Hackers are impersonating your brand.

On August 2, 2026, we read the public record for one question: who is standing on the PopSockets name. This is what we found. Take it one finding at a time.

domains are wearing your name.

We tested 197 close variations of popsockets.com. Twenty-five are registered. Four are your own defensive registrations. The other twenty-one belong to someone else.

Seven of them can email your customers as you.

These domains have live mail servers. That means each one can already send an "order confirmation," a "refund," or a "support" message from an address that looks like yours. This is the staging ground for a phishing run, not parked junk.

Four were built by one operator, in a single week.

These four were all registered at the same registrar, Dynadot, between July 1 and July 5, 2025, and every one carries the same live mail setup. That is not scattered squatting. It is one actor standing up a kit.

And the attack is accelerating.

Opportunistic typo-squats a decade ago. The coordinated cluster in mid-2025. A working storefront clone registered 27 days ago. The problem is not static. It compounds.

One is selling under your name, with your photos.

popsockets.site

A live storefront titled "Popsockets," serving your own licensed product photography, the Netflix One Piece collaboration, to take orders under your name.

RegistrarHostinger operations, UAB

Registered2026-07-07 · 27 days ago

Abuse contactabuse@hostinger.com

UDRP postureStrong · identical mark + your imagery

One quietly sells your mistyped traffic.

Every domain. Click one to understand it.