# Lookalike Domain CT Brand-Abuse Monitor (`plym-actor-factory/lookalike-ct-brand-abuse-monitor`) Actor

Generate lookalikes (dnstwist-class, in-process) for brand apexes, join public CT via crt.sh, and emit LOOKALIKE\_CERT\_ISSUED events when a lookalike gets a new TLS cert. Not a TLS dump; not dnstwist-only.

- **URL**: https://apify.com/plym-actor-factory/lookalike-ct-brand-abuse-monitor.md
- **Developed by:** [Daniel Witney](https://apify.com/plym-actor-factory) (community)
- **Categories:** AI, Automation, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $20.00 / 1,000 lookalike cert event delivereds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Lookalike Domain CT Brand-Abuse Monitor

Seed one or more **brand / apex domains**, generate **lookalike variants in-process** (dnstwist-class algorithms — no paid OSINT API), join **public Certificate Transparency** via [crt.sh](https://crt.sh/), and receive typed **`LOOKALIKE_CERT_ISSUED`** events when a lookalike gets a newly observed TLS certificate (phishing-prep signal).

**Not** a one-shot TLS dump of domains you already know. **Not** dnstwist-only registration/MX findings without a CT join. **Not** Cert Spotter for *your* owned endpoints.

### Value proposition

- **Pipeline join:** brand → lookalike-gen → CT subscribe/poll → emit only `LOOKALIKE_CERT_ISSUED` (issuer, `not_before`, SANs, CT entry id).
- Algorithms in-process: omission, duplication, transposition, replacement, insertion, hyphenation, bitsquatting, homoglyph, vowel-swap, tld-swap, addition.
- Public CT only (`crt.sh`); polite `requestPaceMs` rate-limit. Optional passive DNS A/AAAA enrichment (`checkDns`) — **no** aggressive HTTP crawl of suspect sites.
- **Pay only for unique delivered lookalike-cert events.** First observation of a lookalike’s CT set stores a **baseline** (no charge). Quiet days ≈ $0.
- Durable KVS checkpoint + `event_uid` dedupe.

### PRODUCTION USE (required for real monitoring)

> **Store default ≠ product.** Schema defaults use `sourceMode=fixture` so Apify Store daily auto-tests leave a non-empty health dataset **without** calling crt.sh. That fixture path only writes a non-billable `RUN_STATUS` / `FIXTURE_HEALTH` row. It is **not** brand-abuse monitoring.

For **production monitoring** you **must**:

1. Set **`sourceMode` = `live`**
2. Provide your `brandDomains` (apexes you protect — not the lookalikes)
3. Schedule runs (e.g. daily / every few hours) with polite `requestPaceMs` (default **1000** ms)
4. Optionally enable `checkDns` for passive resolution evidence on new cert events
5. Tune `maxLookalikes` / `maxRunSeconds` / `algorithms` for book size

Official / public references:

- [crt.sh](https://crt.sh/) — public Certificate Transparency search
- [Certificate Transparency](https://certificate.transparency.dev/) — ecosystem overview

### Data limitations (read before buying)

- **crt.sh is a public best-effort mirror.** It can rate-limit, return empty bodies, or lag behind CT logs. This Actor paces politely and retries transient errors; it does **not** claim 100% CT coverage or instant detection.
- **First run** stores CT baselines per lookalike — you will not be charged for “already existing” certs on first observation.
- Generated lookalike sets are **finite** (`maxLookalikes`) and algorithm-dependent — not an exhaustive enumeration of every possible phishing domain.
- Homoglyph variants may include Unicode labels; crt.sh matching is best-effort.
- Exact seed brand domains are **excluded** from lookalike targets (this is not owned-domain Cert Spotter).
- We cite public CT / crt.sh as the data origin. This Actor is not affiliated with Sectigo/crt.sh operators.

### Apify Store daily auto-test / default input

| Field | Default |
|-------|---------|
| `brandDomains` | `["example.com"]` |
| `sourceMode` | `fixture` |
| `emitFixtureDemoEvents` | `false` |
| `maxLookalikes` | `100` |
| `maxRunSeconds` | `55` |
| `maxEvents` | `500` |
| `requestPaceMs` | `1000` |
| `checkDns` | `false` |

On that path the Actor **SUCCEEDS** quickly, pushes exactly one `RUN_STATUS` / `FIXTURE_HEALTH` row (`billable: false`), and does **not** charge `lookalike-cert-event-delivered`.

### Input (summary)

| Field | Notes |
|-------|--------|
| `brandDomains` | Seed brand apexes (required) |
| `algorithms` | Subset of dnstwist-class algorithms |
| `sourceMode` | `fixture` (default) or `live` |
| `emitFixtureDemoEvents` | Default **false** |
| `maxLookalikes` | Cap per brand (default 100) |
| `maxRunSeconds` / `maxEvents` | Budgets |
| `resumeFromCheckpoint` | Default true |
| `requestPaceMs` | Polite crt.sh delay (default 1000) |
| `checkDns` | Optional passive DNS enrichment |

#### Production example

```json
{
  "brandDomains": ["paypal.com"],
  "sourceMode": "live",
  "maxLookalikes": 80,
  "maxRunSeconds": 120,
  "requestPaceMs": 1000,
  "checkDns": false,
  "resumeFromCheckpoint": true
}
```

### Output

#### Lookalike-cert events (billable under PPE)

Typed rows include: `brand_domain`, `lookalike_domain`, `algorithm`, `event_type` (`LOOKALIKE_CERT_ISSUED`), `issuer`, `not_before`, `not_after`, `common_name`, `san_domains`, `ct_entry_id`, `ct_entry_timestamp`, optional `dns_resolves`, `evidence`, `summary`, `source_url`, `event_uid`, `billable: true`.

