Typosquatting campaign

Registering a domain that contains a real product's name, then building a storefront on it that looks official — API docs, a playground, checkout — to capture the traffic a fresh product launch attracts before the real vendor's own SEO catches up. The spoke's first source on this pattern is gbhackers-jev-clone-domains: about 670 "jev"-containing domains picked up TLS certificates within eight days of TypeSafe AI's Jev launch, several running as unofficial resellers that proxy to the real API while overcharging 6–11.5x and routing customer prompts through an undisclosed third party.

Why it works against a new AI product specifically

A launch creates a short window where the product is well known but its own site has not yet built search authority — Eye Security's tracked clone outranked typesafe.ai itself for "Jev AI." The same window exists for the vendor's brand name alone, not just the product ("typesafe" domains, ~40 in six days). Because the clones proxy to the genuine API rather than faking a response, a technically savvy buyer can be fooled too: the answers are real, only the bill and the routing are not.

Recognisable shape (from the one campaign held)

• Registered within days of a public launch, not before it.
• Cloned checkout/docs/playground rather than a bare landing page.
• Markup on a wholesale-priced API, not credential theft — the immediate harm is financial and a data-exposure risk (prompts crossing an unvetted third party), not account takeover.
• A non-affiliation disclaimer present but placed to be missed.
• Shared registrar/CDN/code fingerprints across a small cluster of sites, suggesting one operator running the same template repeatedly rather than many independent actors.

Defensive response (from the one source held)

Verify a vendor link from the vendor's own announcement, not a search result; check a domain's registration and TLS-issuance dates before trusting it; compare price to the vendor's published rate; treat an unbranded intermediary with no stated legal entity, security documentation or SLA as a supply-chain risk. No source here yet covers the SOC side — automated brand-monitoring, certificate transparency-log watching, or takedown process — only the end-user-facing checklist.

Open

One campaign, one report, no base rate for how often a launch draws this. Whether this generalises beyond AI-product launches (it plainly does for other categories — this is the same shape as classic software/crypto-exchange typosquatting) is unheld here; scope this page to what has actually landed rather than assume.

Related

gbhackers-jev-clone-domains · eye-security · typesafe-ai (../llm-providers-wiki) · security-operations-center