The 2026 Shopify
Brand Protection
Report.
Most stores in this cohort have at least one third-party lookalike registration. The two controls measured here are defensive registration and DMARC enforcement. Only 10.8% of the top 2000 Shopify stores have both. These are first-party public-internet scans, not survey responses.
The pages that follow distinguish registered lookalikes from observed redirects and threat-listed domains, then show the email and domain controls we measured.
Brand impersonation used to be a phishing problem. Now it's a discoverability problem.
For most of the last decade, the lookalike domain registered last week mattered to security teams and almost nobody else. A merchant might hear about a cloned store from a customer service ticket, send a takedown, and move on.
That changed in the last 18 months. Cloned storefronts now compete in paid search against the brands they impersonate. Spoofed transactional emails train customers to expect "your order has shipped" from anywhere. The practical impact can include diverted demand, support work, chargebacks, and lost confidence in a brand’s official channels.
The 2026 dataset makes the shape of that risk concrete. Brand impersonation
is a sequence of observable states. It begins with 90.3% of the
top-2000 stores having at least one third-party lookalike already registered.
It narrows at the next stage to 89.6% whose lookalikes are actively redirecting to a non-brand destination:
ad farms, marketplace parking, fake storefronts. Those are not parked squats;
they are pointing customers somewhere.
It narrows further to the small share whose lookalikes have crossed
into documented abuse: 31 of the top-2000
have at least one domain currently listed by Google Safe Browsing, SURBL, or URLhaus.
Those lists are incomplete and can lag the observed behavior.
The bottom of the funnel is the one stage merchants control entirely:
only 17.8% enforce DMARC at p=reject.
This report walks that funnel page by page. Every number maps to a row in our database. We do not use survey responses or modeled incident counts.
How this report was built.
Ranked monthly by Recon's traffic-and-rank index. The most recent month of 2026 sets the universe; stores must appear in the top 2000 to be in the report.
DNS lookalikes, weaponization status, DMARC policy, SPF/DKIM presence, and TLS/HSTS. Each store contributes one scan per week to the underlying time series.
All year-over-year comparisons use the same store cohort at the same point in the prior year. No backfills, no model imputations.
What's not in this report
- · Stores below the top-200 cutoff. Smaller brands are scanned by Recon but excluded here so the cohort is consistent year-over-year.
- · Survey or self-reported data. Every number derives from a scan Recon ran against the public internet.
- · Predicted incidents. We report what we observe, not what we forecast.
The Brand Exposure Index.
One score on a 0–100 scale. Higher means more exposed. Calculated from 7 vectors the merchant either owns or can fix this quarter. Stable across categories, comparable across years.
BEI is not a breach score. It measures how much visible infrastructure exists for impersonating a brand, plus how many of the merchant-controlled defenses against impersonation are missing. A high BEI is not proof a store has been attacked. It measures the visible conditions that could support an impersonation attempt.
Components
| No defensive registration The brand owns none of the lookalike domains generated from its own name. Every one of them is available to someone else, and registering them is the cheapest control a merchant has. The strongest single signal in the index. | 25 max points All or nothing |
| Threat-listed lookalikes Lookalike domains appearing on a public spam or phishing blocklist (Google Safe Browsing, SURBL, URLhaus). One hit is a real signal; two or more indicates a campaign rather than an isolated registration. | 25 max points 15 for one · 25 for two or more |
| Registered lookalikes Lookalike domains registered by someone other than the brand, not yet redirecting or blocklisted. These addresses are registered but not currently redirecting or appearing on the checked blocklists. | 15 max points Scales linearly, reaching maximum at 10 externally-owned domains |
| DMARC enforcement gap A policy of p=none reports authentication failures without requesting that messages be blocked. It scores closer to no record than to an enforced policy. | 15 max points 0 at p=reject · 6 at quarantine · 12 at p=none · 15 with no record |
| Outnumbered defender The brand registered some of its own typos but is heavily outnumbered. This includes brands that registered only a small share of their lookalike addresses. | 10 max points All or nothing, at a 5:1 external-to-owned ratio |
| Email auth gaps Missing SPF or DKIM. Scored low because it is largely redundant with DMARC enforcement. | 2 max points All or nothing |
| Transport gaps Missing HSTS or an invalid certificate. Retired from scoring in 2026.4: SSL is universal on Shopify and HSTS is a platform default, so the component carried no discriminating signal. Listed for continuity with earlier editions. | 0 max points Not scored in this edition |
The components do not sum to 100. No defensive registration and outnumbered defender are mutually exclusive. The first applies only to brands that own none of their lookalikes, the second only to brands that own some, so the highest score any real store can reach is 82. The scale runs to 100 for readability and comparability across editions, not because 100 is attainable.
Tiers
Critical is gated on evidence, not on score. A store with no DMARC, no defensive registrations and a large lookalike inventory is still only at risk until something is actually observed being used against it. That gate is why this report can name brands in the critical tier without overclaiming.
The impersonation funnel is already visible.
Brand impersonation is a progression, not an event. The first three stages describe the public state of third-party lookalikes: registration, active redirects, and documented abuse. The final two stages measure merchant-controlled controls: defensive registration and DMARC enforcement.
1805 of 2000 top stores (90.3%) have at least one third-party-registered lookalike. A registration does not establish malicious intent; it is a domain that needs classification.
1793 of 2000 (89.6%) have at least one lookalike currently redirecting to a non-brand-owned destination, such as a parking page, marketplace listing, or storefront. The destination still needs review before it is treated as abuse.
31 of 2000 (1.6%) have a lookalike currently appearing on Google Safe Browsing, SURBL, or URLhaus. Threat-list inclusion can lag observed behavior. Stage 2 is an earlier signal that a lookalike has become active, not proof of malicious intent.
