Reading the 2026 gTLD list for lookalike-domain risk

The 2026 new gTLD list contains about two dozen generic strings that read like the parts of a login page, including .login, .verified, .official, .auth and .wallet, and none of them can be used for a lookalike domain yet. They are applications, not live top-level domains. Nobody can register yourbrand.login until a string passes evaluation, gets a contract and is delegated, and ICANN has published no date for that.

So the risk is real but not immediate, and it arrives on two separate clocks. One clock is running now and ends in March 2027: it decides which strings exist. The other starts when each TLD launches: it decides who gets the names inside it. The two are easy to mix up, and that leads to spending money at the wrong time.

What ICANN published on 7 October

ICANN’s Reveal Day announcement lists 1,615 applications for the 2026 round, including 333 brand applications, 16 community applications and 15 self-identified geographic names. Those numbers are a snapshot. Applicants could swap in a pre-declared replacement string until 21 October 2026, 23:59 UTC, and the final list will be confirmed on String Confirmation Day, 17 November 2026.

The dates that matter for brand owners:

• 17 November 2026: String Confirmation Day. The list stops changing and the comment period opens.
• 17 November 2026 to 16 March 2027: Community Input and Objections Period, with ICANN’s office closure from 19 December to 4 January already added in.
• First half of 2027: the Prioritization Draw, after a String Evaluation stage ICANN expects to take 180 days.

The internal-name side of the same round, where an applied-for string collides with a suffix your company uses inside its own network, is covered in the 2026 gTLD round and internal name collisions. This post is about the outside world: strings someone else could use to imitate you.

The phishing-shaped strings in the 2026 list

We pulled the full application export from ICANN’s application system on 21 October 2026, kept the active applications that are not replacement strings, and looked for generic words a phishing page would want in its address. These are the ones that turned up. None is flagged as a brand or community application, which means each is planned as a TLD that sells names to others.

Several common phishing words are absent: secure, support, help, bank, pay, verify, password and sso have no active application. That does not make them safe. Some already exist from the 2012 round, and one of them, .help, is the best preview of what a word-shaped TLD looks like once it is open.

What .help already looks like

The Cybercrime Information Center’s phishing ranking for May 2025 to April 2026 lists .help with 18,715 phishing domains out of 176,801 registered, a phishing domain score of 1,058.5. The same table gives .com a score of 53.7. .help is a 2012-round TLD with an ordinary, helpful-sounding name, and it ranks seventh on that list.

Interisle’s Phishing Landscape 2025 report explains why. In its words, "New gTLDs now represent 11% of the market and 51% of phishing domains reported", up from 9% and 21% in 2021, and "nearly all phishing-related DNS abuse is concentrated in new gTLDs with unrestricted registration policies." It found that 18 new gTLDs in its set offered non-promotional registrations for under US$2, and that those cheap TLDs generally had the highest phishing scores. Nearly 37% of phishing domains in its data were registered in bulk.

Our read of that data: price and openness drive abuse more than the string itself. A .login run as a strict, expensive registry would be a poor tool for phishers. A .login sold for a dollar in bulk would look a lot like .help. Which one we get will not be known until launch.

Check whether anyone applied for your name

The TLD string itself only matters to you if it matches or closely imitates your mark. The export is public, so this takes a minute. Download it:

curl -s -X POST 'https://newgtldprogram-aps.icann.org/aps/applications/export/csv' \
  -H 'Content-Type: application/json' \
  -d '{"searchAndFilter":{},"sort":{"field":"primaryString","direction":"ASC"},"pagination":{"pageNum":0,"pageSize":5000}}' \
  | tail -n +3 > apps.csv

Then filter it. This keeps active, non-replacement applications and prints any string that contains your term:

import csv

rows = [r for r in csv.DictReader(open('apps.csv', encoding='utf-8-sig'))
        if r['Application Status'] == 'Active'
        and r['Application Type'] != 'Replacement String']
print(len(rows), 'active applications')
for r in rows:
    if 'login' in r['Primary String']:  # put your brand here
        print(r['Primary String'], '|', r['Applicant Name'], '| brand:', r['TLD Type: Brand'])

Output for login on 21 October 2026:

1614 active applications
login | ECHO Domain Co L.L.C. | brand: FALSE

The export gives 1,614 such rows, one fewer than ICANN’s published 1,615. ICANN’s number is the one to quote; the difference does not change a string search. Search for your brand, obvious misspellings and your product names. For almost every company the answer is no match, and the TLD-level clock needs nothing from you.

