The whole documented corpus, as one dated file you can hold
Every lookalike storefront hostname we have documented and published — 61 of them across 57 brands, carrying 653 dated observations between them — exported as one table, one row per hostname, fixed to the day you buy it. The rows are the ones re-checked in our re-verification round of 27 October 2026; each carries the state we observed in our fixed vocabulary, the date we observed it, every superseded observation with its own date, and the artefacts we published for it, quoted verbatim.
Of the 61 hostnames on this index: 34 were live, HTTP 200 when we last checked them; 21 do not resolve; 3 resolve but do not serve; 3 we could not re-check, because our own check failed. A hostname's state can change on any day, in either direction — one row on this list was observed “does not resolve” on 31 July 2026 and “live, HTTP 200” again on 2 September 2026, re-confirmed 8 September 2026, 15 September 2026, 22 September 2026, 13 October 2026, 18 October 2026, 19 October 2026, 20 October 2026 and 27 October 2026.
One-time · CSV + PDF · $499
Clone Ledger Export — $499
61 documented hostnames across 57 brands, 653 dated observations, as re-checked in the round of 27 October 2026. One row per hostname, the whole observation chain in the row it belongs to.
A 16-column CSV, one row per documented hostname — 62 lines including the header row, covering all 61 hostnames across 57 brands.
The full dated observation history: all 653 observations we hold, every superseded reading kept with its own date in the row it belongs to, oldest first.
Per row: the brand the page reproduced, the evidence class it falls in, the state we observed in the fixed three-string vocabulary, the date of that observation, the date it was last observed serving, and the date it was first documented.
The artefacts we published for each hostname, quoted verbatim — filenames, asset paths, product codes and reproduced copy — plus the flag for the .shop clone-kit build and a link to that hostname's own public record.
The annotations that keep the dates honest: the rows where our own check failed (the date does not advance, and the row says so) and the rows re-classified when what they served changed (the earlier class is kept with its own date).
The same table as a paginated PDF, 24 pages, with the dated summary and the limits on the front of it — the copy you can circulate inside a team or attach to a file.
The card form opens on this page. Nothing is charged until you complete it, and the export is built from the record as it stands on the day you pay — your copy does not change afterwards when we record a new check.
Delivery is immediate and automatic: the research is already published and dated, so there is no queue in front of it. The moment the payment verifies we build the export, email you the link to your order page, and put both files — the CSV and the PDF — on that page to download. No account to create, no form to fill in beyond the card itself, nothing kept on file.
Every row is a dated record of what we observed on the day we checked it, not a statement about what any hostname is serving today. We do not re-check these hostnames for you after delivery, we name no registrar, host or IP, and nothing here is a takedown, an outcome promise or legal advice.
Most research, brand-protection and trust-and-safety teams cannot put a company card through a supplier's form. The invoice route below captures the ask, confirms it to you by email and raises the invoice to the address you give — and the export is produced once that invoice is paid.
No card? Buy it on an invoice instead
Request an invoice for the Clone Ledger Export — $499
Most brand-protection, trademark and legal teams cannot put a company card through a supplier's web form — spend leaves as an invoice, often against a purchase order. If that is you, ask for one here instead.
Tell us who to invoice. We email you a confirmation immediately and send the invoice to the same address. The export is produced once the invoice is paid — the same file this page describes, fixed to the day it is produced.
These are not sentences written for this page. They are the scope limits from our own claims register, reproduced word for word, and they bind every surface of this site — including the one you are reading.
Every report is a point-in-time audit of publicly observable information, dated to the day the reads were taken. A hostname's state can change at any time after that date.
No continuous monitoring, on any tier. There is no real-time feed, no API and no alerting, and nothing is re-checked after the report is delivered.
No takedown execution, on any tier: we never file. We assemble the evidence and draft the request; the buyer sends it.
We never contact the registrant, and we do not contact a registrar, host or platform on a customer's behalf.
No outcome and no timeline is promised. Whether anything is suspended is the registrar's, host's or platform's decision alone.
