Resources  / Research

Who registers lookalikes of big brands, and what they do with them

Draft. These numbers come from a development database and will be replaced before this page is published.

We read every lookalike our generator produces for 100 well-known brands, and found 28,158 registered (27,260 distinct domains). Most of them are not attacks. This page says what they are, who registers them, where they live, and how fast they move — counted on Oct 10, 2026.

First, what the names are

A count of every registered lookalike of a big brand is mostly the brand's own lawyers. So each name is put in one class first, and every number below is per class.

• Active, unexplained 20,482 · 73%

  Publishes an address or a mail service, and none of the above explains it. The class worth watching; an address is the ability to serve a page, not proof that one is served.

• Parked 4,214 · 15%

  Held by a parking service, doing nothing of its own.

• The brand’s own 3,093 · 11%

  The brand's own: the ownership check, a corporate registrar such as MarkMonitor, or brand-protection DNS.

• Somebody’s business 369 · 1%

  Somebody's business: years of stable DNS and mail, an independent popularity rank, or a staff review.

Same ending, or a new one?

Of the active, unexplained names, 59% swap the brand's ending for another (example.com becomes example.net or example.co) and 41% keep it and change the name.

Who registers them

Where they take mail, and where they live

For the active, unexplained names. Mail matters for a different reason than a website: it is how a reply is captured, and how a business-email-compromise thread is held open.

How fast they move

Hours, over names registered after we began watching their brand. Our scan reads every name every few hours, so a figure under that is the scan, not the attacker.

Registered to live

2 days

median over 660 names; half fall between 15.9 hours and 7 days

Live to taking mail

0 hours

median over 170 names; most configure mail on the day they go live, inside one pass of our scan

Who is targeted most

Names that are not the brand's own, not parked and not dormant, by the brand they imitate. The showcase is big brands only; how small businesses are targeted is a different question these numbers do not answer.

• mail.ru 685 · 3%
• live.com 576 · 3%
• goo.gl 500 · 2%
• bit.ly 499 · 2%
• wa.me 489 · 2%
• nic.ru 470 · 2%
• x.com 457 · 2%
• ui.com 448 · 2%
• t.me 447 · 2%
• qq.com 432 · 2%
• apple.com 420 · 2%
• whatsapp.com 420 · 2%
• zoom.us 404 · 2%
• bing.com 399 · 2%
• cloud.microsoft 397 · 2%
• everything else 13,808 · 66%

What the pages run

0 names have been opened in our isolated browser; 0 carried a phishing-kit marker. Over the names the capture worker opened, which it picks by risk.

What these numbers do not say

• We only see the lookalikes our permutation generator produces. A name built some other way is not in these numbers.
• The set is the public showcase: well-known brands. Attacks on small businesses look different, and these numbers do not describe them.
• Our record of a name starts when we first read it. The speed figures count only names registered after we began watching their brand.
• Kit and shared-infrastructure figures cover only the names the capture worker has opened, which it chooses by risk. They are not a sample of all lookalikes.

Snapshot Oct 10, 2026, dataset: public showcase. Look up any name in the open record.