Why Brand Impersonation Is Easy to Deploy and Difficult to Eradicate

Why Brand Impersonation Is Easy to Deploy and Difficult to Eradicate Brand impersonation scams are escalating rapidly, fueled by multi-surface campaigns and automated tools that allow attackers to redeploy fakes faster than single-asset takedowns can remove them. Data from Doppel's Threat Graph reveals that traditional internal defenses miss most attacks, takedowns often provide only temporary relief, and concentrated operator networks repeatedly recycle infrastructure across different channels. Americans reported losing $3.5 billion to imposter scams in 2025, up roughly 19% year-over-year, making it the Federal Trade Commission's most-reported fraud category. During their first 90 days with continuous external monitoring, brands and existing partners discovered only about 9% of confirmed fakes targeting them, with median brands self-detecting none. More than 80% of impersonated brands face attacks across two or more surfaces at once, while near-simultaneous multi-surface campaigns increased roughly sevenfold over two years. Although approximately 97% of filed takedowns eventually lead to content or host removal, nearly 60% of taken-down domains re-arm with a new confirmed fake within 24 hours. A small tier of professional actors drives the damage, with the most active 10% of operators accounting for nearly half of all analyzed impersonations. Severe Visibility Blind Spots for Targets Impersonation occurs on third-party platforms outside a company's internal perimeter, aimed at outside users rather than employees. Because internal security stacks cannot see these assets, brands fail to identify the vast majority of threats on their own. In the first 90 days of continuous external monitoring, brands detected roughly 9% of confirmed threats targeting them, 94% identified less than half, and the median brand identified none at all. Coordinated Multi-Surface Campaigns by Industry Threat actors rarely rely on a single channel, increasingly launching coordinated campaigns across social media, search ads, lookalike domains, mobile apps, and messaging. More than 80% of affected brands are targeted across multiple surfaces simultaneously. Targeting choices also vary sharply by sector: software and media encounter impersonation predominantly on social platforms, healthcare and manufacturing face attacks via mobile apps, and hospitality is targeted mostly through lookalike domains. Takedown Delays and Domain Recurrence While roughly 97% of filed takedown requests ultimately succeed, overall exposure is driven by platforms that delay or refuse responses. Furthermore, removal rarely neutralizes the underlying asset. Content removals happen far more readily than domain registrar seizures, enabling nearly 60% of taken-down domains to deploy another confirmed fake within 24 hours and close to 70% within 90 days. Over one in five malicious domains are aged domains that lay dormant for years before activation. Concentrated Operator Infrastructure and Modern Defense Despite the sheer volume of attacks, the threat landscape is dominated by a concentrated group of operators rather than disparate opportunists, with the top 10% generating nearly half of all attacks. Attackers rely on shared templates and disposable infrastructure to launch iterations immediately following takedowns. Effective defense requires continuous multi-surface monitoring that maps and dismantles the operator's broader infrastructure rather than reacting to individual artifacts in isolation.

