Jev AI lookalike domains surge after launch, UpGuard warns

UpGuard has identified a surge in lookalike web domains linked to the AI model Jev. It found 167 similar domains were registered in the 13 days after the model's launch.

The findings focus on Jev, an AI model from TypeSafe that UpGuard said had been adopted by 25% of Fortune 500 companies since its release.

According to UpGuard's research, some websites branded as "Jev AI" sit between users and TypeSafe's real product, relaying requests onwards. That allows their operators to capture prompts, files and API keys while still returning working answers.

Because the service appears to function normally, the sites are harder for users to detect, the research said. UpGuard also found that 24 of the lookalike domains had mail servers configured, creating scope for phishing emails, fake invoices or messages intended for Jev being diverted elsewhere.

Fast uptake

TypeSafe launched Jev in limited early access as a model designed to answer fixed categories of questions rather than generate open-ended text. The system returns typed answers with a confidence estimate, a format intended for software workflows that need set outputs such as yes-or-no responses, rankings or classifications.

UpGuard said Jev's first lookalike domain, jev.quest, was registered the day after the model was announced. By the end of the monitoring period, the total had reached 167, with most registrations using the exact name "jev" across different top-level domains.

The research tracked newly registered domains over 46 days and tested whether names resembling Jev, Jevai and TypeSafe resolved in the domain name system and had been set up to receive mail. It flagged exact brand matches on other extensions, typographical variants, lookalike characters and longer names that embedded the brand.

Most of the 166 domains using the exact "jev" name appeared across distinct extensions, including both credible technology-related endings and more obscure ones. UpGuard said that suggested automated bulk buying, likely aimed at resale or traffic capture rather than direct impersonation in every case.

Higher-risk names

More concerning activity appeared in domains using "jevai" and "TypeSafe", where the names were framed to look more plausible to users. UpGuard pointed to examples such as jev-support-style domains and hyphenated variations, including "jev-ai" registrations on multiple extensions.

Several of these sites sat behind Cloudflare, according to the research, and some had Cloudflare Email Routing configured. One domain combining the product and company names was configured for inbound mail through Amazon SES.

Across the three search terms, UpGuard found 24 domains with functioning mail infrastructure that it said had been deliberately configured. Only two of those appeared in the direct "jev" scan, leading UpGuard to conclude that while the volume sat under Jev, stronger signs of intent appeared under Jevai- and TypeSafe-related names.

The study also compared Jev with other AI brands. UpGuard said Jev attracted lookalike registrations at about twice the daily rate of Claude and roughly two and a half times the rate of ChatGPT during the period tracked. Jev recorded 13 new domains a day, compared with 6.7 for Claude and 5.4 for ChatGPT.

The data suggested product names generally attract more impersonation than company names. In UpGuard's sample, names users were more likely to type, such as Claude, ChatGPT and Gemini, drew far more registrations than the company names behind them.

Fraud risks

The timing reflects a familiar pattern in online fraud, the research said, in which a fast-rising brand becomes a target before it has secured enough of the surrounding web domain space. A domain can be registered cheaply and quickly, giving cyber criminals or speculators an immediate opening when public interest spikes.

That creates particular risks for AI products because users signing up often create accounts, enter payment details and generate API keys that can be used for sustained access. A convincing fake sign-up page can therefore yield both personal data and working credentials.

UpGuard also warned that lookalike domains can be used as outbound tools rather than passive traps. Mail-enabled addresses can send support messages, invoices, recruitment approaches or warnings about expiring API keys from domains that appear close to the real brand.

Another risk lies in API integrations themselves. If a user or developer connects to a lookalike hostname that proxies traffic to the real service, the interaction may continue to work while the intermediary records each prompt, response and key.

"The window in which a brand becomes worth impersonating opens before the brand is ready to defend it, and attempts at impersonation flourish during times of massive public attention," UpGuard said.