Island Maps 186 AI Lookalike Domains, Traces Malware Routes

Enterprise browser security company Island mapped 186 domains resembling 27 artificial intelligence brands and traced routes involving malware delivery and browser manipulation — a risk that begins with a mistyped address, not a confirmed infection.

Its inventory includes parked domains alongside those connected to malicious routes, so the 186 figure counts web addresses rather than people or infected devices. Island listed 25 lookalike domains for ChatGPT and 18 for Claude. DeepSeek had 16, Runway had 12, and Perplexity, Lovable and Character.ai had 11 each. The report’s count does not show how many visitors encountered or acted on any route.

Island’s research snapshot is dated Nov. 3, and its report was published Nov. 12. The snapshot date also applies to the reported total of declared users on related browser extension listings.

One route began at cloude[.]ai, a Claude lookalike. Island traced it to a fake Cloudflare verification page that prompted Windows visitors to paste and run a command. That command downloaded and launched a PowerShell script; Island documented the route but gave no count of people who ran it.

Island also linked eight AI typos to fake “Security Check” pages that led to Net Guard. The analyzed package matched the Microsoft Store package hash. Island’s analysis found that it could change browser search settings and run scripts supplied remotely.

Island traced a Perplexity lookalike, preplexity[.]ai, to a Chrome extension that it found replaced the browser’s default search provider with a third-party endpoint. Related extension listings displayed 972,000 declared users combined in the Nov. 3 snapshot. That store-listed total does not establish how many people encountered the campaign.

Island calls the broader pattern “TypoPrompting,” in which an AI brand lookalike turns a visit to a familiar service into a prompt to verify, install or run something else. The fake verification step follows the ClickFix tactic, which uses deceptive checks or error messages to persuade people to copy, paste and run commands. Having users run commands themselves can help campaigns get past conventional and automated defenses.