Fake Holiday Stores Copying Your Brand? AI Domain Watch

Every holiday season the same thing happens to someone. A shop runs its biggest promo of the year, and a stranger registers a domain that's one letter off, copies the product photos, and starts taking orders. Customers pay. Nothing ships. The angry emails land in your inbox, not the scammer's.

You can't stop a stranger from registering a domain. You can find out quickly, though, and speed is most of the fight. Here's how an AI assisted lookalike domain watch works, what it can and can't catch, and when it honestly isn't worth the effort.

Why this is your problem, not just your customers'

Statistics Canada's Impact of cybercrime on Canadian businesses, 2023 found that about 1 in 6 (16%) Canadian businesses were impacted by cyber security incidents in 2023. Among those impacted, 50% dealt with scams or fraud and 31% with identity theft, which was up 11 percentage points from 2021. Recovery spending hit roughly $1.2 billion in 2023, double the roughly $600 million of 2021, and small businesses with 10 to 49 employees accounted for about $300 million of it.

Be careful with those numbers. They cover every kind of incident, not fake stores specifically. What they do show is that impersonation style attacks are growing, and cleanup isn't cheap.

The Canadian Anti-Fraud Centre's 12 Frauds of the Holidays bulletin warns about brand name offers "listed for quick sale or for too good to be true prices," and notes that inferior or counterfeit products "could pose significant health risks." If a knockoff of your product is sold under your name, that risk gets pinned to your brand, fairly or not.

What a lookalike domain actually looks like

Get Cyber Safe, the Government of Canada's public awareness program, describes typosquatting as criminals registering "a common misspelled website that appears like a legitimate one." Its warning signs include typos, hyphenated domains, names mixing letters and numbers, and other alphabets or special characters.

Take a made up bakery, Maplecrumb, at maplecrumb.ca. The copies might look like this:

• maplecrumbs.ca or maplecrum.ca (one letter added or dropped)
• maple-crumb.ca (a hyphen slipped in)
• rnaplecrumb.com ("rn" reads as "m" at a glance)
• maplecrumb-holiday.shop (your name plus a seasonal word on a new ending)
• a version where one "a" is a Cyrillic letter that looks identical on screen

None of these need to fool you. They only need to fool a customer scrolling an ad on their phone in December.

How the watch works

1. Generate the variants. You don't have to brainstorm typos by hand. dnstwist, an open source tool under the Apache 2.0 licence, describes itself as a domain permutation engine. It produces variants using techniques such as homoglyphs, hyphenation and dictionary additions, then checks which ones actually resolve. It can also flag "rogue MX host detection (intercepting misdirected e-mails)", compare page HTML using fuzzy hashes, and compare screenshots using perceptual hashes. That last part matters, because a fake store's whole job is to look like yours.

2. Watch new certificates. A fake checkout page that wants a padlock in the browser needs a TLS certificate, and certificates can show up in public logs. RFC 9162, the Certificate Transparency 2.0 spec published in December 2021, says interested parties "can monitor the logs, asking them regularly for all new entries," to spot certificates they didn't expect. The RFC frames this around domains you're responsible for. Searching those same logs for new names that merely contain your brand is an extension of the idea, and it can surface a copycat before anyone reports it.

3. Let AI do the triage. This is where AI earns its spot. A permutation run on a short brand name can return hundreds of candidates, and most are unregistered, parked, or belong to someone legitimate. Nobody wants to open each one. An AI step can screenshot the live ones, compare them against your real site, read the page text, and sort them into "ignore," "keep watching," and "a person needs to look at this today." It can also draft the evidence pack: screenshots, registration dates, which of your product names and photos appear, and where the payment form points. A human still makes the call. The AI just shrinks a list of hundreds down to a handful.

4. Act on what's real. Start with the fast routes: an abuse report to the registrar and the hosting provider, a report to the payment processor the fake store uses, and a report to the Canadian Anti-Fraud Centre. Then post a short notice on your own site and social pages telling customers your one official address. Get Cyber Safe's own advice to the public is to bookmark sites you trust and consider a DNS filter such as CIRA Canadian Shield, so it helps to make your real domain easy to bookmark.

