How we measure Clone Watch

Newly-registered-domain (NRD) lists from whoisds.com (free public tier); WHOIS registration records; Certificate Transparency logs; and urlscan.io evidence for domains that resolve to a live page.

We match against a curated watch-list of roughly 290 brands — Australian retail, bank, telco, superannuation, government and logistics names plus heavily-targeted global brands. The list evolves (each brand's coverage start is recorded, so month-on-month comparisons only count brands covered for the whole period); it is not exhaustive.

Coverage: newly registered generic-TLD domains (.com, .shop, .xyz and similar). .au registrations are not yet included, so counts for brands on .au domains are a lower bound.

A deterministic lexical sweep flags newly-registered domains whose string is characteristically similar to a watch-list brand — typo-squats (one-character changes), homoglyph/confusable characters, brand-name substrings, and alternate top-level domains. Candidates are then classified (including an AI pre-classifier and, where the domain resolves, urlscan evidence).

For short (five-letter) brand names, a one-character change usually spells an ordinary word — bonus for Bonds, mart for Kmart — so we never count a near-miss that is a dictionary word, and count other one-character changes only when they swap in a look-alike character (l→i, o→0) or the brand's near-misses have already been used in confirmed phishing.

When one name is registered across four or more web endings in the same month, every domain is still tracked, but the brand's ranking and month-on-month change count that bulk registration once.

• Lookalike / suspected clone — a domain whose name resembles a watch-list brand by the measurement above. Not a claim that the registrant is a scammer.
• Likely phishing — the domain resolves to a page that urlscan or our classifier assesses as consistent with credential harvesting.
• Parked / for sale — the domain resolves to a registrar parking or domain-sale page, not brand-impersonating content.
• Submitted for takedown review — referred to a community blocklist provider (e.g. Netcraft) for independent assessment. Referral is not a finding of abuse.

• NRD feeds and blocklists count reported/registered domains, not confirmed abuse.
• Raw registrar counts partly reflect registrar size; we do not infer that a registrar condones abuse.
• We report month-over-month deltas and always state the measurement window.
• We do not publish live clone URLs in clickable form, per-victim data, or which brands are least defended.

If your brand or business is named and you believe a domain is legitimate (for example your own defensive registration or a licensed reseller), email hello@askarthur.au. We will share the specific evidence privately, log the dispute, and correct or remove the entry promptly where warranted.