What does Typosquat Monitor — Find Fake Lookalike Domains return?

It returns 14 documented output fields: domain, threatScore, threatLevel, capability, hasMailServer, hasWebsite, technique, registered, watchedDomain, ipAddresses, mailServers and recommendation. Each field declares its type, a description of what it holds, and an example value. The remaining 2 are listed in the output schema below.

What input does Typosquat Monitor — Find Fake Lookalike Domains require?

domains is required. A further 9 inputs are optional. The full input schema, with types and defaults, is below.

Does Typosquat Monitor — Find Fake Lookalike Domains need an API key or login?

No. None of its inputs is a credential, and it reads only public data. Nothing to sign up for before the first run.

How do I run Typosquat Monitor — Find Fake Lookalike Domains?

It runs on Apify. Start it from its listing with the inputs above, or call the Apify API with the Actor's ID. Results land in a dataset you can export as JSON, CSV or Excel, or read through the Apify API into your own pipeline.

Typosquat Monitor — Find Fake Lookalike Domains

Generate every plausible lookalike of your domain using 11 attack techniques (homoglyphs, keyboard slips, TLD swaps, combosquatting) and find which are registered - and critically, which have MX records and can receive phishing or invoice-fraud email. Free DNS, no key, no login.

Typosquat Monitor — Find Fake Lookalike Domains returns 14 documented output fields, including domain, threatScore, threatLevel, capability and hasMailServer. Every field carries a declared type, a written description and an example value. 32 runs are recorded on Apify.

Run it on ApifyPay per result · no subscription

14: Output fields
10: Inputs
32: Runs
2026-10-15: Last run

01 — output

What it returns

Every field the extractor writes to its dataset, with its type, a written description and an example value.

Field	Type	What it holds	Example
domain	stringnull	Domain name, without the scheme.	example.com
threatScore	integernull	Threat score, from 0 to 100. Higher is more threatening.	0
threatLevel	stringnull	Threat level in words.	<threatLevel>
capability	stringnull	Capability as recorded for this row.	<capability>
hasMailServer	booleannull	Whether the domain publishes mail servers.	true
hasWebsite	booleannull	Whether a website was found.	true
technique	stringnull	Technique the source documents for this entry.	<technique>
registered	booleannull	Whether the entity is registered.	true
watchedDomain	stringnull	Domain this run was configured to watch.	<watchedDomain>
ipAddresses	stringnull	IP addresses the name resolves to.	<ipAddresses>
mailServers	stringnull	Mail servers the domain uses.	<mailServers>
recommendation	stringnull	The recommended action for this row.	Review the price change before it propagates.
checkedAt	stringnull	ISO 8601 timestamp of the most recent check.	2026-10-16T09:12:44.000Z
status	stringnull	Outcome recorded for this row.	ok

02 — sample

One record

Assembled from the example values declared on the schema above, not invented at render time.

{
  "domain": "example.com",
  "threatScore": 0,
  "threatLevel": "<threatLevel>",
  "capability": "<capability>",
  "hasMailServer": true,
  "hasWebsite": true,
  "technique": "<technique>",
  "registered": true
}

03 — input

What you give it

Input	Type	Description
domains	arrayrequired	The domains to protect. Lookalikes are generated from these.
techniques	arrayoptional	Leave empty to use all 11. Fewer techniques = faster, cheaper runs.
checkEmailCapability	booleanoptional	Strongly recommended. A lookalike with MX records can RECEIVE EMAIL — that is invoice-fraud and credential-phishing infrastructure, and it is the single most important finding this actor produces.
registeredOnly	booleanoptional	On by default. Turn off to also list unregistered variants you may want to defensively register.
minThreatScore	integeroptional	Filter out low-signal hits. 40+ = medium, 60+ = high, 80+ = critical.
maxVariantsPerDomain	integeroptional	Caps how wide the net goes. 800 is thorough; lower it for a fast scan.
tlds	arrayoptional	Leave empty for the commonly abused defaults (.com .co .cm .om .net .org .io .app …).
comboWords	arrayoptional	Leave empty for the defaults (login, secure, verify, billing, support …).
concurrency	integeroptional	10 is a good balance.
maxItems	integeroptional	Hard limit, strictly enforced.

04 — run

Run Typosquat Monitor on your own input

It runs in the cloud on Apify. Nothing to install, and you are billed per result returned rather than per attempt.

Open on Apify ↗

Also in business, developer tools

05 — questions

Asked before running it

14 of 14 fields described

What does Typosquat Monitor — Find Fake Lookalike Domains return?: It returns 14 documented output fields: domain, threatScore, threatLevel, capability, hasMailServer, hasWebsite, technique, registered, watchedDomain, ipAddresses, mailServers and recommendation. Each field declares its type, a description of what it holds, and an example value. The remaining 2 are listed in the output schema below.
What input does Typosquat Monitor — Find Fake Lookalike Domains require?: domains is required. A further 9 inputs are optional. The full input schema, with types and defaults, is below.
Does Typosquat Monitor — Find Fake Lookalike Domains need an API key or login?: No. None of its inputs is a credential, and it reads only public data. Nothing to sign up for before the first run.
How do I run Typosquat Monitor — Find Fake Lookalike Domains?: It runs on Apify. Start it from its listing with the inputs above, or call the Apify API with the Actor's ID. Results land in a dataset you can export as JSON, CSV or Excel, or read through the Apify API into your own pipeline.