品牌仿冒易发难绝：Doppel 数据揭示跨渠道攻击与高复发困境 网络品牌仿冒正演变为跨平台、高度自动化且难以根除的攻击。Doppel 在 2025 年至 2026 年的监测数据显示，大多数品牌对外部仿冒处于感知盲区，而单点下架往往无法遏制攻击者利用现成工具和沉睡域名的快速复发。 美国 FTC 数据显示，2025 年因仿冒诈骗造成的损失达 35 亿美元，同比上升约 19%，为报告最多的欺诈类型。 企业在接入持续监控前普遍存在严重盲区：品牌及其原有合作伙伴仅能自行发现约 9% 的确诊仿冒，中位数品牌自行发现率为零。 超过 80% 的受害品牌同时在两个或更多渠道遭受冒充，多渠道协同攻击规模在两年内增长约七倍。 近 60% 遭下架的域名会在 24 小时内重新上线新的仿冒内容，最活跃的前 10% 攻击团伙制造了近半数的仿冒破坏。 企业内部防御对外部仿冒存在巨大视线盲区 品牌仿冒行为发生在企业控制之外的第三方平台，针对的是外部受众而非内部员工，现有内部安全架构无法直接覆盖。在接入 Doppel 持续监控的前 90 天内，品牌自身仅能发现 9% 的确诊仿冒，94% 的品牌能发现的仿冒不足半数，中位数品牌甚至完全没有自主发现记录。不到 10% 的自查率表明仿冒感知并非边缘性失误，而是普遍缺乏视线覆盖。 多渠道协同攻击加剧且呈现行业分化特征 现今的攻击倾向于在社交平台、搜索广告、高仿域名等多渠道同时发起，两年内近乎同时发生的多渠道行动增加了约七倍。超过 80.6% 遭遇确诊仿冒的品牌在两个及以上渠道被冒充。不同行业遭遇仿冒的重灾区各有不同：软件和媒体品牌主要在社交媒体受害，医疗保健和制造业主要遭受移动应用冒充，酒店业则主要集中于仿冒域名。仅监控域名注册等单一手段通常只能捕获约 6% 的攻击面。 下架遭遇长尾延迟，恶意域名呈现极高复发率 虽然 Doppel 发起的下架请求有约 97% 最终移除内容或断开托管，但因部分平台长期不予响应，顽固仿冒能够存活数月并形成大部分暴露风险。在域名层面，下架往往仅能限制内容而非域名本身注销：近 60% 的被下架域名在 24 小时内重新加载新的确诊仿冒，近 70% 在 90 天内复发。此外，超过五分之一的恶意域名是经过多年沉睡后被启用的老域名，下架后的两周内同一品牌往往会遭遇更多基于变异测试的新仿冒。 团伙高度集中但依赖公用基础设施进行快速迭代 数据表明仿冒活动并非主要由分散的散户发起，最活跃的前 10% 运营者贡献了近一半的危害。攻击者普遍使用相同的模板包与代码在数分钟内克隆登录页面。十分之九的共享技术指纹仅对应单一品牌的反复攻击，而跨数百个品牌的广泛指纹则多属于通用的公共托管服务或现成模板。应对该类攻击需要摆脱逐个资产追逐的传统模式，转向持续多渠道监测并协同阻断其底层基础设施。

[America](https://www.a16z.news/t/america) | [Tech](https://www.a16z.news/t/technology) | [Opinion](https://www.a16z.news/t/opinion) | [Culture](https://www.a16z.news/t/culture) | [Charts](https://www.a16z.news/t/charts) Most forms of theft take something from you. You notice the car is gone, the account is drained, the files are locked. Brand impersonation is a strange one. Nothing of yours ever leaves. A copy of you, your company, your logo, your login page, goes to work somewhere else on the internet, collecting passwords and payments in your name. And, to make matters worse, if you’re being copied you’re usually the last to find out. That is what makes it so hard to fight. Impersonation is hard to find, because it runs on other people’s platforms, aimed at other people, in your name. It is harder to stop, because a single takedown rarely ends it. Like the Hydra of Greek myth, cut off one head and two grow back: a new lookalike domain, a fresh ad, another cloned account. How did Hercules beat Hydra? Only by searing each neck shut so nothing could regrow. The modern equivalent is an always-on social engineering defense, one that watches every surface at once and cauterizes the regrowth so the heads stay gone. The machinery for stopping impersonation has never been larger. Every big platform runs a trust-and-safety team, brand protection is a mature software category, and ‘AI-powered detection’ sits on every vendor’s homepage. The losses keep climbing anyway. Americans reported losing $3.5 billion to imposter scams in 2025, up \~19% from $2.95 billion the year before, and imposter scams were the single most-reported category of fraud, according to the FTC. We’re seeing more detection and more losses, at the same time. Doppel hunts fake versions of real brands (all industries) across the internet. The fakes turn up wherever their customers are: lookalike domains, social accounts, mobile apps, paid ads, marketplaces, and messaging. Doppel’s Threat Graph sits across the surfaces where impersonation lives: social, paid ads, domains, mobile app stores, and messaging, and it records what happens to a fake from the moment it is spotted to the moment it’s brought down. These are confirmed fakes, reviewed by analysts, across hundreds of brands, over the four quarters from spring 2025 to spring 2026. For once, we do not have to ask the victims what happened. We can watch. To map this, we have to look at the graph: the shared infrastructure connecting seemingly isolated attacks. Let’s start with how many impersonators companies actually notice. Before continuous monitoring begins, brands are nearly blind to their own impersonation: across their first 90 days with Doppel, brands and their existing partners surfaced only about 9% of the confirmed fakes targeting them. Doppel found the other 91%. 94% of brands caught fewer than half of their own impersonators, and the median brand caught none at all. Impersonation isn’t a visibility problem at the margins; for most brands, the fakes simply never cross their radar. In general, less than 10% of all brand impersonations are self-discovered: This is not a knock on those teams. Impersonation lives outside a company’s walls, on platforms they don’t control, aimed at people who aren’t their employees. No internal security stack can see it, no matter how good. That blind spot is the whole reason continuous external monitoring exists as a category. Seeing it is only half the challenge, because the attack is built to appear in many places at once. There is no single pane of glass. A campaign is many-headed by design: