# Brand Lookalike Watch — Phishing & Typosquat Domains (`prelaunch-radar/brand-lookalike-watch`) Actor

- **URL**: https://apify.com/prelaunch-radar/brand-lookalike-watch.md
- **Developed by:** [Pre-Launch Radar](https://apify.com/prelaunch-radar) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 suspect domain founds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Brand Lookalike Watch — Phishing & Typosquatting Domains from CT Logs

Phishing sites and fake shops need an HTTPS certificate **before** their campaign starts.
Every certificate is written to public **Certificate Transparency (CT) logs**. This Actor
reads those logs and returns the newly certified domains that imitate **your** brand:

- **Typosquatting** — one keystroke away: `paypall.com`, `coinbsae.org`
- **Homoglyphs & IDN** — look-alike characters: `paypa1.com`, `rnicrosoft-support.com`, `раypal.com` (Cyrillic)
- **Combosquatting** — brand plus bait words: `paypal-login-secure.com`, `coinbase.com.verify-wallet.xyz`
- **TLD variants** — your exact name on another extension: `nike.shop`

Unlike permutation tools (dnstwist and similar), it does not *guess* thousands of possible
names: it only reports domains that **really exist and just received a certificate**.

### Prefer a weekly email instead?

Looking for automated weekly monitoring without running Actors? Subscribe to our turnkey
**Brand Watch** service ($2.99/month): type your brand once, get one email a week with the new
look-alike domains and a CSV file. Same engine, no setup, cancel anytime:
https://slama13.gumroad.com/l/snvpxl

### Who it is for

- Brand-protection, fraud and trust & safety teams
- MSSPs, SOC analysts and freelancers who monitor clients' brands
- AI security agents (callable through the Apify MCP server)

### How to use it

1. Enter your **brands** (`acmebank`, `acme`) and your **official domains** (`acmebank.com`), which are never reported.
2. Run once, or **schedule it daily** with `sinceDays: 1` or `2` and a webhook or integration for alerts.
3. Or switch to **Score my list of domains** to rate domains you already have.

Example input:

```json
{ "brands": ["paypal", "netflix"], "ownDomains": ["paypal.com", "netflix.com"], "sinceDays": 2, "minScore": 40 }
```

### What it returns

| Field | Meaning |
|---|---|
| `domain` | The certified hostname (IDN in punycode) |
| `unicode` | Decoded Unicode form when the name is an IDN, else `null` |
| `brand` | Which of your brands it imitates |
| `match_type` | `typosquat`, `homoglyph`, `combosquat` or `tld-variant` (`none` in scoring mode) |
| `matched_on` | The exact part of the name that matched |
| `registrable_domain` | The registered domain behind the hostname |
| `risk_score` | 0–100, sum of the signals below |
| `risk_signals` | Human-readable reasons: bait keyword (`login`, `verify`, `wallet`…), low-cost TLD, brand only in a subdomain, live DNS, freshly registered domain |
| `resolves`, `ip` | Whether the name answers in public DNS, and its first IP |
| `domain_registered`, `domain_age_days` | Registration date from the official RDAP registry |
| `certificate_seen` | When the certificate appeared in the CT log (watch mode) |

Example (real item from a test run on 26 Sep 2026):

```json
{ "domain": "netfilxrenewn.com", "brand": "netflix", "match_type": "homoglyph", "risk_score": 75,
  "risk_signals": ["homoglyph", "resolves (live)", "domain registered 0 days ago"],
  "domain_registered": "2026-09-26", "domain_age_days": 0 }
```

### Coverage — read this

- Source: public CT logs for **Let's Encrypt** certificates (the most used issuer for new
  sites), sampled **every 2 hours**, kept for **7 days**. It is an early-warning feed, not an
  exhaustive registry of every certificate ever issued.
- The score is a **bundle of public signals, not a verdict**. Common words that contain a
  brand are filtered with an English dictionary, but a legitimate site can still match
  (`booking.somehotel.com`). Always review before any takedown or legal action.
- Short brands (3 letters) only match as whole words; typo matching starts at 5 letters.

### Pricing

Pay per event: you are charged for each lookalike domain returned (`lookalike`) or each
domain scored (`domain-check`) — no subscription. `maxItems` and `minScore` cap the cost.

### Data & privacy

Domain names and public infrastructure records only (CT logs, DNS, RDAP registration
dates). **No personal data** is collected or returned: no emails, phone numbers, names
of people or addresses.

### LEGAL DISCLAIMER

This Actor is an independent tool. It is **not affiliated with, endorsed or sponsored by
any brand** that users choose to monitor, nor by the certificate authorities or registries
it reads. Brand names in examples are used only to illustrate matching. Results are
automated signals from public data, provided **"as is"**, without warranty of accuracy,
completeness or fitness for a particular purpose; they are not legal advice. Liability is
limited to the amount paid for the run. Users are responsible for how they act on results.

# Actor input Schema

## `brands` (type: `array`):

Brand names as they appear in domains (letters and digits, 3+ characters), e.g. 'paypal', 'coinbase', 'acmebank'. Typo matching applies from 5 letters, substring matching from 4.

## `ownDomains` (type: `array`):

Domains you own, e.g. 'paypal.com'. They and their subdomains are never reported.

## `mode` (type: `string`):

watch = scan recent public certificates for lookalikes. check = score the domains you paste in 'domains' against your brands.

## `sinceDays` (type: `integer`):

watch mode only. Schedule the Actor daily with 1 or 2 days for continuous monitoring.

## `minScore` (type: `integer`):

watch mode only. 0 = everything that looks like your brand; 60+ = strongest signals only (access keywords, fresh registration, live DNS).

## `maxItems` (type: `integer`):

Upper bound on results (and so on cost).

## `domains` (type: `array`):

check mode only. Domains or URLs to score against your brands.

## Actor input object example

```json
{
  "brands": [
    "paypal",
    "netflix"
  ],
  "mode": "watch",
  "sinceDays": 2,
  "minScore": 40,
  "maxItems": 200
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "brands": [
        "paypal",
        "netflix"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("prelaunch-radar/brand-lookalike-watch").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "brands": [
        "paypal",
        "netflix",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("prelaunch-radar/brand-lookalike-watch").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "brands": [
    "paypal",
    "netflix"
  ]
}' |
apify call prelaunch-radar/brand-lookalike-watch --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,prelaunch-radar/brand-lookalike-watch"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/C0TVRBV32rbZFzQxH/builds/VAjGecwya2dTVwNhe/openapi.json