# Lookalike Domain Finder: Typosquat & Phishing Detection (`scrapemint/lookalike-domain-finder`) Actor Find registered lookalike domains impersonating your brand: typos, homoglyphs, hyphenations, phishing prefixes, and TLD swaps, checked live against DNS. Flags domains with a mail server (spoofing-capable) and shows registration dates. Keyless, no browser. Pay per lookalike found. - **URL**: https://apify.com/scrapemint/lookalike-domain-finder.md - **Developed by:** [Ken M](https://apify.com/scrapemint) (community) - **Categories:** Business, Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Lookalike Domain Finder: Typosquat & Phishing Detection Attackers register domains that look like yours - `paypa1.com`, `secure-paypal.com`, `paypal.co` - to phish your customers and staff. This actor finds the ones that actually exist. Give it your domain; it generates hundreds of lookalike variants, checks each against live DNS, and returns only the registered ones, flagging those that can send email. Brand-protection platforms charge thousands a month for this. Here you pay only for the lookalikes actually found. ### How it works 1. **Generate** hundreds of variants of your domain, fully offline: - Typos: omitted, doubled, transposed, and adjacent-key characters (`paypl.com`, `paypall.com`, `payapl.com`) - Homoglyphs: `o -> 0`, `l -> 1`, `rn -> m`, `vv -> w` (`paypa1.com`) - Hyphenation (`pay-pal.com`) - Phishing prefixes and suffixes (`login-paypal.com`, `paypal-secure.com`) - TLD swaps (`paypal.net`, `paypal.co`, `paypal.io`) 2. **Resolve** every variant through Google's DNS-over-HTTPS. Only domains that actually resolve are kept. 3. **Enrich** each hit with its IPs, name servers, whether it has a mail server, and its registration date. ### What you get One row per registered lookalike: | Field | Description | | --- | --- | | `lookalikeDomain` | The impersonating domain that exists | | `brandDomain` | Your domain it mimics | | `ipAddresses`, `nameServers` | Where it points | | `hasMailServer`, `mxHosts` | Whether it can send spoofed email (top risk) | | `registrationDate` | When it was registered (RDAP); recent = active threat | | `riskFlags` | mail-capable, hyphenated, different-tld | ### Use it as a monitor Turn on `dedupe` and schedule it: each run returns only lookalikes that have appeared since last time. That turns the actor into a brand-abuse alarm - you hear about a new impersonating domain the day it goes live. ### Typical uses - **Security teams**: continuous typosquat and phishing-infrastructure discovery. - **Brand and legal**: evidence for takedown and UDRP complaints. - **MSPs and agencies**: run it per client on a schedule. - **Domain investors**: see which variations of a name are already taken. ### Pricing You pay per registered lookalike found (`lookalike_found`). Variants that are not registered - the vast majority - cost nothing. The first 2 rows of every run are free. ### Input example ```json { "domains": ["mybrand.com"], "includeHomoglyphs": true, "onlyWithMx": false, "maxVariantsPerDomain": 600, "dedupe": true } ```` ### Notes - Fully keyless: offline variant generation plus Google DNS-over-HTTPS and public RDAP. No API key, no browser. - A registered lookalike is not proof of malicious intent - it can be a defensive registration you or a partner own. The data lets you judge; the mail-server flag and registration date are the strongest signals. - Set `onlyWithMx` to focus on the domains that can actually send spoofed email. # Actor input Schema ## `domains` (type: `array`): The domains you want to protect, e.g. stripe.com, mycompany.io. The actor generates lookalike variants of each and checks which are registered. ## `includeHomoglyphs` (type: `boolean`): Also test look-alike character swaps like o->0, l->1, rn->m, vv->w. These are the sneakiest impersonations. ## `extraTlds` (type: `array`): Additional top-level domains to check the exact brand name against, e.g. shop, store, ai. A common set is always included. ## `onlyWithMx` (type: `boolean`): Return only registered lookalikes that have a mail server, meaning they can send brand-spoofing email. The highest-risk subset. ## `includeRegistrationDate` (type: `boolean`): Add each lookalike's domain registration date via RDAP so you can spot recently registered threats. Adds one lookup