Brand Lookalike Watch — Phishing & Typosquatting Domains from CT Logs

Phishing sites and fake shops need an HTTPS certificate before their campaign starts. Every certificate is written to public Certificate Transparency (CT) logs. This Actor reads those logs and returns the newly certified domains that imitate your brand:

• Typosquatting — one keystroke away: paypall.com, coinbsae.org
• Homoglyphs & IDN — look-alike characters: paypa1.com, rnicrosoft-support.com, раypal.com (Cyrillic)
• Combosquatting — brand plus bait words: paypal-login-secure.com, coinbase.com.verify-wallet.xyz
• TLD variants — your exact name on another extension: nike.shop

Unlike permutation tools (dnstwist and similar), it does not guess thousands of possible names: it only reports domains that really exist and just received a certificate.

Prefer a weekly email instead?

Looking for automated weekly monitoring without running Actors? Subscribe to our turnkey Brand Watch service ($2.99/month): type your brand once, get one email a week with the new look-alike domains and a CSV file. Same engine, no setup, cancel anytime: https://slama13.gumroad.com/l/snvpxl

Who it is for

• Brand-protection, fraud and trust & safety teams
• MSSPs, SOC analysts and freelancers who monitor clients' brands
• AI security agents (callable through the Apify MCP server)

How to use it

1. Enter your brands (acmebank, acme) and your official domains (acmebank.com), which are never reported.
2. Run once, or schedule it daily with sinceDays: 1 or 2 and a webhook or integration for alerts.
3. Or switch to Score my list of domains to rate domains you already have.

Example input:

{ "brands": ["paypal", "netflix"], "ownDomains": ["paypal.com", "netflix.com"], "sinceDays": 2, "minScore": 40 }

What it returns

Field	Meaning
domain	The certified hostname (IDN in punycode)
unicode	Decoded Unicode form when the name is an IDN, else null
brand	Which of your brands it imitates
match_type	typosquat, homoglyph, combosquat or tld-variant (none in scoring mode)
matched_on	The exact part of the name that matched
registrable_domain	The registered domain behind the hostname
risk_score	0–100, sum of the signals below
risk_signals	Human-readable reasons: bait keyword (login, verify, wallet…), low-cost TLD, brand only in a subdomain, live DNS, freshly registered domain
resolves, ip	Whether the name answers in public DNS, and its first IP
domain_registered, domain_age_days	Registration date from the official RDAP registry
certificate_seen	When the certificate appeared in the CT log (watch mode)

Example (real item from a test run on 26 Sep 2026):

{ "domain": "netfilxrenewn.com", "brand": "netflix", "match_type": "homoglyph", "risk_score": 75,
  "risk_signals": ["homoglyph", "resolves (live)", "domain registered 0 days ago"],
  "domain_registered": "2026-09-26", "domain_age_days": 0 }

Coverage — read this

• Source: public CT logs for Let's Encrypt certificates (the most used issuer for new sites), sampled every 2 hours, kept for 7 days. It is an early-warning feed, not an exhaustive registry of every certificate ever issued.
• The score is a bundle of public signals, not a verdict. Common words that contain a brand are filtered with an English dictionary, but a legitimate site can still match (booking.somehotel.com). Always review before any takedown or legal action.
• Short brands (3 letters) only match as whole words; typo matching starts at 5 letters.

Pricing

Pay per event: you are charged for each lookalike domain returned (lookalike) or each domain scored (domain-check) — no subscription. maxItems and minScore cap the cost.

Data & privacy

Domain names and public infrastructure records only (CT logs, DNS, RDAP registration dates). No personal data is collected or returned: no emails, phone numbers, names of people or addresses.

LEGAL DISCLAIMER

This Actor is an independent tool. It is not affiliated with, endorsed or sponsored by any brand that users choose to monitor, nor by the certificate authorities or registries it reads. Brand names in examples are used only to illustrate matching. Results are automated signals from public data, provided "as is", without warranty of accuracy, completeness or fitness for a particular purpose; they are not legal advice. Liability is limited to the amount paid for the run. Users are responsible for how they act on results.