No legal representation, ever. This is the boundary that did NOT move and must never be softened. We are not a law firm.
No fund recovery.
No legal proceedings, and no advice on the merits of a trademark position.
We make no assertion about any registrant's intent or criminality
Quoted from growth/approved-claims.md §13b, with no word added, removed or softened.
A question before you pay — a column you need, a billing entity, a purchase order we should quote? Write to scam-detective8@mail.acoco.ai and a person reads it.
What arrives, exactly
·A 16-column CSV, one row per documented hostname — 62 lines including the header row, covering all 61 hostnames across 57 brands.
·The full dated observation history: all 653 observations we hold, every superseded reading kept with its own date in the row it belongs to, oldest first.
·Per row: the brand the page reproduced, the evidence class it falls in, the state we observed in the fixed three-string vocabulary, the date of that observation, the date it was last observed serving, and the date it was first documented.
·The artefacts we published for each hostname, quoted verbatim — filenames, asset paths, product codes and reproduced copy — plus the flag for the .shop clone-kit build and a link to that hostname's own public record.
·The annotations that keep the dates honest: the rows where our own check failed (the date does not advance, and the row says so) and the rows re-classified when what they served changed (the earlier class is kept with its own date).
·The same table as a paginated PDF, 24 pages, with the dated summary and the limits on the front of it — the copy you can circulate inside a team or attach to a file.
The 16 columns are, in the file’s own order: hostname, brand, evidence_class, observed_state, observed_on, observed_on_iso, last_observed_serving_on, first_documented_iso, decay_history, not_rechecked_note, reclassified_note, artefact_count, artefacts, clone_kit_domain, record_url, dispute_page_url.
Every row is a dated record of what we observed on the day we checked it, in the past tense, and never a statement about what any hostname is serving today. A hostname that stopped resolving is not described as removed, suspended, seized or taken down: we did not observe why it stopped, and we read back no registry hold for it.
An excerpt from the round of 27 October 2026
6 rows from the round of 27 October 2026, exactly as the file carries them. 58 of the 61 rows completed a reading on that round; 3 did not, because our own check failed, and those keep both their earlier finding and their earlier date. Nothing below is redacted — every row is already published free on its own page, and the link in each row goes to it.
6 rows of 61. The file carries all of them, and the column the excerpt cannot show on a phone is the one worth most: every superseded observation for that hostname, each with its own date, in the row it belongs to.
How to check any row above for yourself
Every reading in the file was taken this way, and you can re-run any of them yourself against any hostname in the excerpt. A check you run today will not necessarily agree with ours: ours is dated, yours is today's, and the difference between the two dates is the finding rather than an error in either.
1. Ask the DNS, twice, from resolvers we do not run
dig +short <hostname> A
curl -s 'https://dns.google/resolve?name=<hostname>&type=A'
Two independent answers, both empty, is what this dataset records as “does not resolve”. One empty answer is not a finding, and a resolver that is simply unreachable from where you are is a fact about your network, not about the hostname.
A 200 is “live, HTTP 200”. A 403 or a 404 is “resolves but not serving — HTTP nnn”, which is an observation about a server and nothing more. A fetch that fails at your own egress tells you about your egress: record it as that, or record nothing.
The four fields this dataset publishes are the record's own: `status`, and the `registration`, `expiration` and `last changed` entries in `events`. RDAP is a public protocol and these are the registries' own endpoints, so a third party gets the same bytes we did. Timestamps will have moved on since our round — that is the point of dating a reading.
Decay is not one-way, and the file is built around that
The finding this corpus exists to carry: one row on this list was observed “does not resolve” on 31 July 2026 and “live, HTTP 200” again on 2 September 2026, re-confirmed 8 September 2026, 15 September 2026, 22 September 2026, 13 October 2026, 18 October 2026, 19 October 2026, 20 October 2026 and 27 October 2026. That is why every row keeps its whole observation chain rather than a single current state, and why no row is ever written as finished. A hostname that is not in the zone today can be back in it tomorrow, and one row here has already done exactly that.
