A name generator behind 294 Aldi and Lidl look-alike .shop names: technical analysis

Key findings

1. Between 17:15 UTC on 12 November and 02:10 UTC on 13 November 2026, NSS's certificate records logged 294 names of one shape: an Aldi or Lidl label, then an invented shop name on .shop, such as lidldeals[.]kelmsfordgrocer[.]shop. Search DNS, web gateway and certificate logs for names matching ^(aldi|lidl)[a-z-]*\.[a-z0-9-]+\.shop$ and treat a hit as a look-alike of the brand.
2. The shop names are generated. 255 of the 294 end in one of five shop words: grocer, market, mart, pantry or basket. 41 invented words, such as fenbrook, glenwillow and kelmsford, appear with all five, which makes 205 names. A second set of five words (aisle, corner, shelf, store, depot) appears on 31 names.
3. The brand label changed. Before 12 November, public lists that NSS reads carried 2,043 names of this shape, and 4 of them had a Lidl label. Of the 294 names logged in nine hours from 17:15 UTC on 12 November 2026, 222 have one: lidldeals, lidlmart or lidl.
4. The names were bought months before use. All 30 registrations in NSS's sample are at one registrar and date from 6 April to 9 July 2026, 125 to 220 days before the names' certificates. Eight were bought within 77 seconds on 22 May and eight within 10 seconds on 26 May. In the names NSS read, names bought together carry the same brand label: every 22 May name carries lidldeals and every 26 May name lidlmart.
5. Every name has a certificate of its own. Each of the 294 first appeared in NSS's certificate records under its brand name, never as the bare registered name, a www name or a wildcard. That is why the brand label shows in public certificate logs, and why watching those logs for the two brand words finds this set.
6. Two names served shop pages when NSS loaded them on 13 November. lidl[.]orvystore[.]shop showed the Lidl logo, a photo of a Lidl store, kitchen appliances in US dollars and a cart. aldi[.]vineyardmart[.]shop showed the Aldi logo and slogan, power tools and garden machines in US dollars at a fraction of their usual price, an account sign-up and a cart. Asked as a search crawler, the same name sent the visit on to google[.]com, so a crawler-based check sees Google, not the shop. Three names from the 41-word grid did not serve a page: the delivery network refused the secure connection or showed its own error page.
7. On 13 November 2026, 284 of the 294 hosts were on no list NSS holds (checked at 15:27 UTC and again at 19:26 UTC); 10 were listed. The pattern itself is not new: public lists have carried 2,062 registered names of this shape since 25 July 2026. NSS adds the 294 from its own records, the way the names are built, the purchase runs, the two pages and a search pattern.

How an analyst finds this with NSS

The same trail, in the order a defender would follow it, on NSS's own screens on 13 November 2026.

1. 01Step 1. Start from one name. Typed into Investigate, lidl[.]orvystore[.]shop reads Suspicious 55/100: the name carries Lidl's name without being one of Lidl's domains, and its page is a shop selling under Lidl's identity.

   

2. 02Step 2. Open the page capture in the same casefile: a store dressed as Lidl, prices in US dollars, no password field, and the same page for a desktop, a phone and a crawler.

   

3. 03Step 3. Follow a second store of the same shape. The capture of aldi[.]vineyardmart[.]shop lists the hosts its page loaded and marks one as known bad, aldi[.]nelvostore[.]shop; one click opens that name's casefile, High risk.

   

4. 04Step 4. Chain two live checks on that name: its registration record, then its certificate. The certificate names that one host only and was issued on 10 November 2026.

   

5. 05Step 5. Widen to the family. From one generator name, lidldeals[.]kelmsfordgrocer[.]shop, the family finder groups 762 registered names of the same shape and shows when they were bought: 75 names in 99 seconds on 22 May 2026 and 84 in 138 seconds on 26 May.

   

6. 06Step 6. Act on the whole family: export its names as CSV or JSON for blocking, and put the names that matter on watch from their casefiles. The family finder, the export and watch are NSS Full features.

   

Automate it with the NSS API

Every NSS check is also a JSON answer, so this paper's list can be re-checked by a script. The public check takes one name or address and returns its band, its host type, its public listing state and the time of the reading; it allows 3 lookups a day from one address.

