Lookalike domains: how they are built and how NSS ties them together

What a lookalike name looks like

In NSS-WA-01, 51 names shared one pattern: three letters, a hyphen, then "vvhatsapp", with two letters v standing in for the w. They sat under four low-cost endings: .cyou (16), .top (16), .icu (10) and .shop (9).

A swapped letter, a short prefix and a cheap ending is a common build. A lookalike only has to pass a quick glance in a message or a browser tab.

Not every name in a bulk set copies a brand. The 1,770 names in NSS-OC-01 are shop-style names under .shop: some themed, 295 of them about gardens or bicycles, and many coined with no meaning. They came to NSS from public warning lists. The same method ties both sets together.

Why a name pattern is not proof

Anyone can register a name that looks like another. A name pattern tells you where to look. It does not tell you which names belong together.

In WA-01, NSS joined a name to the kit only when it shared a public record with a name already in it. A lookalike name that shared no record stayed out. Five kinds of link were used:

• Same registrar, same registration minute: names bought together in one order.
• Same address, registered within a day: names set up together on one host.
• Same address, same registrar: names bought and hosted the same way.
• Same address, first delegated within 12 hours: names switched on together.
• Same relay: names placed behind the same forwarding service, on the same label.

The registration batch

The strongest link is the registration batch. A registration record carries the second a name was registered and the registrar that sold it. People buying one name at a time do not land in the same second. An order of many names does.

In WA-01 all 51 names fall in three single minutes: 15 names at 13:34 UTC on 27 October, 17 at 15:10 on 28 October and 19 at 02:14 on 30 October 2026.

OC-01 applies the same test at scale. A batch there is five or more names through one registrar, each within 30 seconds of the one before. 1,770 names fall into 98 batches between 18 April and 2 November 2026. The median batch holds 15 names and takes 46 seconds. The largest holds 54 names registered in 2 minutes and 7 seconds.

The result does not hang on the 30 seconds. With a limit of 10 seconds, 1,349 names still fall in batches.

A batch also links hosts. 53 of the 98 batches put their names on hosts in two different address blocks. OC-01 joined two hosts only when two or more batches spanned them. That gave three groups on nine hosts in six address blocks.

What did not count as a link

Some records look like links and are not. The papers set these aside:

• Default name servers. Most names use the pair their registrar gives every customer. A shared default is not a link.
• The hosting company. A hosting network has many unrelated customers, so sharing one says little.
• A relay service. In WA-01, 41 names forwarded through one relay, each under its own label. The relay has other customers, so its domain is not an indicator on its own. The single label that 33 of those labels pointed on to is useful: any other name that forwards to it is worth a look.

What the pages showed

A name shows intent. The page shows what it does. NSS read a copy of the WhatsApp sign-in page, with a code to scan, on 11 of the 51 WA-01 names. On the real WhatsApp Web, scanning that code links the phone's account to the browser showing it. A copy on a lookalike name is the shape of account-takeover phishing.

On 20 names the site blocked a phone visitor and served a desktop visitor. Seven showed a search engine's home page in place of their own. NSS records a blocked or swapped page on a brand copy as a finding. It does not treat an unread page as a clean one.

In OC-01, NSS captured 44 sample names as a phone and as a desktop. About half did not connect, and NSS read no shop page and no payment page. The paper says so, and leaves the judgement that the names are harmful to the warning lists.

How long the names last

The two sets behaved differently. The WA-01 kit was short-lived: at least 19 names were put on registry hold, and on 10 November 2026, 34 of the 51 no longer resolved. Its list is of most use for looking back through logs.

The OC-01 names stayed up. On 10 November 2026, 1,749 of the 1,770 still resolved and none carried a registry hold, although they had been on public warning lists for weeks. Its list serves blocking as well as looking back.

What a defender can look for

• New registrations that put a short prefix and a hyphen in front of a misspelt brand name, several in the same minute, under low-cost endings.
• Runs of new names from one registrar inside the same minute, pointing at the same few hosts.
• A site that blocks a phone visitor and serves a desktop visitor, or shows a search engine's home page under a brand lookalike name.
• The papers' indicator lists, in CSV and JSON. Both leave addresses out, because the hosts serve unrelated sites. Treat an address as a reason to look, not as a block rule.

For how NSS decides what counts as evidence, see how NSS confirms infrastructure.