We did not observe why it stopped resolving, we make no claim that it was removed, suspended or taken down, and a hostname that stops resolving can be re-pointed at any time — one in this corpus already has.
Read the file before you buy it
Five real rows in full, the complete column schema with a worked example for every column, and the CSV and PDF exactly as they are delivered — produced by the same builders the paid export runs, so nothing here can read better than what arrives.
The record as data — 5 real rows, free
These are 5 of the 61 rows, in the structured form our own sweeps write them — same columns, same fixed state vocabulary, same dates. Nothing below is redacted. Every row in this corpus is already published free on its own page, and these five are the genuine article — written by the same code that produces every dated reading on this site.
Of the 61 hostnames on this index: 34 were live, HTTP 200 when we last checked them; 21 do not resolve; 3 resolve but do not serve; 3 we could not re-check, because our own check failed. A hostname's state can change on any day, in either direction — one row on this list was observed “does not resolve” on 31 July 2026 and “live, HTTP 200” again on 2 September 2026, re-confirmed 8 September 2026, 15 September 2026, 22 September 2026, 13 October 2026, 18 October 2026, 19 October 2026, 20 October 2026 and 27 October 2026.
What we do not promise: no row here is a statement about what a hostname is serving today, we do not re-check these hostnames for you, and nothing here predicts or promises any takedown, any filing outcome or any timing. It names no registrar, hosting provider, network or IP.
observed_statedoes not resolve when checked on 27 October 2026 (2026-10-27)
serving_on15 September 2026 · first documented 2026-07-27
decay_history
live, HTTP 200 on 4 August 2026
live, HTTP 200 on 2 September 2026
live, HTTP 200 on 8 September 2026
live, HTTP 200 on 15 September 2026
does not resolve on 22 September 2026
does not resolve on 29 September 2026
does not resolve on 6 October 2026
does not resolve on 13 October 2026
does not resolve on 18 October 2026
does not resolve on 19 October 2026
does not resolve on 20 October 2026
artefacts (4)
Serves the genuine brand’s own hosted files — the hero image, the favicon and a category image — directly from the real brand’s CDN. This is file-level copying, not an imitated look.
A category image from cdn.shopify.com/s/files/1/0108/8959/2898/ — the real brand’s own Shopify asset path.
Our strongest evidence class, and what an artefact row looks like: on the dates below this address was serving the genuine brand's own hosted hero image, favicon and a category image from the real brand's CDN. The artefacts column carries that finding word for word. It did not resolve on our most recent check, and the row shows that too — a dated record of what an address served does not stop being true when the address stops answering.
We did not observe why it stopped resolving, we make no claim that it was removed, suspended or taken down, and a hostname that stops resolving can be re-pointed at any time — one in this corpus already has.
observed_statelive, HTTP 200 when checked on 27 October 2026 (2026-10-27)
serving_on27 October 2026 · first documented 2026-08-13
decay_history
live, HTTP 200 on 13 August 2026
live, HTTP 200 on 2 September 2026
live, HTTP 200 on 8 September 2026
live, HTTP 200 on 15 September 2026
live, HTTP 200 on 22 September 2026
live, HTTP 200 on 29 September 2026
live, HTTP 200 on 6 October 2026
live, HTTP 200 on 13 October 2026
live, HTTP 200 on 18 October 2026
live, HTTP 200 on 19 October 2026
live, HTTP 200 on 20 October 2026
artefacts (3)
Loads 40 images directly from nomatic.com — the genuine Nomatic’s own domain — including its homepage banner, e.g. nomatic.com/cdn/shop/files/WFA_Homepage_M-1070x900_1.png.
Reproduces 3 of Nomatic’s own image filenames, e.g. an-sj1-blk_outsetsoftshelljacket-hoodie_black_nomatic_11, an-rp1-olv_outsetpant_classic_olive_nomatic_04, an-jp1-ccl_outsetjogger_charcoal_nomatic_04.
Reproduces 3 of Nomatic’s own product codes: AN-SJ1, AN-RP1, AN-JP1.
