank name and BIC where open data exists.
- [Sanctions Screening: OFAC, EU, UN & UK Lists](https://apify.com/offerastudio/sanctions-screening): names screened against official sanctions lists, with match scores.
- [OSHA & EPA Violation Monitor: Fines by Company](https://apify.com/offerastudio/osha-epa-violation-monitor): US OSHA and EPA enforcement cases and penalties by company.
- [Email List Precheck: Syntax, MX & Disposable Check](https://apify.com/offerastudio/email-list-precheck): cheap email list hygiene before a real verification.
- [UK Company Officer Changes: Director & PSC Alerts](https://apify.com/offerastudio/uk-company-officer-changes): director, owner, address and status changes for a watchlist of UK companies.
- [FDA Warning Letters Monitor: By Company & Subject](https://apify.com/offerastudio/fda-warning-letters-monitor): FDA warning letters by company and subject, with cited regulations.
- [Supplier Risk Report: Sanctions, VAT & Insolvency](https://apify.com/offerastudio/supplier-risk-report): one risk row per supplier from eight official registers, with changes since last run.

**Media and AI**

- [Audio & Video Transcriber: Podcasts, SRT, Speakers](https://apify.com/offerastudio/audio-video-transcriber): audio, video, podcasts and social links to text, SRT and VTT.
- [Podcast Mention Alerts: Brand Mentions by Second](https://apify.com/offerastudio/podcast-mention-alerts): where your brand is said in new podcast episodes, with the exact second.
- [News Brand Mentions Monitor: New Articles Only](https://apify.com/offerastudio/news-brand-mentions-monitor): new news articles about your brand, people or topics.
- [YouTube Channel Monitor: New Videos & Growth](https://apify.com/offerastudio/youtube-channel-monitor): new videos and view growth of the channels you watch.

**Market signals**

- [US WARN Layoff Notices: 12 States Daily Feed](https://apify.com/offerastudio/us-warn-layoff-notices): layoff and plant closure notices from official state sources.
- [US Product Recalls Monitor: FDA & CPSC Feed](https://apify.com/offerastudio/us-product-recalls-monitor): FDA and CPSC recalls in one feed, with severity.
- [EU Tenders Feed: TED Public Procurement Alerts](https://apify.com/offerastudio/eu-tender-feed): EU public tenders from TED with CPV, country and value filters.
- [Liquor License Openings: New Bars & Stores (US)](https://apify.com/offerastudio/liquor-license-openings): new US liquor licences from official state open data.
- [Clinical Trials Change Monitor: Status & Updates](https://apify.com/offerastudio/clinicaltrials-change-monitor): status, enrollment and results changes on ClinicalTrials.gov studies.
- [Career Site Jobs Monitor: ATS Jobs & New Roles](https://apify.com/offerastudio/career-site-jobs-monitor): open roles from company career sites, with new and closed roles since the last run.
- [App Reviews Monitor: App Store & Google Play](https://apify.com/offerastudio/app-store-reviews-monitor): app reviews from both stores, only new ones in monitor mode.
- [US Federal Contracts Feed: SAM.gov & USAspending](https://apify.com/offerastudio/us-federal-contracts-feed): SAM.gov contract opportunities with the buyer's award history.
- [Grants.gov Opportunities: US Federal Grants Feed](https://apify.com/offerastudio/grants-gov-opportunities): US federal grant opportunities by keyword, eligibility and agency.
- [Federal Register Monitor: US Rules & Notices Feed](https://apify.com/offerastudio/federal-register-monitor): new US rules, proposed rules and notices by agency or topic.
- [B2B Sales Trigger Feed: Hiring + Tech Leads](https://apify.com/offerastudio/b2b-sales-trigger-feed): companies hiring for a role and using (or not using) a technology, with contacts.
- [Local Business Leads: OpenStreetMap, No Website](https://apify.com/offerastudio/local-business-leads-osm): local businesses by city and category, including those with no website.
- [Solana Token Pair Monitor: New & Trending Pairs](https://apify.com/offerastudio/solana-token-pair-monitor): new and trending Solana pairs with liquidity, volume and safety flags.

### Feedback

Missing a source, a filter or a field? Open an issue on the **Issues** tab.

# Changelog

This Actor's version history is a separate document: https://apify.com/offerastudio/brand-impersonation-domain-monitor/changelog.md

# Actor input Schema

## `brands` (type: `array`):

Each brand has a "name" and the "domains" you officially own, e.g. \[{"name": "Acme", "domains": \["acme.com", "acme.shop"]}]. Official domains are never reported. Up to 50 brands.

## `extraKeywords` (type: `array`):

Words that phishers add to your brand name in your market, e.g. refund, rewards, kundendienst. They are combined with the brand name, and added to the built-in list (login, support, secure, account, verify ...).

## `tlds` (type: `array`):

Other top-level domains to try with the brand name, without the dot. Default: com, net, org, co, io, shop, online, app, xyz, info, store, site.

## `checkCertificates` (type: `boolean`):

Also search public certificate transparency logs (crt.sh) for certificates that contain your brand name, which finds look-alikes this Actor would never guess. crt.sh can be slow; partial results are fine.

## `mode` (type: `string`):

All: report every flagged domain. Monitor: report only domains not reported in an earlier run with the same monitor name.

## `monitorName` (type: `string`):

Names this watch (monitor mode). Runs with the same name share one memory of reported domains, kept in a named key-value store.

## `maxCandidatesPerBrand` (type: `integer`):

How many generated look-alike names are checked per brand (typos, homoglyphs, keywords, TLD swaps, interleaved so each kind is covered). Certificate hits come on top, up to the same number. Default 300, maximum 2,000.

## `includeUnregistered` (type: `boolean`):

Add a free row for each candidate that is not registered (useful to see which names you could still buy defensively). Default off.

## Actor input object example

```json
{
  "brands": [
    {
      "name": "PayPal",
      "domains": [
        "paypal.com"
      ]
    }
  ],
  "checkCertificates": true,
  "mode": "all",
  "maxCandidatesPerBrand": 40,
  "includeUnregistered": false
}
```

# Actor output Schema

## `overview` (type: `string`):

No description

## `evidence` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "brands": [
        {
            "name": "PayPal",
            "domains": [
                "paypal.com"
            ]
        }
    ],
    "checkCertificates": true,
    "mode": "all",
    "maxCandidatesPerBrand": 40
};

// Run the Actor and wait for it to finish
const run = await client.actor("offerastudio/brand-impersonation-domain-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "brands": [{
            "name": "PayPal",
            "domains": ["paypal.com"],
        }],
    "checkCertificates": True,
    "mode": "all",
    "maxCandidatesPerBrand": 40,
}

# Run the Actor and wait for it to finish
run = client.actor("offerastudio/brand-impersonation-domain-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "brands": [
    {
      "name": "PayPal",
      "domains": [
        "paypal.com"
      ]
    }
  ],
  "checkCertificates": true,
  "mode": "all",
  "maxCandidatesPerBrand": 40
}' |
apify call offerastudio/brand-impersonation-domain-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,offerastudio/brand-impersonation-domain-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/xSmJ2emqrULp38PqQ/builds/86J3AElchWxfRrlbr/openapi.json