per lookalike found. ## `maxVariantsPerDomain` (type: `integer`): How many lookalike candidates to generate and check per brand domain. Higher = more thorough, more DNS lookups. ## `maxRows` (type: `integer`): Cap on registered lookalike rows returned. Controls total cost. ## `dedupe` (type: `boolean`): Remember returned lookalikes across runs and skip them. Turn on with a schedule to be alerted only when a NEW lookalike of your brand appears. ## Actor input object example ```json { "domains": [ "paypal.com" ], "includeHomoglyphs": true, "extraTlds": [], "onlyWithMx": false, "includeRegistrationDate": true, "maxVariantsPerDomain": 600, "maxRows": 100, "dedupe": false } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "paypal.com" ] }; // Run the Actor and wait for it to finish const run = await client.actor("scrapemint/lookalike-domain-finder").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": ["paypal.com"] } # Run the Actor and wait for it to finish run = client.actor("scrapemint/lookalike-domain-finder").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "paypal.com" ] }' | apify call scrapemint/lookalike-domain-finder --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=scrapemint/lookalike-domain-finder", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Lookalike Domain Finder: Typosquat & Phishing Detection", "description": "Find registered lookalike domains impersonating your brand: typos, homoglyphs, hyphenations, phishing prefixes, and TLD swaps, checked live against DNS. Flags domains with a mail server (spoofing-capable) and shows registration dates. Keyless, no browser. Pay per lookalike found.", "version": "0.1", "x-build-id": "8I2BETc5ckcGSsSuM" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/scrapemint~lookalike-domain-finder/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-scrapemint-lookalike-domain-finder", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/scrapemint~lookalike-domain-finder/runs": { "post": { "operationId": "runs-sync-scrapemint-lookalike-domain-finder", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/scrapemint~lookalike-domain-finder/run-sync": { "post": { "operationId": "run-sync-scrapemint-lookalike-domain-finder", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domains" ], "properties": { "domains": { "title": "Brand domains (one per line)", "type": "array", "description": "The domains you want to protect, e.g. stripe.com, mycompany.io. The actor generates lookalike variants of each and checks which are registered.", "items": { "type": "string" } }, "includeHomoglyphs": { "title": "Include homoglyph tricks", "type": "boolean", "description": "Also test look-alike character swaps like o->0, l->1, rn->m, vv->w. These are the sneakiest impersonations.", "default": true }, "extraTlds": { "title": "Extra TLDs to test (optional)", "type": "array", "description": "Additional top-level domains to check the exact brand name against, e.g. shop, store, ai. A common set is always included.", "default": [], "items": { "type": "string" } }, "onlyWithMx": { "title": "Only mail-capable lookalikes", "type": "boolean", "description": "Return only registered lookalikes that have a mail server, meaning they can send brand-spoofing email. The highest-risk subset.", "default": false }, "includeRegistrationDate": { "title": "Look up registration date", "type": "boolean", "description": "Add each lookalike's domain registration date via RDAP so you can spot recently registered threats. Adds one lookup per lookalike found.", "default": true }, "maxVariantsPerDomain": { "title": "Max variants per domain", "minimum": 20, "maximum": 2000, "type": "integer", "description": "How many lookalike candidates to generate and check per brand domain. Higher = more thorough, more DNS lookups.", "default": 600 }, "maxRows": { "title": "Max lookalikes per run", "minimum": 1, "maximum": 2000, "type": "integer", "description": "Cap on registered lookalike rows returned. Controls total cost.", "default": 100 }, "dedupe": { "title": "Skip lookalikes seen in previous runs", "type": "boolean", "description": "Remember returned lookalikes across runs and skip them. Turn on with a schedule to be alerted only when a NEW lookalike of your brand appears.", "default": false } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```