What you can do before 16 March 2027

If a string does match your mark, the 2026 Applicant Guidebook gives two routes. Its Module 4 says comments count if received in the 104 days after String Confirmation Day, and that objections can be filed on four grounds: String Confusion, Legal Rights, Limited Public Interest and Community.

The one built for brands is the Legal Rights Objection, for "a party with standing that believes that an applied-for gTLD string ... infringes their existing legal rights". It is about the TLD string itself. You cannot use it to object to .login because someone might later register yourbrand.login. That is a second-level problem, and it belongs to the other clock.

What waits until each TLD launches

Lookalikes like yourbrand-support.verified only become possible when a TLD opens second-level registration. ICANN publishes no date for that. The steps in between are String Evaluation, the Prioritization Draw, contracting and delegation; the 2026 Base Registry Agreement gives a registry 12 months from signing, extendable, to get the TLD delegated into the root zone. Adding those up, our estimate is late 2027 at the earliest for the first launches, and later for most.

At launch, the rights protection mechanisms come from ICANN’s Trademark Clearinghouse Requirements:

• Sunrise: trademark holders registered in the Trademark Clearinghouse (TMCH) get first access for at least 30 days (start-date sunrise) or 60 days (end-date sunrise) before general registration.
• Claims: for at least the first 90 days of general registration, anyone registering a name that matches a trademark record sees a Claims Notice. The requirements say plainly that the registrant "may complete the domain name registration following the receipt of a Claims Notice". It warns; it does not block.
• Brand TLDs: Specification 13 of the registry agreement exempts .Brand registries from running Sunrise or Claims. That is fine, because a closed brand TLD does not sell names to strangers.

Both Sunrise and Claims work on matches to your trademark record, and both are time-boxed. After Claims ends, the TMCH’s Ongoing Notifications service keeps emailing you when a matching name is activated in a new gTLD, and you can add variation labels (containing, partial and similar) at no extra charge. It only covers new gTLDs, and it only notifies.

There is a catch that the TMCH itself has written about. In its August 2026 note on inactive records, it says "nearly one in three matching domain name registrations went unreported to trademark holders, often due to records being expired, deactivated, or otherwise invalid". A record that lapses quietly gives you no Sunrise, no Claims match and no notification.

Our take: buy nothing now, fix your record

There is nothing to buy in the 2026 round today, and no defensive registration to plan until a registry publishes its launch dates and prices. The useful work in the next five months is smaller. If you already have a TMCH record, confirm it is active and verified, and add variation labels for Ongoing Notifications. If you do not have one, decide whether you want one before the first Sunrise opens, not during it.

Where this falls short: none of this does much where lookalike phishing already happens. A lookalike in .com or a country-code TLD is outside every mechanism above. In a 2012-round TLD like .help, Sunrise and Claims ended years ago, and only Ongoing Notifications is left. Every one of the 1,542,922 phishing domains in Interisle’s 2024-2025 data sat in a TLD that already exists, and 8.9% of them contained a prominent brand name spelled exactly.

When you do find a lookalike, in any TLD, the first step is the registrar’s abuse contact. A domain lookup shows the registrar and its abuse contact for the name. For new gTLDs under the 2026 agreement, Specification 11 also puts a duty on the registry: where it "reasonably determines, based on actionable evidence" that a name is used for DNS abuse, which includes phishing, it "must promptly take the appropriate mitigation action(s)". A report with screenshots, timestamps and the URL is that evidence.

Watching your own domains is a different job from watching for other people’s. The difference is laid out in do you need domain monitoring, and the threat to the domains you already own is covered in how to detect domain hijacking.