We scanned 2,000 leading Shopify stores.
Nine in ten had a lookalike domain registered by someone else.
90.3% of the 2,000 largest Shopify stores have at least one lookalike domain registered against them , while 51.1% own none of their own. 31 already have one sitting on a public spam or phishing blocklist. Only 17.8% enforce DMARC. The full picture, by category and by name.
Seven sections, every number sourced from a row in our database.
Methodology
Cohort, scan vectors, exclusions, and what the report deliberately does not claim. 2,000 stores, first-party scans, no survey data.
The Brand Exposure Index
The 7-component score with every weight published, so your security team can reproduce any figure in the report.
The impersonation funnel
Registered, redirecting, threat-listed, spoofable, and enforced. Where the cohort falls out at each stage.
By category
All 18 parent categories ranked by average exposure, plus the component breakdown driving each one.
How lookalikes are made
Typo classes, commerce-suffix TLDs, and character-swap domains that can be mistaken for the real thing.
Most-impersonated brands
Top 20 by lookalike inventory, with the count actively redirecting and the resulting BEI.
The baseline
What this locked snapshot unlocks next edition: year-over-year BEI movement by category, and rising-target detection.
Exposed callouts
22 named stores in the critical tier, based on observed abuse rather than weak posture alone, with the drivers behind each.
Operators, agencies, and security leads.
Get this picture for your store, not the industry.
Recon scans your store on the same five vectors used in the report. Free.
Add Recon to Shopify →