Lookalike Domain CT Brand-Abuse Monitor

Seed one or more brand / apex domains, generate lookalike variants in-process (dnstwist-class algorithms — no paid OSINT API), join public Certificate Transparency via crt.sh, and receive typed LOOKALIKE_CERT_ISSUED events when a lookalike gets a newly observed TLS certificate (phishing-prep signal).

Not a one-shot TLS dump of domains you already know. Not dnstwist-only registration/MX findings without a CT join. Not Cert Spotter for your owned endpoints.

Value proposition

• Pipeline join: brand → lookalike-gen → CT subscribe/poll → emit only LOOKALIKE_CERT_ISSUED (issuer, not_before, SANs, CT entry id).
• Algorithms in-process: omission, duplication, transposition, replacement, insertion, hyphenation, bitsquatting, homoglyph, vowel-swap, tld-swap, addition.
• Public CT only (crt.sh); polite requestPaceMs rate-limit. Optional passive DNS A/AAAA enrichment (checkDns) — no aggressive HTTP crawl of suspect sites.
• Pay only for unique delivered lookalike-cert events. First observation of a lookalike’s CT set stores a baseline (no charge). Quiet days ≈ $0.
• Durable KVS checkpoint + event_uid dedupe.

PRODUCTION USE (required for real monitoring)

Store default ≠ product. Schema defaults use sourceMode=fixture so Apify Store daily auto-tests leave a non-empty health dataset without calling crt.sh. That fixture path only writes a non-billable RUN_STATUS / FIXTURE_HEALTH row. It is not brand-abuse monitoring.

For production monitoring you must:

1. Set sourceMode = live
2. Provide your brandDomains (apexes you protect — not the lookalikes)
3. Schedule runs (e.g. daily / every few hours) with polite requestPaceMs (default 1000 ms)
4. Optionally enable checkDns for passive resolution evidence on new cert events
5. Tune maxLookalikes / maxRunSeconds / algorithms for book size

Official / public references:

• crt.sh — public Certificate Transparency search
• Certificate Transparency — ecosystem overview

Data limitations (read before buying)

• crt.sh is a public best-effort mirror. It can rate-limit, return empty bodies, or lag behind CT logs. This Actor paces politely and retries transient errors; it does not claim 100% CT coverage or instant detection.
• First run stores CT baselines per lookalike — you will not be charged for “already existing” certs on first observation.
• Generated lookalike sets are finite (maxLookalikes) and algorithm-dependent — not an exhaustive enumeration of every possible phishing domain.
• Homoglyph variants may include Unicode labels; crt.sh matching is best-effort.
• Exact seed brand domains are excluded from lookalike targets (this is not owned-domain Cert Spotter).
• We cite public CT / crt.sh as the data origin. This Actor is not affiliated with Sectigo/crt.sh operators.

Apify Store daily auto-test / default input

Field	Default
brandDomains	["example.com"]
sourceMode	fixture
emitFixtureDemoEvents	false
maxLookalikes	100
maxRunSeconds	55
maxEvents	500
requestPaceMs	1000
checkDns	false

On that path the Actor SUCCEEDS quickly, pushes exactly one RUN_STATUS / FIXTURE_HEALTH row (billable: false), and does not charge lookalike-cert-event-delivered.

Input (summary)

Field	Notes
brandDomains	Seed brand apexes (required)
algorithms	Subset of dnstwist-class algorithms
sourceMode	fixture (default) or live
emitFixtureDemoEvents	Default false
maxLookalikes	Cap per brand (default 100)
maxRunSeconds / maxEvents	Budgets
resumeFromCheckpoint	Default true
requestPaceMs	Polite crt.sh delay (default 1000)
checkDns	Optional passive DNS enrichment

Production example

{
  "brandDomains": ["paypal.com"],
  "sourceMode": "live",
  "maxLookalikes": 80,
  "maxRunSeconds": 120,
  "requestPaceMs": 1000,
  "checkDns": false,
  "resumeFromCheckpoint": true
}

Output

Lookalike-cert events (billable under PPE)

Typed rows include: brand_domain, lookalike_domain, algorithm, event_type (LOOKALIKE_CERT_ISSUED), issuer, not_before, not_after, common_name, san_domains, ct_entry_id, ct_entry_timestamp, optional dns_resolves, evidence, summary, source_url, event_uid, billable: true.

RUN_STATUS (never billed)

Every successful run pushes one health row (FIXTURE_HEALTH | MONITOR_IDLE | CATCHUP_COMPLETE | HEALTH_OK) including lookalike / CT counters.

Pricing

Pay-per-event: lookalike-cert-event-delivered at $0.02 per delivered unique lookalike-cert event ($20 / 1,000). Single tier (see docs/monetization.md and ADR 0010). Health / baseline / duplicate / fixture rows are never charged.

Local development

cd actors/lookalike-ct-brand-abuse-monitor
npm install
npm test
npm run build
# Store-safe fixture health:
apify run -p
# Demo typed events locally:
# set input emitFixtureDemoEvents=true (still sourceMode=fixture)

Attribution

Certificate data originates from public Certificate Transparency logs as exposed by crt.sh. Lookalike strings are generated locally. Not an official crt.sh / Sectigo / CA product. Not SSLMate Cert Spotter.