Over 1.5 million fraudulent online domains have been identified over the past year, according to newly published data from Israeli cybersecurity company BrandShield.
Among the millions of fake listings, 10,395 were associated with El Al, and 1,165 listings sold products while impersonating the Hostages and Missing Families Forum.
On an international scale, the situation is no better: more than 10,000 fake domains and websites claiming to be associated with FIFA were identified ahead of the 2026 World Cup, along with 4,800 listings impersonating Elon Musk.
Major brands have also become prime targets.
BrandShield also identified 5,878 fake or suspicious domains involving the luxury Swiss watch brand Omega SA, alongside 5,134 linked to NIKE, 4,987 to Labubu, and 4,041 to Apple’s iPhone.
"Attackers go where public trust lies," said Yoav Keren, CEO of BrandShield. “It could be a government agency, an airline, a well-known brand, or a celebrity. The more recognizable the name, the easier it is to convince the victim that the communication is legitimate.”
At the same time, fraud methods have also become more sophisticated.
For example, in a campaign impersonating the “Israel Traffic Authority,” SMS messages were sent claiming that the recipient owed 100 shekels for a traffic fine.
As the victim entered their information, hackers could see what was being entered into the website in real time and monitor their actions throughout.
AI makes building fake websites easy
Artificial intelligence and online website-building tools made the process easy, BrandShield showed.
In a test conducted by the cybersecurity company, the company found that fake businesses could be set up in about 5 minutes using AI tools and website builders, complete with a name, logo, staff members, testimonials, photos, and a phone number.
The test showed that fraudulent websites could be easily created for any sector: from banks and government agencies to plumbers and locksmiths looking for work.
Once created, they are easy to manipulate, allowing hackers to collect an individual's personal data or charge for a service that will never be provided.
Earlier this year, BrandShield successfully uncovered a network operating out of Hong Kong that ran a website selling counterfeit medications worldwide while impersonating healthcare organizations.
According to Keren, the combination of AI, rapid website creation, and systems that allow scammers to manage fraud in real time is expected to make combating the rising phenomenon even more challenging in the coming year.
“AI is mainly changing the scale of the problem,” said Keren. “What previously required knowledge, time, and money can now be produced within minutes and replicated over and over again.”