What a lookalike scan finds on banks and fintech brands
On 28 October 2026 a LookalikeDomain.com scan of PayPal, Chase, Stripe, and Revolut found thousands of registered lookalikes. Hundreds can send mail. Here is what stood out.
Payment brands get copied because the payoff is direct: a password, a card, a “verify your account” click. On 28 October 2026 our LookalikeDomain.com scan checked paypal.com, chase.com, stripe.com, and revolut.com against live registrations in major domain endings.
The scan found 1,853 lookalikes of paypal.com, 1,490 of chase.com, 1,225 of stripe.com, and 967 of revolut.com. A registered neighbour, a name that can send mail, and a page that already speaks as the brand are three different things. The scan separates those signals. Calling a page a phishing kit still takes a person.
Mail is the path that reaches a customer first
Across the four brands, hundreds of lookalikes already had mail DNS. PayPal: 294. Chase: 662. Stripe: 490. Revolut: 399. Names with both mail and a website: 13, 162, 133, and 112 respectively. Chase and Revolut share ordinary English words, so other real businesses inflate the website counts the same way “crypto” and “kraken” do in other sectors.
For a security review, start with high-scoring names that combine a close spelling or a trusted keyword with mail. A parked page with mail ready is still worth a look. A quiet registration with neither mail nor a site can wait.
PayPal: Unicode, digits, and “support” cousins
xn--pypal-4ve.com is the Cyrillic-а spelling of paypal that encodes to punycode. DNS was active on the day of the scan. ASCII swaps sat beside it: paypa1.com and p4ypal.net can send mail.
Brand-plus-keyword names were thick on the ground. paypal-support.com had a website titled “Merchant Technical Support” and could send mail. paypal-secure.com, paypal-secure.net, paypal-secure.org, paypal-secure.biz, and secure-paypal.com all showed mail configured. paypal-account.com and update-paypal.com did too. That is the shape of a list a payments brand actually has to triage.
Chase, Stripe, and Revolut: the same playbook
On Chase, secure-chase.com and chase-billing.com scored high with mail configured. chase-fraud-support.com had mail and a “Coming Soon” page. Digit swaps such as ch4se.net and cha5e.com were parked with mail ready. Plenty of other hits were unrelated companies that happen to use the word chase. The scan surfaces them; a human still sorts bank risk from coincidence.
On Stripe, strlpe.com replaced i with l and redirected to stripe.com. support-stripe.com, update-stripe.com, stripe-update.com, and stripe-pay.com also redirected to the real Stripe site while showing mail capability. That may be defensive ownership, a forward someone set up, or something else. The scan shows the destination. Ownership still needs a person. Nearby, stripe-secure.com and pay-stripe.com answered on HTTPS with mail configured and parked for sale. stripeclosedmyaccount.com resolved to a default server page with mail on. Names like stripeaccountants.com are other businesses. They stay on the list so you can dismiss them with eyes open.
On Revolut, revoiut.com swapped l for i and could send mail through Microsoft 365. revolut-update.com and support-revolut.info showed “Coming Soon” with mail. revolut-pay.com and revolutaccountmail.com had mail configured without a finished site.
PayPal had the longest list of the four. Revolut had the shortest. Absolute size is not the same as abuse. The useful cut is close spellings, trusted keywords, and mail or a live page.
Of those names, 191 PayPal matches ranked high, 176 Chase, 304 Stripe, and 326 Revolut. High means a close spelling, a Unicode or digit swap, or the brand paired with a word such as pay, secure, support, or update.
How we counted
On 28 October 2026 our LookalikeDomain.com research scan searched live domain registrations in major endings. The brand is the label before the dot, so paypal.com is searched as paypal.
Every match was checked for DNS, mail, and a website. An SSL certificate only means the name answered on HTTPS. Impersonation still takes a closer human look at the page, the mail setup, and who operates the name.
If you run this on your own bank or fintech domain, start with mail-ready names and pages that already use your brand in the title. A free lookalike check shows the top of that list. Monitoring is what tells you when a new one appears next week.