# Pokémon Brand-Spoofing Campaign: 1,352 Lookalike Domains Ahead of 30th Anniversary

> BforeAI PreCrime Labs identified 1,352 lookalike domains impersonating the Pokémon brand, 85% registered March-May 2026 ahead of Pokémon's 30th Anniversary cycle, spanning credential harvesting, character-specific phishing, counterfeit merchandise, trading-card fraud, mobile app trojanization, illegal gambling, and cryptocurrency pump-and-dump schemes.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1520
- **ID:** TL-2026-1520
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BforeAI's PreCrime Labs published "Pokémon Brand Spoofing in 2026: Pre-Crime Analysis of 1,352 Lookalike Domains" on 2026-06-17, documenting a large, financially motivated brand-abuse campaign timed to Pokémon's 30th Anniversary. Registration volume spiked across Q2 2026 (401 domains in March, 378 in April, 376 in May — 85% of the total 1,352-domain set), consistent with opportunistic infrastructure staging ahead of anniversary-driven consumer attention, product launches, and trading-card releases.

The domains cluster into six primary abuse categories: credential harvesting (671 domains, 49.6%) using generic typosquats keyed to game launches; character-specific phishing (233 domains, 17.2%) weaponizing named Pokémon (Pikachu, Mewtwo, Charizard, Squirtle) as lure hooks for fake card sales and passes; e-commerce/counterfeit merchandise fraud (161 domains, 11.9%); trading-card-game (TCG) and card-grading fraud (154 domains, 11.4%) impersonating legitimate authentication/grading services; mobile app clones (86 domains, 6.4%) distributing trojanized APKs including Pokémon GO "hack"/spoofing tools; and fan-tool phishing (47 domains, 3.5%) impersonating Pokédex lookups and IV calculators.

Distinct regional/thematic clusters were identified: an Indonesia-based illegal gambling network (170+ domains) using systematically numbered Pikachu branding (pikachu168v1.com through v3) and Indonesian slang ("Gacor" — slot-machine hot streak) across .bet/.live/.sbs/.ink/.world TLDs; a Turkey-targeted geo-affiliate/PPC-fraud cluster (48 domains) following a [city]pikachu[number].click pattern across cities including Alanya, Fethiye, and Kayseri; a TCG/card-grading fraud ecosystem (62 domains) spanning counterfeit shops, wholesale fraud, and scalper tooling; a Pokémon GO spoofing-infrastructure cluster (34 domains) offering GPS-spoofing and coordinate-sharing tools with child-safety implications given the game's ~80M monthly active users; a cryptocurrency meme-coin cluster (7 domains) blending Pokémon characters with Solana-ecosystem tokens for pump-and-dump/rug-pull schemes; and a piracy/bot-infrastructure cluster (19 domains) offering ROM hacks and purchase bots that risk bundling malware with pirated content. A redirect chain was observed routing pokemonromhacks.com traffic through FIFA World Cup 2026 sports content into a fake antivirus-renewal scam, demonstrating traffic-monetization layering typical of malvertising redirector chains.

Registrar concentration favors GoDaddy LLC (191 domains), Namecheap Inc (158), Spaceship Inc (78), and Cloudflare Inc (60), with TLD distribution led by .com (673), followed by .net (78), .online (52), .xyz (52), .click (47), and specialty gTLDs (.vip, .bet, .app, .exposed, .lat). A distinct 6-domain sub-cluster using an "a1-" naming prefix is hosted on Aliyun infrastructure and targets Asian slot-gambling providers.

Separately, Bitdefender's Hot for Security (2026-02-26, author Alina Bîzgă) corroborates the trading-card-fraud vector: at least 477 reported Pokémon TCG scam cases since October 2025 totaling over $958,000 in losses, driven by pre-order fraud, fake marketplace seller accounts, counterfeit graded-card slabs mimicking legitimate grading companies, non-card merchandise scams (anniversary plushes/figurines), and credential-harvesting phishing emails — consistent with, and independently reported ahead of, the domain infrastructure BforeAI later mapped.

No CVE or software vulnerability underlies this threat; it is a brand-impersonation/social-engineering infrastructure campaign. At-risk populations include children (gambling sites using child-facing mascots, trojanized mobile apps), collectors (card fraud, investment scams), gamers (credential harvesting, app clones), and cryptocurrency investors (meme-coin rug pulls).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1036 Masquerading
- T1684.001 Impersonation
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1005 Data from Local System
- T1102 Web Service
- T1104 Multi-Stage Channels
- T1657 Financial Theft
- T1589 Gather Victim Identity Information

## Sources

- [Pokémon Brand Spoofing in 2026: Pre-Crime Analysis of 1,352 Lookalike Domains](https://bfore.ai/report/pokemon-brand-spoofing-2026-lookalike-domains/)
- [Pokémon card listing scams and how to avoid them in 2026](https://www.bitdefender.com/en-us/blog/hotforsecurity/pokemon-card-scams-2026)
- [How to Find Malicious Domains](https://bfore.ai/blog/how-to-find-malicious-domains/)
- [Fake Domains & Brand Abuse: Insights from the Domain Security Report](https://www.cscdbs.com/blog/fake-domains-real-damage-what-the-latest-data-reveals/)
- [Typosquatting: When Your Domain Is Used Against You](https://www.truesec.com/hub/blog/typosquatting-when-your-domain-is-used-against-you)
- [Website Spoofing in 2026: How to Detect and Take Down Fake Sites](https://www.brandshield.com/blog/website-spoofing-detection-take-down/)
- [Domain Impersonation Detection Guide 2026](https://www.marqvision.com/blog/domain-impersonation-brand-spoofing-detection)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1520