A Full account adds API keys, each with its own daily allowance, sent only as an Authorization: Bearer header and never in the address; the keyed address is in the Station's Docs. Over a limit the API answers 429 with Retry-After.

NAME=$(curl -s https://nsshq.com/research/files/nss-gr-01.json \
  | python3 -c 'import json, sys; print(json.load(sys.stdin)["indicators"][0]["value"])')
curl -s "https://nsshq.com/api/v1/check?value=$NAME"

{
  "value": "lidl.orvystore[.]shop",
  "type": "domain",
  "found": true,
  "view": "public",
  "band": "Suspicious",
  "band_is_host_class": false,
  "known_good": false,
  "host_class": {
    "class": "platform",
    "label": "Shared platform",
    "sentence": "Shared platform (...). Tenants differ per name, so what other names on it do says nothing about this one; judge the specific name, and do not block the address, which would block unrelated sites.",
    "as_of": "2026-11-13T17:36:47Z"
  },
  "names": null,
  "reports": 0,
  "public_listing": { ... },
  "as_of": "2026-11-13T18:00:26Z"
}

#!/usr/bin/env python3
"""Check every name in an NSS Research indicator file and report the names whose NSS band changed since the last run.
Run it from cron or a SIEM job. Standard library only.
  NSS_LIST     the paper's indicator file, a URL or a local path (JSON or CSV)
  NSS_API_URL  the check address (default: the public check, 3 lookups a day per address)
  NSS_API_KEY  a Full account's API key, sent as "Authorization: Bearer"; use it with the keyed address in your Station's Docs
  NSS_STATE    where the last bands are kept between runs (default nss_watch_state.json)
Exit code 0: nothing changed; 1: at least one band changed; 2: stopped by a limit or an error."""
import csv, io, json, os, sys, time, urllib.error, urllib.parse, urllib.request

LIST = os.environ.get("NSS_LIST", "https://nsshq.com/research/files/nss-gr-01.json")
API = os.environ.get("NSS_API_URL", "https://nsshq.com/api/v1/check")
KEY = os.environ.get("NSS_API_KEY", "")
STATE = os.environ.get("NSS_STATE", "nss_watch_state.json")
GAP_S = float(os.environ.get("NSS_GAP_S", "11"))          # the public check allows 6 a minute per address


def fetch(url, headers=None):
    req = urllib.request.Request(url, headers={"User-Agent": "nss-watch-list/1", **(headers or {})})
    with urllib.request.urlopen(req, timeout=90) as r:
        return r.read().decode("utf-8"), r.headers


def names():
    text = fetch(LIST)[0] if LIST.startswith("https://") else open(LIST, encoding="utf-8").read()
    rows = json.loads(text)["indicators"] if text.lstrip().startswith("{") else list(csv.DictReader(io.StringIO(text)))
    return [r.get("value") or r.get("indicator") for r in rows if r.get("type") == "domain"]


def check(value):
    auth = {"Authorization": "Bearer " + KEY} if KEY else {}
    for _ in range(3):
        try:
            body, headers = fetch(API + "?" + urllib.parse.urlencode({"value": value}), auth)
            a = json.loads(body)
            return a.get("band") or a.get("verdict"), headers.get("NSS-Quota-Remaining")
        except urllib.error.HTTPError as e:
            if e.code != 429:
                raise
            if b'"cap"' in e.read():                         # the day's allowance, not a per-minute limit
                raise SystemExit("daily allowance used up; run again after 00:00 UTC")
            time.sleep(int(e.headers.get("Retry-After") or 60))
    raise SystemExit("still rate limited after three tries")


def main():
    old = json.load(open(STATE)) if os.path.exists(STATE) else {}
    new, changed = dict(old), []
    try:
        for value in names():
            band, left = check(value)
            if old.get(value) not in (None, band):
                changed.append({"value": value, "was": old[value], "now": band})
            new[value] = band
            if left == "0":
                break
            time.sleep(GAP_S)
    except SystemExit as stop:
        print(stop, file=sys.stderr)
        json.dump(new, open(STATE, "w"), indent=1)
        sys.exit(2)
    json.dump(new, open(STATE, "w"), indent=1)
    for c in changed:
        print(json.dumps(c))                                 # one JSON line per change: easy to ship to a SIEM
    sys.exit(1 if changed else 0)


if __name__ == "__main__":
    main()

