How we measure Clone Watch
Clone Watch is a monthly, transparent measurement of newly-registered domains whose names resemble Australian brands. Every number we publish is reproducible from the sources below. Detections are suspected lookalikes submitted for review — not adjudicated findings.
Data sources
Newly-registered-domain (NRD) lists from whoisds.com (free public tier); WHOIS registration records; Certificate Transparency logs; and urlscan.io evidence for domains that resolve to a live page.
Scope
We match against a reference watch-list of roughly 50 Australian retail, bank, telco, superannuation, and logistics brand names, plus a small set of heavily-targeted global brands. The list is curated and evolves; it is not exhaustive.
How a domain is matched
A deterministic lexical sweep flags newly-registered domains whose string is characteristically similar to a watch-list brand — typo-squats (one-character changes), homoglyph/confusable characters, brand-name substrings, and alternate top-level domains. Candidates are then classified (including an AI pre-classifier and, where the domain resolves, urlscan evidence).
Definitions
- Lookalike / suspected clone — a domain whose name resembles a watch-list brand by the measurement above. Not a claim that the registrant is a scammer.
- Likely phishing — the domain resolves to a page that urlscan or our classifier assesses as consistent with credential harvesting.
- Parked / for sale — the domain resolves to a registrar parking or domain-sale page, not brand-impersonating content.
- Submitted for takedown review — referred to a community blocklist provider (e.g. Netcraft) for independent assessment. Referral is not a finding of abuse.
Limitations
- NRD feeds and blocklists count reported/registered domains, not confirmed abuse.
- Raw registrar counts partly reflect registrar size; we do not infer that a registrar condones abuse.
- We report month-over-month deltas and always state the measurement window.
- We do not publish live clone URLs in clickable form, per-victim data, or which brands are least defended.
Corrections & disputes
If your brand or business is named and you believe a domain is legitimate (for example your own defensive registration or a licensed reseller), email hello@askarthur.au. We will share the specific evidence privately, log the dispute, and correct or remove the entry promptly where warranted.
Back to the Clone Watch pillar and monthly editions.