# Lookalike Domain Monitoring: Why One-Time Checks Fail

A one-time lookalike scan tells you which suspicious domains existed on the day you ran it, and which ones *looked* harmless when you visited. Two pieces of research published in the past week show why both answers go stale fast. Attackers register in waves, rotate domains, and in one case serve a fake "account suspended" page to anyone who checks twice.

## Case 1: 820 restaurant clones that proxy the real site

On November 5, 2026, [InfoHawk published "Scamwich"](https://www.infohawk.com/news/2026-11-05-scamwich-restaurant-skimming), research on fake restaurant ordering sites. (I found it through a [summary on X](https://x.com/RoundtableSpace/status/2118972973985964346) and checked the figures below against InfoHawk's report.)

What the report states:

- Across two research passes, InfoHawk identified **820 domains impersonating 35 restaurant brands**. **808 use `.delivery`**, and the rest use `.com` or `.shop`.
- Jimmy John's was the most cloned brand, with **404 domains**, which InfoHawk says it saw between March 3 and October 21, 2026.
- The sites **reverse-proxy the legitimate restaurant site**, so menus, prices and cart behavior are real, and replace only the checkout payment form. Some ask for the bank's SMS verification code as well.
- Cloudflare gives the domains a valid certificate automatically (Google Trust Services in the example InfoHawk traced), so the browser shows "Connection is secure."
- InfoHawk found **at least 47 Google Search ads** between July 7 and October 20, 2026, under at least 46 advertiser accounts. Most ran for one to four days. On **November 4, 367 of the 820 domains still served a site**.
- In the first sweep, 251 of 255 domains were registered at one registrar.

InfoHawk is a company that sells this kind of monitoring, and some of its account (for example, how the live operator works) is its own inference.

**Why a one-time scan misses this:** the domains are typos of the brand on a TLD the brand may never have thought about. The ads ran for days, not months. And because the page content comes live from the real site, a "does this look like our site?" check passes by design.

One useful detail: certificates leave a trail. When I searched crt.sh on November 9, two of the domains InfoHawk lists, `jimmijones[.]delivery` and `hotchlckandaves[.]delivery`, had 11 and 6 CT log entries, with certificates from Google Trust Services, Let's Encrypt, Sectigo and a Cloudflare-branded CA. Certificate Transparency is one of the few places these domains show up whether or not anyone has scanned them.

## Case 2: A bank phishing kit that fakes its own takedown

On November 3, 2026, [KELA published research](https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/) on a campaign it calls the "Suspended" infrastructure. According to KELA:

- As of October 25, 2026, the campaign had **248 live domains impersonating 189 US financial institutions**. KELA has identified more than 300 domains in the same infrastructure since May 2026. Most targets are mid-sized regional banks, and many cloned pages are business banking and treasury logins.
- Most domains follow one formula, **`[keyword]-[bank].com`**, with keywords such as *secure, disable, protect* and *cancel*. A growing set uses help-desk, live-support, treasury-portal and "primary device" names.
- **The kit remembers every visitor's IP address.** The first visit gets the login page. Any later visit from the same IP gets a fake "This account has been suspended" page that looks like a hosting provider's notice. Some domains now use other decoys too: a "you have been blocked" notice, a blank page or a redirect to Google.
- Some flagged domains have **no public scan record at all**.
- In the week to October 25, 49 new domains went live and 15 were taken down.

KELA spells out what this does to defenders: a scanner or takedown team checks a site, checks again to confirm, and the second check shows what looks like a completed takedown. A provider "can mark a look-alike domain as down while it is still serving the phishing page to new visitors."

## Why one-time checks fail

Taken together, these cases break the usual "scan once, review, close" workflow in four ways:

1. **New domains keep appearing.** Both campaigns registered in waves and kept adding domains during the research period.
2. **Brand-plus-keyword names aren't typos.** `secure-[bank].com` is nowhere near your domain in edit distance, so typo permutations alone won't catch it.
3. **One look can be wrong.** A cloaked site can show a decoy to repeat visitors, and a proxied clone shows your own content.
4. **"Down" isn't a final state.** A takedown can be marked resolved based on a decoy, and the infrastructure behind it keeps serving other domains.