#### RUN\_STATUS (never billed)

Every successful run pushes one health row (`FIXTURE_HEALTH` | `MONITOR_IDLE` | `CATCHUP_COMPLETE` | `HEALTH_OK`) including lookalike / CT counters.

### Pricing

Pay-per-event: **`lookalike-cert-event-delivered`** at **$0.02** per delivered unique lookalike-cert event ($20 / 1,000). Single tier (see `docs/monetization.md` and ADR 0010). Health / baseline / duplicate / fixture rows are never charged.

### Local development

```bash
cd actors/lookalike-ct-brand-abuse-monitor
npm install
npm test
npm run build
## Store-safe fixture health:
apify run -p
## Demo typed events locally:
## set input emitFixtureDemoEvents=true (still sourceMode=fixture)
```

### Attribution

Certificate data originates from **public Certificate Transparency** logs as exposed by **crt.sh**. Lookalike strings are generated locally. Not an official crt.sh / Sectigo / CA product. Not SSLMate Cert Spotter.

# Actor input Schema

## `brandDomains` (type: `array`):

Seed brand apex domains (e.g. paypal.com). Lookalikes are generated from these; the exact seeds themselves are never treated as lookalike abuse targets.

## `algorithms` (type: `array`):

dnstwist-class algorithms to run in-process (no paid API). Default: a practical subset covering omission, duplication, transposition, replacement, insertion, hyphenation, bitsquatting, homoglyph, vowel-swap, tld-swap, addition.

## `maxLookalikes` (type: `integer`):

Cap on generated lookalike FQDNs per brand domain (deterministic truncation after sort).

## `maxRunSeconds` (type: `integer`):

Wall-clock budget for this scheduled poll.

## `maxEvents` (type: `integer`):

Stop after this many unique lookalike-cert events are delivered (does not include RUN\_STATUS).

## `resumeFromCheckpoint` (type: `boolean`):

If true, resume seen CT cert IDs / event\_uids from the default Key-Value Store. First observation of a lookalike's cert set is baseline-only (no charge).

## `sourceMode` (type: `string`):

fixture = local/CI / Apify Store daily auto-test default (no network; emits RUN\_STATUS only unless emitFixtureDemoEvents=true). live = generate lookalikes in-process and query public crt.sh Certificate Transparency (polite rate-limit; passive only).

## `emitFixtureDemoEvents` (type: `boolean`):

When sourceMode=fixture, if true push fabricated LOOKALIKE\_CERT\_ISSUED events from local fixtures (unit/local demos only). Default false so Store daily auto-tests never emit fake product events or charge lookalike-cert-event-delivered. Production: leave false and use sourceMode=live. SAMPLE rows only: demo events use placeholder entities (never real companies/IDs), are flagged sample=true / isSample=true, and are NEVER charged.

## `checkDns` (type: `boolean`):

If true, after a new lookalike cert is observed, attempt a passive DNS A/AAAA lookup and attach resolution evidence (still only LOOKALIKE\_CERT\_ISSUED is billable; no aggressive HTTP crawl).

## `maxTotalChargeUsd` (type: `number`):

Optional soft budget hint for delivered lookalike-cert events. Platform ACTOR\_MAX\_TOTAL\_CHARGE\_USD also applies when set.

## `requestPaceMs` (type: `integer`):

Minimum delay between outbound crt.sh HTTP requests (polite fair-use pacing; crt.sh is public and rate-sensitive).

## Actor input object example

```json
{
  "brandDomains": [
    "example.com"
  ],
  "algorithms": [
    "omission",
    "duplication",
    "transposition",
    "replacement",
    "insertion",
    "hyphenation",
    "bitsquatting",
    "homoglyph",
    "vowel-swap",
    "tld-swap",
    "addition"
  ],
  "maxLookalikes": 100,
  "maxRunSeconds": 55,
  "maxEvents": 500,
  "resumeFromCheckpoint": true,
  "sourceMode": "fixture",
  "emitFixtureDemoEvents": false,
  "checkDns": false,
  "requestPaceMs": 1000
}
```

# Actor output Schema

## `OUTPUT` (type: `string`):

JSON summary: delivered, charged, runStatus, checkpoint, stats, lookalike counts

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("plym-actor-factory/lookalike-ct-brand-abuse-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("plym-actor-factory/lookalike-ct-brand-abuse-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call plym-actor-factory/lookalike-ct-brand-abuse-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,plym-actor-factory/lookalike-ct-brand-abuse-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/c9qthBgtuTdZXxRiU/builds/Ssx2x3auGADAEfRbp/openapi.json