Lookalike domain research, October 2026

We ran our scanner on 47 well-known brands (payments, crypto, software, retail and fashion, for example PayPal, Netflix, Shopify and GitHub) on October 19 and 20, 2026, and kept every result. These are the counts. Nothing here is a survey or an estimate: each number is counted from the stored scan data.

Every brand had lookalikes

• 16,679 registered lookalike domains in total, a median of 292 per brand (fewest 43, most 744).
• 5,298 were misspellings and variants of the brand's own domain that someone had registered. The most common kinds were:
  • the brand plus a word (login, pay, shop...): 1,193
  • an extra letter: 1,141
  • one letter swapped for another: 1,066
  • a one-bit memory error (bitsquatting): 634
  • the same name on another extension: 428
• 11,381 were domains containing the brand name that received a new HTTPS certificate in the 24 hours before the scan (seen in public Certificate Transparency logs). Most of these are harmless, but it shows how fast new names appear.

About a third can receive email

36% of all lookalikes had a real mail server (MX record), and another 7% pointed at a registrar's parking or forwarding mail host. A lookalike with a working mail server is the one that can send fake invoices or "new bank details" emails. Why MX matters.

Most lookalikes are old, parked or harmless

• Where the registry gave a creation date (11,008 domains), 42% were more than five years old and 6% were under 30 days old.
• We opened the most suspicious ones in each scan (8,997 sites): 47% showed a live page, 36% were parked, for sale or empty, 15% didn't respond, and 2% forwarded to the brand's real site.
• Many live pages belonged to unrelated businesses that simply share a word with the brand. That is why a long list of lookalikes is not a list of attacks, and why every result shows the reasons behind its score.

What the real fakes had in common

We reviewed the results our scanner flagged as medium or high risk and found 48 sites presenting themselves as the brand, across 20 of the 47 brands: a "restore wallet" page asking for a 12-word recovery phrase, a copied payments dashboard on a domain with an accented letter, a website-builder clone, fake shops using a retailer's name (one even listed the retailer's real head-office address), and booking and meeting-invite lures.

• Most were not typos. 43 of 48 used the brand name spelled correctly, plus extra words (patterns like brand-verify or brandofficial). Only 5 relied on a misspelling or look-alike characters. A misspelling check alone would have missed those 43.
• They were new. Of the 38 with a known creation date, 92% were registered within the past year and 37% within the past 30 days.
• Most showed up in certificate logs. 30 of 48 were found through a new HTTPS certificate, not through a list of misspellings.
• Few showed an obvious login form (8%) and few had their own mail server (12%), so "has a login form" or "has MX" on its own is not a reliable test.

The practical lesson: watch for new domains that contain your brand name, not only misspellings, and check them again later, because a domain that is empty today can go live later.

Free, no account needed. A scan takes 15 to 60 seconds. You get a shareable result link.

How we counted

• One scan per brand with the same scanner customers use (scoring version 0.5.1). The brand's own sites were excluded. Counts are per brand and lookalike pair.
• "Opened" sites are the highest-scoring ones in each scan, so the page results describe the more suspicious part of the list, not every lookalike.
• Fakes were found by reading the flagged pages. Pages with no readable content couldn't be classed, so the real number of fakes is probably higher. We don't name the domains here: an automated score is not an accusation.
• The brands are large, well-known companies, so a smaller business may see fewer lookalikes. Run a free scan above to see yours.

Related guides: combosquatting, why new registrations matter, parked vs live lookalikes.

What it does not do

LookalikeGuard is monitoring and early warning. It does not take down domains, send legal notices, or give legal advice. Scores are automated and can be wrong in both directions: a high score is a reason to look, not proof of abuse. Many lookalike domains are parked, owned by unrelated businesses, or registered defensively by the brand itself; you can mark those as yours or dismiss them.