Resources / Research
The Lookalike Report
Each day we look for new lookalike domains of 100 well-known brands. These are the names registered in the last 30 days.
- New in 30 days
- 636
- lookalike domains registered
- Worth watching
- 570
- 90%: live and unexplained, or malicious
- Risk 50 or more
- 217
- 34% of the new domains
- In the last 7 days
- 138
- this grows as we find more
New lookalikes each day
636 new lookalikes in total, 570 worth watching
Show the numbers as a table
| All | Worth watching | |
|---|---|---|
| Sep 15 | 64 | 63 |
| Sep 16 | 50 | 39 |
| Sep 17 | 22 | 19 |
| Sep 18 | 16 | 12 |
| Sep 19 | 17 | 15 |
| Sep 20 | 14 | 10 |
| Sep 21 | 26 | 23 |
| Sep 22 | 31 | 28 |
| Sep 23 | 23 | 21 |
| Sep 24 | 19 | 18 |
| Sep 25 | 13 | 13 |
| Sep 26 | 10 | 8 |
| Sep 27 | 10 | 8 |
| Sep 28 | 20 | 15 |
| Sep 29 | 22 | 20 |
| Sep 30 | 24 | 21 |
| Oct 1 | 20 | 18 |
| Oct 2 | 21 | 21 |
| Oct 3 | 11 | 11 |
| Oct 4 | 18 | 17 |
| Oct 5 | 12 | 12 |
| Oct 6 | 17 | 15 |
| Oct 7 | 18 | 16 |
| Oct 8 | 24 | 24 |
| Oct 9 | 23 | 21 |
| Oct 10 | 22 | 17 |
| Oct 11 | 13 | 13 |
| Oct 12 | 20 | 19 |
| Oct 13 | 23 | 20 |
| Oct 14 | 13 | 13 |
How dangerous they are
The new domains by their risk score today. A parked name scores low. A live page with mail scores high. How the risk score works →
636 domains in total, 570 worth watching
Show the numbers as a table
| All | Worth watching | |
|---|---|---|
| 0–9 | 1 | 0 |
| 10–19 | 86 | 47 |
| 20–29 | 42 | 36 |
| 30–39 | 53 | 35 |
| 40–49 | 237 | 235 |
| 50–59 | 126 | 126 |
| 60–69 | 57 | 57 |
| 70–79 | 29 | 29 |
| 80–89 | 3 | 3 |
| 90–100 | 2 | 2 |
What they are
We put each new domain in one class.
- Active, unexplained Live, and nothing explains it546 86%
- Malicious Known bad by a blocklist24 4%
- Parked A parking or for-sale page63 10%
- The brand’s own Held by the brand3 0%
Same TLD, or a new one?
Of the new domains worth watching, 66% change the brand’s TLD. For example, example.com becomes example.cn. The other 34% keep the TLD and change the name.
Switch the TLD 374 · 66% Keep it 196 · 34%
When they switch, the TLD they pick
- .cn 92 · 22%
- .cc 63 · 15%
- .shop 53 · 12%
- .top 53 · 12%
- .co 42 · 10%
- .com 32 · 8%
- .click 28 · 7%
- .vip 25 · 6%
- .info 24 · 6%
- .pro 14 · 3%
Who registers them
The registrar of each new domain that is active and unexplained. Next to it, for comparison: the registrars that brands use for their own lookalikes.
New, active and unexplained
- Dynadot 55 · 10%
- Namecheap 52 · 10%
- NameSilo 35 · 6%
- GoDaddy 32 · 6%
- Spaceship 31 · 6%
- Cloudflare 26 · 5%
- Gname 24 · 4%
- Alibaba Cloud (HiChina) 16 · 3%
- Chengdu West Dimension Digital Technology 15 · 3%
- HOSTINGER operations, UAB 13 · 2%
- Everything else 247 · 45%
The brands’ own, all years
- MarkMonitor 2,156 · 68%
- Com Laude 316 · 10%
- CSC Corporate Domains 237 · 7%
- RegistrarSEC 161 · 5%
- Unknown 75 · 2%
- Ascio 60 · 2%
- SafeNames 32 · 1%
- GoDaddy 19 · 1%
- Alibaba Cloud (HiChina) 17 · 1%
- GoDaddy Corporate Domains 16 · 1%
- Everything else 76 · 2%
Where they take mail, and where they live
For the new domains that are active and unexplained. With mail, an attacker can get your customer’s reply.
Mail provider
- No mail server 430 · 79%
- Self-hosted or other 81 · 15%
- Cloudflare Email Routing 14 · 3%
- Google Workspace 12 · 2%
- Zoho Mail 2 · 0%
- IONOS 1 · 0%
- ImprovMX (forwarding) 1 · 0%
- Microsoft 365 1 · 0%
- Everything else 4 · 1%
Hosting network
- No address 142 · 25%
- CLOUDFLARENET - Cloudflare, Inc., US 131 · 23%
- AMAZON-02 - Amazon.com, Inc., US 50 · 9%
- HETZNER-AS - Hetzner Online GmbH, DE 16 · 3%
- GOOGLE-CLOUD-PLATFORM - Google LLC, US 14 · 2%
- NAMECHEAP-NET - Namecheap, Inc., US 14 · 2%
- YANCYLIMITED-AS-HK - Yancy Limited, HK 14 · 2%
- AS-HOSTINGER - Hostinger International Limited, CY 13 · 2%
- GRANSY - Gransy s.r.o., CZ 10 · 2%
- SH2206-AP - UNIT A17,9/F SILVERCORP INT_L TOWER 707-713 NATHAN RD, HK 9 · 2%
- Everything else 152 · 27%
How fast they go live
- Registered to live
- 8 hours
- The median of 294 domains. Half take 4 hours to 12 hours.
- Live to taking mail
- under 1 hour
- The median of 72 domains. Most add mail on the day they go live.
We read each name every few hours. A time shorter than that is our scan, not the attacker.
Who is targeted most
The new domains that are not the brand’s own, not parked and not dormant, by the brand they copy. Select a brand to see its lookalikes.
- google.com 24 · 4%
- apple.com 18 · 3%
- tiktok.com 18 · 3%
- mail.ru 17 · 3%
- whatsapp.net 17 · 3%
- yandex.net 17 · 3%
- baidu.com 16 · 3%
- whatsapp.com 15 · 3%
- aws.dev 14 · 2%
- goo.gl 13 · 2%
- live.com 13 · 2%
- facebook.com 12 · 2%
- yandex.ru 12 · 2%
- openai.com 11 · 2%
- amazon.com 10 · 2%
- Everything else 343 · 60%
What the pages run
Over all the names our browser opened, not only the new ones. Of 613 pages, 97 had a sign of a phishing kit.
- Hides from automated browsers 66 · 63%
- Long base64 blob 20 · 19%
- Looks up the visitor’s IP 8 · 8%
- Blocks right-click 3 · 3%
- Anti-bot kit 3 · 3%
- document.write(unescape(...)) 2 · 2%
- Sends data to a Discord webhook 1 · 1%
- eval(atob(...)) 1 · 1%
Still registered?
Of 300 names we checked against the registry, 99% are still held.
What these numbers do not say
- We see only the names that our generator makes.
- We watch big brands. Attacks on small businesses look different.
- Our speed figures start when we first read a name.
- Our browser opens the riskiest names first. Its numbers are not a random sample.
Counted October 15, 2026, from the public showcase.