The row a free scanner and our own fetch read differently on one day — see the note under the table. Its artefacts are filenames and product codes anyone can check in a browser.
observed_statelive, HTTP 200 when checked on 27 October 2026 (2026-10-27)
serving_on27 October 2026 · first documented 2026-07-27
decay_history
does not resolve on 31 July 2026
live, HTTP 200 on 2 September 2026
live, HTTP 200 on 8 September 2026
live, HTTP 200 on 15 September 2026
live, HTTP 200 on 22 September 2026
live, HTTP 200 on 13 October 2026
live, HTTP 200 on 18 October 2026
live, HTTP 200 on 19 October 2026
live, HTTP 200 on 20 October 2026
artefacts (0)none recorded for this hostname — stated rather than padded
Read the decay column first. This hostname did not resolve on one of our checks and was serving the full clone kit again on a later one, which is why every row carries its history rather than a single current state. Two later rounds failed at our own egress and its date stood still through both; the round after that completed, and the column carries all of it — dated record, no present tense.
We did not observe why it stopped resolving, we make no claim that it was removed, suspended or taken down, and a hostname that stops resolving can be re-pointed at any time — one in this corpus already has.
observed_stateresolves but not serving — HTTP 522, when checked on 27 October 2026 (2026-10-27)
serving_on17 August 2026 · first documented 2026-08-17
decay_history
live, HTTP 200 on 17 August 2026
resolves but not serving — HTTP 403 on 2 September 2026
resolves but not serving — HTTP 403 on 8 September 2026
resolves but not serving — HTTP 403 on 15 September 2026
resolves but not serving — HTTP 403 on 22 September 2026
resolves but not serving — HTTP 403 on 29 September 2026
resolves but not serving — HTTP 522 on 6 October 2026
resolves but not serving — HTTP 522 on 13 October 2026
resolves but not serving — HTTP 522 on 18 October 2026
resolves but not serving — HTTP 522 on 19 October 2026
resolves but not serving — HTTP 522 on 20 October 2026
artefacts (10)
Four images on its homepage load from us.foursigmatic.com — the genuine Four Sigmatic store’s own domain. The page serves the genuine brand’s own hosted files, which is asset-level evidence.
The /cdn/shop/files/ path and the ?v= cache-busting stamps are a Shopify asset path, and the version stamps are the ones the genuine store generated.
On the same page the product photographs load from foursigtics.com/wp-content/uploads/2026/02/… — the suspect’s own server. The four images pointing back at the real brand were decorative: background artwork in one marketing section.
Discounts in the 65–70% band: ground coffee marked $20 down to $6, and protein marked $50 down to $15 — both exactly 70% off.
A mushroom-coffee storefront carrying a slide for “JBuds Open Wireless Open-Ear Headphones” — a product the brand does not sell.
The support address published on the page is support@ its own domain — writing to it reaches whoever runs the page, not the brand being copied.
A row that resolved and served nothing when we last looked. The export records the HTTP status it answered with and the date, and stops there.
A server answering 403 or 404 is not a takedown: enforcement means a registry status code (clientHold or serverHold) read back off the domain’s record, and we have read none for this hostname. We record only the state we observed, on the day we observed it.
observed_statenot re-checked — our own check failed on 27 October 2026 — last observed live, HTTP 200 on 13 August 2026 (2026-08-13)
serving_on13 August 2026 · first documented 2026-08-13
decay_historyno superseded observation on this row — the check above is the only one on file
not_recheckednot re-checked — our own check failed on 27 October 2026
artefacts (2)
Loads at least one asset — a B-Corp badge — directly from ekster.com’s own file server: //www.ekster.com/cdn/shop/files/B-Corp-Logo-White-RGB.png.
Reproduces 6 of Ekster’s own image filenames, e.g. father_sdayprobundleapple-blackinfograph01, cardholder_pro_-_midnight_blue_infograph_01_9b48e5da-8a11-428f-bb40-4f4c73a843fb, d_r_passport_holder_-_onyx_infograph_01_no_logo.
The row where OUR OWN check failed. The date does not advance, the earlier finding stands, and the row says so in its own column — an export that quietly date-stamped an incomplete check would be worth nothing.