a head on social, another on a search ad, another on a lookalike domain, all at once, and operating 24/7 with the help of AI. The usual human math doesn’t apply here. Spinning up a new head costs the attacker minutes; finding and cutting one off costs a defender hours, and increasingly the heads appear everywhere at the same time: near-simultaneous multi-surface campaigns have grown roughly sevenfold in two years. No team scales with that by hand. Over 80% of impersonated brands are faked across two or more surfaces at once. A tool that only watches domain registrations, which is what most legacy takedown vendors were built to do, only catches a \~6% sliver of the picture, and misses the rest of it entirely. Of the brands that had confirmed impersonations, 80.6% were hit on two or more of the surfaces monitored for them. That figure only counts surfaces each brand actually has monitored: a brand that’s only bought domain and social modules can never show up as more than two surfaces, however many surfaces attackers actually use against them. So the true multi-surface rate is almost certainly higher than what’s shown here; this is a floor, not a ceiling. Where those surfaces land shifts by industry: Software and media brands are impersonated almost entirely on social media. Healthcare and manufacturing get hit mostly through mobile apps. Hospitality lives on lookalike domains. There is no universal channel, and a defense that watches only one surface stays blind to most of the attack. Say a brand does see all of it. Getting it down is the next fight. Once a fake is found, someone still has to get it removed, and a brand almost never owns the platform it lives on. So the main lever is the takedown request, a formal note to whoever hosts the fake asking them to pull it down. Most of those amount to little more than ‘please remove this.’ Of every threat Doppel filed a takedown request on over the past year, roughly 97% had their content removed and/or the hosting pulled. The 3% that survive cluster almost entirely on the handful of platform types that ignore takedown requests altogether. Even the fakes that do come down are not down instantly, and the harm is not spread evenly across a fake’s life. What stretches takedown times into weeks is not slow removals; it is the platforms that never answer at all. The good news is that half of all fakes are gone within a couple of days. A stubborn few live for months, and that long tail is where most of the total exposure sits, costing customers their money or a brand its trust. The longer a fake stays live, the more time it has to reach new victims, steal credentials or payments, spread across channels, and repeatedly erode trust in the brand. Where a fake lands on that curve depends less on the fake than on who you have to ask to remove it, and you do not get to pick who that is. The clock belongs to the platform, each with its own timeline and willingness to act, and most of a fake’s life is the wait for the host to move. Dirty domains (no, not those) deserve their own look. Once removed, a fake page seldom returns. The domain behind it usually survives, because the industry grants blocking and content removal far more readily than registrar-level removal, and it re-arms fast: almost 60% of taken-down domains serve a new confirmed fake within 24 hours, and close to 70% within 90 days. One-asset-at-a-time enforcement is a treadmill no vendor escapes. About half of malicious domains are registered and pointed at a brand within a month. But over one-in-five are aged domains that sat quietly for years before someone woke them up. Domains are the Jason Bourne-style sleeper cells of the scam world. In fact, the oldest in this data had been sitting untouched for the better part of a decade before it was aimed at a brand. Domains are also the one surface where beating a scam doesn’t last. Take a bad domain down and, hydra-like, a fresh head grows back on the same neck: most within 90 days, and often within a single day, on the same registrable name. Every other surface stays down once it is removed. On domains, a takedown buys you a day. Across the board, most scams don’t go quietly into the night, and campaigns push back with an almost hydra-esque quality. In the two weeks after a takedown, the same brand tends to see a rise in brand-new fakes. Why? Threat actors keep trying variations and iterations to test the waters on what is and isn’t being blocked or monitored. And, with AI, this is done much faster. Read one way, this is a losing battle: The services hosting the fakes may not answer, and the impersonations could grow back overnight. Read correctly, it’s a targeting problem. Most fakes end up dead; what survives is the operation behind it, respawning for