BASE=https://raw.githubusercontent.com/nsshq/nssresearch/main/NSS-GR-01-aldi-lidl-lookalike-shop-names
curl -sO "$BASE/stix2.1-bundle.json"     # STIX 2.1 bundle: one report, its indicators, TLP:CLEAR

Timeline

1. 6 Apr 2026
   The earliest registration among the names NSS read (aldius[.]yelqon[.]shop).
2. 22 Apr, 02:22 UTC
   Four names are bought within 39 seconds, three of them ending in mart; all four carry the aldi label in November.
3. 22 May, 19:15 to 19:16 UTC
   Eight names are bought within 77 seconds. All eight carry the lidldeals label in November.
4. 26 May, 21:19 to 21:20 UTC
   Eight names are bought within 10 seconds. All eight carry the lidlmart label in November.
5. 8 Jun to 9 Jul
   Further names are bought: invented store names on 8 Jun (lidl label), place names on 4 Jul (aldideals and aldimart) and 9 Jul (aldishop).
6. 25 Jul
   The first name of this shape reaches NSS from public lists. By 11 Nov the lists carry 2,043 names of the shape, 4 with a Lidl label.
7. 12 Nov, 17:15 UTC to 13 Nov, 02:10 UTC
   294 brand names appear in NSS's certificate records, one per registered name; 222 carry a Lidl label.
8. 13 Nov, 15:27 UTC
   NSS checks every name against the lists it holds: 284 of 294 are on none.
9. 13 Nov, 15:32 to 15:40 UTC
   NSS loads five of the names. Two serve shop pages with the Lidl or Aldi logo; three serve no page.

The NSS tools used

• > Investigate

  Read the public registration record, the current address and the host type of 30 of the names on 13 November and built a casefile for each.

• > Capture

  Loaded five of the names on 13 November through NSS's capture service: two shop pages with the Lidl or Aldi logo, three with no page. No form was submitted and nothing was downloaded.

Indicators

The first 25 of 261 indicators. Each is written defanged so it cannot be opened by accident. TLP:CLEAR. Use them in your own tools; no account needed.

How we know

What this rests on

• The 294 names, their labels and the time each was first logged are from NSS's own certificate records, read in one stamped run on 13 November 2026 at 15:27 UTC.
• The listing state of every name is from the lists NSS takes in, checked in the same run. The count of earlier names of the same shape is from the same lists.
• The family-wide count (962 registered names: 699 listed, and 263 held by NSS and on no list) is from one search of every record NSS holds, with listings read on 13 November 2026 at about 15:30 UTC.
• Registration dates and the registrar are the public registration records of a sample of 30 of the names and 11 more, read on 13 November 2026.
• What the pages showed is from NSS's own page loads of five names on 13 November 2026 between 15:32 and 15:40 UTC.

What we cannot say

• The pattern is on public lists since July 2026. NSS did not discover it; this paper describes the 294 names of 12 November and how they were made.
• NSS loaded five names and saw two shop pages: aldi[.]vineyardmart[.]shop (shop word mart, not one of the 41 grid words) and lidl[.]orvystore[.]shop (second set). The three grid names it loaded served no page.
• NSS saw no checkout, no payment and no victim.
• NSS read 41 of 294 registration records. The dates and purchase runs describe the names read, not every name.
• The naming pattern ties the names. It may be one operator, or one tool used by more than one; NSS cannot tell which.
• The indicator list carries the 261 names that NSS rated Suspicious or higher on both Investigate and Scan on 13 November 2026: 260 of the 294 and the image host aldi[.]nelvostore[.]shop. The 34 that read Low risk, most of them on the second set of shop words, are left out.
• Addresses are not in the indicator list. They belong to a content-delivery network that serves many unrelated sites.
• The listing counts are as of 13 November 2026. An update with the 7-day listing result will follow on 20 November 2026.
• This paper is not attributed to any named group.

Use and citation

This paper is marked TLP:CLEAR: it may be shared without restriction. Cite as:

Nexus Sentinel Station (NSS), "A name generator behind 294 Aldi and Lidl look-alike .shop names: technical analysis", NSS-GR-01, 13 Nov 2026. https://nsshq.com/research/aldi-lidl-lookalike-shop-names