Skip to main content

New gTLD abuse

New gTLD abuse is the exploitation of the many newer top-level domains, such as .shop, .app, .xyz, and .top, to register cheap lookalike and scam domains at scale.

Updated 1 min read

How it works

The expansion of the domain name space added hundreds of new endings, many of them cheap and loosely policed. Attackers register your brand under endings you do not own, such as yourbrand.shop or yourbrand.app, and use them for phishing, fake stores, or redirects. Some TLDs see far higher abuse rates than legacy ones like .com.

Because you cannot defensively register every ending, watching the new TLD space matters.

How it relates to brand impersonation

New gTLDs widen the lookalike surface around your brand at low cost to attackers. They are a common home for the impersonating domains monitoring is meant to catch.

How nebty helps

nebty watches the full TLD space around your brand, not just .com and your home market, so abusive registrations under new endings surface for review and on-demand takedown.

Why some endings attract abuse

Not all top-level domains carry the same risk. Abuse concentrates where registration is cheap, bulk-friendly, and lightly policed, which is why several newer endings show abuse rates many times higher than .com. For an attacker the appeal is simple: a few euros buys yourbrand.shop or yourbrand.app, your customers half-expect brands to live on themed endings, and the registry may be slow to act on complaints. You cannot defensively register your brand across hundreds of endings, and trying is a poor use of budget. The realistic posture is to register the handful that match your business and home market, then monitor the rest, so when your name appears under an ending you do not own, you see it and can decide whether it warrants a takedown.

A lookalike domain is any domain crafted to resemble a legitimate one closely enough to deceive. It is the umbrella term that covers typo-, combo-, and homoglyph squatting and more.

Domain abuse & monitoring

Typosquatting is the registration of domains that exploit common typing mistakes of a well-known domain, such as "gogle.com" or "amazn.com", to capture mistyped traffic.

Domain abuse & monitoring

Combosquatting combines a brand name with an extra word, such as "paypal-security.com" or "apple-support.net", to create a domain that looks legitimate and trustworthy.

Domain abuse & monitoring

Domain monitoring is the continuous tracking of newly registered and changed domains that resemble your brand, so you can spot lookalikes and abuse early, before they are used against you.

Domain abuse & monitoring

Cybersquatting is registering, trafficking in, or using a domain name that is identical or confusingly similar to someone else’s brand or trademark, in bad faith.

Domain abuse & monitoring

Punycode is the encoding that represents non-ASCII characters in domain names using only ASCII, turning an internationalized domain into a string that starts with "xn--". Attackers exploit it to hide homoglyph domains.

Domain abuse & monitoring

Domain reputation is a score that mail providers, browsers, and security tools assign to a domain based on its history, deciding whether to trust, flag, or block its mail and links.

Domain abuse & monitoring

Trademark monitoring is watching for unauthorized use of your registered trademarks, in new trademark filings, domains, marketplaces, and online content, so you can object or enforce early.

Brand protection & DRP
Free report

See who is impersonating your brand

The free nebty report scans the web for lookalike domains and fake profiles targeting your brand, with no obligation.

Benedikt Scheungraber

Benedikt Scheungraber

Co-Founder & CEO

Questions about brand protection, or want to see nebty in action? I’m happy to walk you through it myself and talk openly about whether we can help with your case.