n8n Workflow: Monitor Brand Domains & Typosquats with DomainKits

Stay ahead of brand domain abuse—daily monitoring for new registrations and typosquats with DomainKits

This n8n workflow automatically scans for newly registered domains matching your brand keyword and checks typosquat variants of your brand domain using DomainKits. Each run compiles WHOIS and DNS details into a CSV and emails a plaintext report—so you can quickly spot potential phishing and impersonation threats.

What this workflow does

• Runs daily at 14:00 UTC and sets the brand domain used for all downstream lookups.
• Searches DomainKits for newly registered domains (last 10 days) that contain your brand keyword.
• Generates DomainKits typosquat variants for the monitored brand domain and records which variants are registered and their statuses (including what is for-sale or expiring, as available).
• Batches NRD domains and queries DomainKits bulk WHOIS (registrar and nameservers) and bulk DNS (status and nameservers).
• Builds a combined report that sorts registrations newest-first, summarizes typosquat coverage, and prepares results as a CSV attachment.
• Sends the findings by email with the CSV attached as a plaintext report.

Use cases

• Brand protection teams tracking newly registered lookalike domains.
• SaaS operators monitoring impersonation attempts targeting their domain.
• Automation engineers needing an n8n workflow for recurring DomainKits reconnaissance and reporting.
• Security or trust-and-safety workflows that require WHOIS/DNS visibility on demand.

Technical details

• DomainKits API credential configured for NRD search, typosquat lookup, bulk WHOIS, and bulk DNS.
• Workflow nodes: Set, Code, Merge, Split out, Email Send, and Sticky note.
• Setup steps: add DomainKits credentials, update the brand domain in the Set Brand step, then configure Email Send with your SMTP credentials (and adjust the schedule if needed).