A check that fails at our own egress is a fact about our connection, never about the hostname. This row keeps the date of the last check we genuinely completed.
Why the decay column exists: noguhq.shop
This is the column a snapshot cannot give you. On 31 July 2026 the observed state of noguhq.shop was “does not resolve”; on 27 October 2026 it was “live, HTTP 200” again. Both observations are in the row, each with its own date, and neither one is written as the end of the story.
Quoted from that row's own record: On 27 October 2026 we fetched noguhq.shop with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked.
We did not observe why it stopped resolving, we make no claim that it was removed, suspended or taken down, and a hostname that stops resolving can be re-pointed at any time — one in this corpus already has.
What a score misses, on one dated example: nomaticstore.com
Row 41 above is nomaticstore.com. On 2 September 2026 we opened ScamAdviser's page for that hostname and it read, verbatim, “Likely Safe - we think nomaticstore.com is legit” — on an analysis the same page described as 3 days old. Our own cache-bypassed fetch of it that day recorded “live, HTTP 200”, and the artefacts in the row above — first published 13 August 2026 — are the reason why. We did not run their analysis, we cannot see what it measured, and nothing here says their score is wrong about anything we did not check ourselves. What the two readings show is the difference between a score and a dated, itemised record, and that difference is the whole of what this file is.
·You are not buying permission. The published dataset is free and stays free under the Creative Commons Attribution 4.0 International (CC BY 4.0), including commercial use, with attribution as the single condition — the rows, the method and a machine-readable release are all at /lookalike-domain-dataset, and nothing on this page is withheld from it.
·You are not buying exclusivity, and nobody loses access because you bought it. The same corpus stays published, and the same /lookalike-domain-dataset.csv stays downloadable by anyone.
·You are buying the artefact and its delivery: the whole corpus in the evidence-class shape, as a loadable CSV and a paginated PDF, fixed to the day of purchase, with a receipt, an order page and an invoice route for a procurement record.
·No monitoring. We do not watch these hostnames for you after delivery, and nothing in the file is re-checked on your behalf.
·No feed and no API. There is no endpoint, no webhook, no push and no alerting — this is one file, bought once.
·No ongoing updates. The export is fixed to the day it was produced. A later re-verification round does not update your copy, and buying this does not entitle you to the next one.
·No registrar, hosting provider, network, name server or IP, for any hostname. That attribution is withheld here exactly as it is on every free page of this site.
·No takedown, no filing, no outcome and no timing of any kind — this is a record of what we observed, not an action taken against anyone.
The scope, in our own register’s words
These are not sentences written for this page. They are the scope limits from our own claims register, reproduced word for word, and they bind every surface of this site — including the one you are reading.
·Every report is a point-in-time audit of publicly observable information, dated to the day the reads were taken. A hostname's state can change at any time after that date.
·No continuous monitoring, on any tier. There is no real-time feed, no API and no alerting, and nothing is re-checked after the report is delivered.
·No takedown execution, on any tier: we never file. We assemble the evidence and draft the request; the buyer sends it.
·We never contact the registrant, and we do not contact a registrar, host or platform on a customer's behalf.
·No outcome and no timeline is promised. Whether anything is suspended is the registrar's, host's or platform's decision alone.
·No legal representation, ever. This is the boundary that did NOT move and must never be softened. We are not a law firm.
·No fund recovery.
·No legal proceedings, and no advice on the merits of a trademark position.
·We make no assertion about any registrant's intent or criminality
Quoted from growth/approved-claims.md §13b, with no word added, removed or softened — and it binds this page as much as any other surface here.
We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice.
If this is the wrong shape
Want one brand’s rows rather than all 57? Every brand in this corpus has its own slice on the dataset page, free, with that brand’s full dated chains on it. Want the index as a reader rather than as data? The documented index lists every hostname by the brand it reproduces. Want your own domain swept instead of our corpus read? That is a different report — start with the free count at /brand-audit, which asks for no email, no card and no account. A question first: scam-detective8@mail.acoco.ai.