Norton lookalike domains

What kind of lookalikes

Words most often added to the name in the last 90 days: app (5), help (4).

Lookalikes per week

Endings

The 8 most used of the 30 top-level domains these lookalikes sit under.

Where they are registered

For the 163 with a registrar in WHOIS (78% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

What the live ones do

30 of these lookalikes were registered and checked for a website and mail: 15 (50%) served a website and 21 (70%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists none of the 9 live ones checked against it.

11 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Norton; it is not necessarily malicious, and none of these is a claim about who registered it or why.

• nortonservice[.]co[.]in
  Combo, Oct 14MX records
• nortonaccountants[.]ie
  Combo, Oct 13MX records
• nortonservices[.]uk
  Combo, Oct 13Serves a websiteMX records
• nortonappliancerepair[.]com
  Combo, Oct 10MX records
• nortonappraisal[.]ca
  Combo, Oct 10Serves a websiteMX records
• nortonhelpandsupport[.]com
  Combo, Oct 9No site or mail when checked
• nortonhelps[.]com
  Combo, Oct 7MX records
• myaccountnorton[.]com
  Combo, Oct 4MX records
• nortonaccountancy[.]co[.]uk
  Combo, Oct 4Serves a websiteMX records
• nirton[.]com
  Typo, Oct 2Not checked

Further reading

• What combosquatting is, with examples
• Homoglyph and punycode domains, explained
• How to find lookalike domains of your own company
• What to do about a lookalike domain
• The weekly lookalike domain report, across all monitored brands