48.9% of top stores own at least one of their own generated variants. This is one measurable defensive registration, not a complete strategy for every customer route.
10.8% combine DMARC at p=reject with
at least one defensive lookalike registration, and have no current
threat-listed lookalike. This is a measured configuration state, not a
guarantee that a brand cannot be impersonated.
First-year baseline.
"Documented abuse" here means appearance on a public threat list (Google Safe Browsing, SURBL, URLhaus). These services have indexing lag and incomplete coverage. The Stage 3 number is a floor, not a ceiling. Stage 2's "actively redirecting" lookalikes include many that have not yet been flagged.
Consumer-facing categories can have more visible impersonation exposure.
Categories with high repeat purchase, strong visual identity, and direct consumer trust have more to lose from impersonation. That is why the highest-BEI categories are not necessarily the most technical. They are categories where a copied storefront or spoofed email may plausibly reach a shopper.
Average Brand Exposure Index by parent category. Sample size in parentheses. Categories with fewer than five stores are included for completeness, but the sample is too small for a stable average.
Categories are exposed for different reasons.
Average BEI is the headline. The components beneath it are the story. Where one category's score is driven by registered lookalikes nobody owns, another's is driven by missing DMARC enforcement. That distinction shapes which defense actually moves the number.
Impersonation follows predictable ecommerce patterns.
Attackers don't pick lookalike domains at random. They use the same handful of construction patterns and reach for the same handful of TLDs. Knowing the patterns tells you what your own defensive sweep should cover.
Construction class
Across 38,487 third-party-registered
lookalikes observed against the cohort. True IDN homoglyphs (Cyrillic or Greek
characters encoded as xn-- punycode) are uncommon in this
cohort. ASCII character swaps appear more often (see section 04D).
Top TLDs in the inventory
Across 38,487 third-party-registered lookalikes observed.
TLDs over-represented in threat-listed lookalikes
The cheap-abuse TLD pattern: defensive registration covers .com; weaponization concentrates elsewhere.
The lookalikes your customers can't tell apart.
Some lookalikes do not misspell a brand. They swap one character for a near-identical one. The most common in our cohort is the digit "1" standing in for a lowercase "l," which is nearly invisible in the sans-serif fonts used by browsers and email clients.
Recon observed 150 character-swap variants registered against the 2000-store cohort, affecting 114 of 2000 brands. The examples below are real registrations; the swap is shown in the display column.
matte1.comrevel1.comritua1.comange1.comtona1.comayb1.comhue1.compop1.codecath1on.comtc1.comThe term homoglyph attack usually refers to characters from different writing systems, often encoded as punycode. This cohort contains few true IDN homoglyphs (see page 9); the examples here are ASCII character swaps and should be treated as a distinct pattern.
The cases above are registered now, against the brands named. The examples show why teams should inspect the actual registered domain, not only how the string appears in a headline or address bar.
Recognition creates inventory before it creates incidents.
Lookalike count is an early-warning metric, not an incident count. It measures registered variants that may require review. Redirecting counts lookalikes that already point somewhere (parking pages, monetised squats, or active impersonation). It is Stage 2 in the funnel and needs classification before it is treated as a real incident.
| Rank | Domain | Category | Lookalikes | Registered | Redirecting | BEI |
|---|---|---|---|---|---|---|
| 1 | society6.com | home | 103 | 103 | 102 | 46 |
| 2 | gld.com | jewelry | 97 | 97 | 93 | 40 |
| 3 | harrys.com | beauty | 96 | 96 | 94 | 31 |
| 4 | aloha.com | food | 96 | 96 | 93 | 40 |
| 5 | toms.com | apparel | 92 | 92 | 90 | 54 |
| 6 | swell.com | gift | 92 | 92 | 90 | 37 |
| 7 | ecoflow.com | tech | 91 | 91 | 90 | 25 |
| 8 | angel.com | media | 91 | 91 | 90 | 46 |
| 9 | venus.com | apparel | 90 | 90 | 84 | 42 |
| 10 | cross.com | food | 90 | 90 | 82 | 25 |
| 11 | holy.com | food | 89 | 89 | 85 | 37 |
| 12 | anker.com | tech | 88 | 88 | 84 | 46 |
Findings reflect public-internet scans at time of publication and describe third-party-registered domains, not actions by the named brands. The named brands are subjects of impersonation, not actors in it.
The 2026 edition is the baseline.
Two things ship from this snapshot forward, both unlocked by 12 months of paired scan history:
Year-over-year BEI movement, by category
Every category's 2026 BEI is locked in this snapshot. Next edition shows which categories hardened, which regressed, and by how much, using the same cohort and scan vectors.
Rising-target detection
Stores whose rank and lookalike count both increase. This requires paired rank and scan history to calculate.
In the meantime, the brands at highest risk of compounding exposure are already appear in the "most impersonated" list (section 05). High recognition and high lookalike counts can create more opportunity for impersonation.
Critical exposure, by name.
Top-100 stores whose Brand Exposure Index sits in the "critical" tier (BEI ≥ 70). A weaponized lookalike on its own pushes a brand into this band; registered-but-not-weaponized domains alone do not. Each card shows the single BEI component contributing most to the score.
Findings reflect public-internet scans at time of publication and describe third-party-registered domains, not actions by the named brands. The named brands are subjects of impersonation, not actors in it.
See where your brand sits in the impersonation funnel.
The top 2000 are the cohort measured in this edition. Recon uses the same public-data checks when you scan an individual Shopify store.
Recon scans your Shopify store against the same five vectors used in this report: registered lookalikes, weaponized lookalikes, DMARC enforcement, email-auth gaps, and transport security. You'll see which domains are harmless, which need monitoring, and which are ready for takedown.