Apple lookalike domains
Greyphish has recorded 2,026 domains that resemble Apple since February 2026, 545 of them in the last 90 days. Nearly all of them (93%) are combosquats: Apple's name or one of its product names spelled correctly with a word added, most often “support”, “service”, “help”. No single ending dominates: they are spread over 186, led by .com and .info. The pace has picked up, with 251 in the last 30 days against 136 in the 30 before. The busiest week began 5 October 2026, with 101 new ones. 1,161 certificates for unregistered .ph, .com.ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Data as of . Public sources only.
What kind of lookalikes
One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More
A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More
Words most often added to the name in the last 90 days: support (106), service (46), help (34), account (31), login (27), verify (20).
Lookalikes per week
Show as a table
| Week of | Typo | Combo | Homoglyph | Total |
|---|---|---|---|---|
| 2026-04-20 | 3 | 71 | 0 | 74 |
| 2026-04-27 | 1 | 32 | 0 | 33 |
| 2026-05-04 | 0 | 20 | 0 | 20 |
| 2026-05-11 | 1 | 29 | 0 | 30 |
| 2026-05-18 | 2 | 19 | 1 | 22 |
| 2026-05-25 | 0 | 26 | 0 | 26 |
| 2026-06-01 | 2 | 35 | 0 | 37 |
| 2026-06-08 | 0 | 25 | 0 | 25 |
| 2026-06-15 | 0 | 18 | 0 | 18 |
| 2026-06-22 | 1 | 20 | 4 | 25 |
| 2026-06-29 | 1 | 36 | 34 | 71 |
| 2026-07-06 | 3 | 51 | 0 | 54 |
| 2026-07-13 | 1 | 38 | 1 | 40 |
| 2026-07-20 | 1 | 37 | 1 | 39 |
| 2026-07-27 | 1 | 37 | 2 | 40 |
| 2026-08-03 | 1 | 35 | 0 | 36 |
| 2026-08-10 | 0 | 28 | 0 | 28 |
| 2026-08-17 | 1 | 35 | 1 | 37 |
| 2026-08-24 | 0 | 44 | 0 | 44 |
| 2026-08-31 | 0 | 16 | 0 | 16 |
| 2026-09-07 | 0 | 33 | 0 | 33 |
| 2026-09-14 | 0 | 30 | 0 | 30 |
| 2026-09-21 | 0 | 22 | 1 | 23 |
| 2026-09-28 | 1 | 57 | 0 | 58 |
| 2026-10-05 | 1 | 100 | 0 | 101 |
| 2026-10-12 | 0 | 41 | 0 | 41 |
Endings
The 8 most used of the 186 top-level domains these lookalikes sit under.
| Ending | Lookalikes | Share |
|---|---|---|
| .com | 686 | 33.9% |
| .info | 114 | 5.6% |
| .ru | 112 | 5.5% |
| .us | 80 | 4.0% |
| .help | 58 | 2.9% |
| .net | 45 | 2.2% |
| .co | 41 | 2.0% |
| .org | 38 | 1.9% |
Where they are registered
For the 758 with a registrar in WHOIS (37% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| Sav | 101 | 13.3% | Retail |
| GoDaddy | 76 | 10.0% | Retail |
| Hosting Concepts | 55 | 7.3% | Retail |
| Dynadot | 54 | 7.1% | Retail |
| NameSilo | 44 | 5.8% | Retail |
| OwnRegistrar | 40 | 5.3% | Retail |
| Cloudflare | 33 | 4.3% | Retail |
| NICENIC INTERNATIONAL GROUP | 29 | 3.8% | Retail |
What the live ones do
541 of these lookalikes were registered and checked for a website and mail: 252 (47%) served a website and 184 (34%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
Google Web Risk lists 5 of the 168 live ones checked against it (3%).
181 were tracked while live and 10 have since gone down, a median 2d 21h after they were first seen. See what to do about a lookalike.
Recent examples
The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Apple; it is not necessarily malicious, and none of these is a claim about who registered it or why.
appleapphunt[.]comCombo, Oct 14Serves a websiteMX recordsappleid-support[.]frCombo, Oct 14Not checkedicloudunlock-deluxe[.]infoCombo, Oct 14MX recordsgetapple[.]cnCombo, Oct 14No site or mail when checkedappledeliverybrasilia[.]com[.]brCombo, Oct 14Serves a websiteMX recordsapplesupport247[.]comCombo, Oct 14Serves a websiteappleapple[.]irCombo, Oct 14Not checkedicloudapple[.]comCombo, Oct 14No site or mail when checkedmyapple-tv[.]comCombo, Oct 13Not checkedapple65helpcenter[.]comCombo, Oct 13Serves a website
Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.
Further reading
More in big tech
Greyphish is not affiliated with Apple. Domains listed resemble Apple by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.