## What continuous lookalike monitoring should cover

### Discovery
- **CT log watch** for new certificates containing your brand strings, permutations and keywords. That covers proxied clones too, since they need a certificate to show the padlock.
- **Newly registered domain feeds**, matched against brand names, common typos and brand-plus-keyword patterns (KELA's list is a good starting point for financial brands: *secure, disable, protect, cancel, authorize, terminate, credentials*, plus help-desk and support terms).
- **TLD coverage beyond .com.** In InfoHawk's data, 808 of the 820 domains were on `.delivery`. Include the TLDs that match your industry's vocabulary.
- **Homoglyph and IDN variants**, including punycode forms.

### Verification
- **Re-check over days, from different vantage points.** KELA recommends checking from a new address each time, preferably not an anonymization network, and re-checking over several days.
- **Don't treat "suspended," blank, blocked or redirect responses as proof the site is gone.**
- **Look for your own site being proxied.** InfoHawk notes that the brand's servers see every page the clone serves, so watching for your site loading under someone else's domain is a detection opportunity. Check your logs and CDN analytics for unexpected Host or Referer values.

### Response
- **Keep a record per domain**: registrar, nameservers, certificate issuer, hosting, first and last seen.
- **Report to the registrar, the CDN and the host, then verify from a fresh IP.** That is KELA's takedown advice.
- **Keep watching after takedown.** Shared hosting and registrar patterns let you spot the next wave.
- **Tell customers what to expect.** KELA suggests warning business banking customers that requests to cancel or authorize a transfer via a link should be confirmed through the bank's known phone number or app.

A one-off check is a start: the [lookalike domain checker](/tools/lookalike-domain-checker) runs in the browser. [dnstwist alternatives](/guides/dnstwist-alternatives) compares tools that find lookalikes, and [How to report a lookalike domain](/guides/report-lookalike-domain-takedown) covers evidence, registrar abuse contacts and UDRP.

## FAQ

**What is lookalike domain monitoring?**
Continuously looking for newly registered domains and newly issued certificates that imitate your brand (typos, homoglyphs, other TLDs, brand-plus-keyword names), then verifying and tracking them over time.

**Why does a phishing site look offline when I check it?**
Some kits cloak. KELA documented one that serves a fake "account suspended" page to any IP that has visited before. Check from a fresh IP and recheck over several days before closing it.

**Can Certificate Transparency logs detect phishing domains?**
They can surface many of them early. A lookalike that wants the browser padlock needs a publicly trusted certificate, and those are typically logged to CT and searchable in tools such as crt.sh (both InfoHawk-listed domains I checked were there). CT won't show page content or cloaking, so it's one input to monitoring, not the whole job.

## A note on Nameward

I'm building Nameward, a certificate and domain monitoring tool for MSPs and ops/security teams. One planned piece is a continuous lookalike watch: CT and new-registration matching for client brands, repeated verification over time, and runbooks attached to each alert. You can sign up at [nameward.app](https://nameward.app). If you want to join the beta or share how you handle this today, get in touch.

## Sources (accessed November 9, 2026)

- InfoHawk, "Scamwich: Inside a Restaurant Delivery Payment-Skimming Campaign" (Nov 5, 2026): https://www.infohawk.com/news/2026-11-05-scamwich-restaurant-skimming
- 0xMarioNawfal (@RoundtableSpace) on X (Nov 7, 2026): https://x.com/RoundtableSpace/status/2118972973985964346
- KELA, "Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown" (updated Nov 3, 2026): https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/
- crt.sh searches (author's lookups, Nov 9, 2026): https://crt.sh/?q=jimmijones.delivery and https://crt.sh/?q=hotchlckandaves.delivery

---
Source: https://nameward.app/guides/lookalike-domain-monitoring (updated 2026-11-14)