The formal route: dispute policies

If the domain stays up, there are written dispute processes. For .com and other generic endings, ICANN's Uniform Domain Name Dispute Resolution Policy (updated 21 February 2024) requires a complainant to show three things: the domain is "identical or confusingly similar" to a mark the complainant has rights in, the registrant has "no rights or legitimate interests," and the domain "has been registered and is being used in bad faith." Remedies are limited to cancelling the domain or transferring it to you. No damages.

For .ca, CIRA's Domain Name Dispute Resolution Policy, Version 1.3 (August 22, 2011) is similar but not identical. You must prove "on a balance of probabilities" that the domain is confusingly similar to a mark in which you "had Rights prior to the date of registration of the domain name," that it was registered in bad faith, and you must provide "some evidence" the registrant has no legitimate interest. The panel then decides whether the registration is deleted or transferred.

Both are paper processes with a panel decision, so treat them as cleanup, not an emergency brake for a Black Friday weekend.

An illustrative week

These numbers are made up to show the shape of the work, not results from any real business. Say a Burnaby gift shop runs the watch every morning in November. On Monday it generates 300 variants. About 20 resolve. AI triage marks 17 as parked pages or unrelated businesses, 2 as worth watching, and 1 as a near pixel copy of the shop's holiday page with a different checkout. The owner spends ten minutes confirming it, sends the evidence pack to the registrar, host and payment processor, and pins a "we only sell at our official site" post. That's the realistic goal: hours instead of weeks between the fake going up and you knowing about it.

Where this doesn't apply

Generic names. If your business is called "Metro Vancouver Plumbing," hundreds of legitimate companies will look like lookalikes. The noise swamps the signal.

Fakes without domains. Plenty of holiday scams run on marketplace listings and social pages. A domain watch won't see them at all.

No trademark rights. Both dispute policies hinge on rights in a mark, and CIRA's requires rights that predate the copycat's registration. If you've never thought about your trademark, talk to a lawyer before you count on this route.

Imperfect detection. Homoglyph tricks, sites that skip certificates, and pages that show a clean version to scanners can slip past. AI triage can also wrongly flag a legitimate business.

Accusing the wrong person. Never send a takedown on an AI flag alone. CIRA's policy lets a panel rule against a complainant who brought a case "unfairly and without colour of right."

Tiny online footprint. If you don't sell online and nobody searches for you by name, a quarterly manual check may be all you need.

Sources

1. Statistics Canada, "Impact of cybercrime on Canadian businesses, 2023," The Daily, 2024. https://www150.statcan.gc.ca/n1/daily-quotidien/241021/dq241021a-eng.htm
2. Canadian Anti-Fraud Centre, "The 12 Frauds of the Holidays," page dated November 25, 2025. https://antifraudcentre-centreantifraude.ca/features-vedette/2021/11/holiday-fetes-eng.htm
3. Get Cyber Safe, Government of Canada, "What is typosquatting?," 2023. https://www.getcybersafe.gc.ca/en/blogs/what-typosquatting
4. elceef, "dnstwist," GitHub repository, accessed October 2026. https://github.com/elceef/dnstwist
5. IETF, RFC 9162, "Certificate Transparency Version 2.0," 2021. https://www.rfc-editor.org/rfc/rfc9162.html
6. ICANN, "Uniform Domain Name Dispute Resolution Policy," updated 2024. https://www.icann.org/resources/pages/policy-2024-02-21-en
7. CIRA, "CIRA Domain Name Dispute Resolution Policy, Version 1.3," 2011. https://www.cira.ca/uploads/2023/05/cdrppolicy_-_en.pdf

Want a lookalike watch running before the holiday rush? Autana Solutions sets up AI monitoring and triage for small businesses across Burnaby, New Westminster and Metro Vancouver, and we'll tell you plainly if your business doesn't need one. Book a free call and we'll walk through your brand's risk together.