pennies. Chasing fakes one at a time concedes that math. Mapping the operator’s infrastructure (every domain, account, and kit they run) and cutting it down at once is how the math flips. So who is actually behind all this? Fewer operators than the noise suggests. Group the fakes by who runs them and the busiest tenth accounts for nearly half of everything. A relatively small set of professional operations, rather than a planet of lone opportunists, produces most of the damage. They also share tooling. Plenty of fakes are built from the same kit, a ready-made bundle of page code and templates that clones a brand’s login page in minutes. It would be easy if you could follow those connections to a single kingpin behind everything, but the data will not take you there. Nine in ten shared fingerprints show up on just one brand, which is one operator reusing a tool against a single target and tying only their own fakes together. The rare fingerprints that span hundreds of brands turn out to be commoditized plumbing, a popular host or an off-the-shelf template that unrelated attackers all happen to use. That is what makes fakes so hard to track. There is nothing central to grab hold of, no master list and no single cluster to strangle. The operators are few, but they hide behind disposable, off-the-shelf infrastructure they can rebuild overnight, so watching any one fake tells you almost nothing. Keeping pace means watching every surface at once and without pause, because a fake taken down is usually a fake already regrowing somewhere else. The heads keep coming back. So what actually stops this? An always-on social engineering defense does three things at once: it watches every surface continuously, it acts on a fake within minutes of finding it, and it tracks the operator behind the regrowth rather than just the artifact in front of it. Recurrence and the balloon effect are why: kill a single fake and a new head grows back. And because a few operators and shared kits drive most of it, mapping them aims at the half of the problem that matters, instead of chasing artifacts one at a time. Which brings us back to the copy of you, out there on the internet, working under your name while you are the last to know. Finding the fake was only the start. The hard part is everything that comes after. This is where the modern internet can borrow from the ancient Greek tales, with Doppel serving as the Hercules to the scammers’ Hydra. Hercules did not win by swinging faster. He won by stopping the necks from sprouting new heads, searing each one shut before it could grow back. The takedown-by-takedown fight is the swinging. The win is an always-on social engineering defense: watching every surface at once and choking off the regrowth, so the heads stay gone. All figures come from Doppel’s Threat Graph and cover confirmed, analyst-validated brand impersonation across hundreds of brands over Q2 2025 through Q1 2026 (April 2025 to March 2026). The data is customer-anonymized, with raw volume counts withheld and shown as shares or indices. Coverage is impersonation only, across social media, paid ads, lookalike domains, mobile apps, marketplaces, messaging and telecom, and crypto and wallet services. Multi-surface figures are bounded by two factors: the brand population (Doppel-monitored brands with at least one confirmed impersonation in the window) and the surfaces counted per brand (only the surfaces monitored for that brand, per purchased modules). Both factors cap the published rate from above. The true multi-surface rate is very likely higher. Takedown outcome figures measure end-state removal (content and/or hosting no longer live) rather than formal per-request acceptance, across all threats with at least one takedown request filed in the window. Takedown time figures measure median time from filing to removal, calculated only over requests that resulted in removal, across all phishing/impersonation takedown requests filed in the window. Domain recurrence figures require the follow-on alert to be analyst-confirmed malicious (the same standard used elsewhere in this study), measured over a full 90-day post-removal observation window per domain. Domain age is measured from a domain’s registration date to first detection. Operators are grouped by shared technical fingerprints such as page code, tracking IDs, hosting, and kits. A few summary statistics were calculated by a16z from Doppel’s data. *This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit [https://a16z.com/investment-list/](https://a16z.com/investment-list/) for a full list of investments. Other important information can be found at [a16z.com/disclosures](http://a16z.com/disclosures). You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.*