Security

Authy lookalike domains

Greyphish has recorded 48 domains that resemble Authy since February 2026, 5 of them in the last 90 days. Most of them (85%) are typosquats, a keystroke or two away from the real name. .com carries 94% of them, out of 4 endings in all.

Data as of . Public sources only.

Lookalikes seen
48
since February 2026
Last 90 days
5
2 in the last 30 days
Endings
4
most on .com (94%)
Typosquats
85%
the most common kind

What kind of lookalikes

Typosquats41 (85%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Combosquats6 (13%)

The brand spelled correctly with a word added, such as login or support. More

Homoglyphs1 (2%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Lookalikes per week

TypoCombo
2
3
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboTotal
2026-04-20303
2026-04-27000
2026-05-04011
2026-05-11000
2026-05-18000
2026-05-25101
2026-06-01202
2026-06-08000
2026-06-15202
2026-06-22000
2026-06-29202
2026-07-06000
2026-07-13000
2026-07-20000
2026-07-27000
2026-08-03000
2026-08-10011
2026-08-17101
2026-08-24000
2026-08-31011
2026-09-07000
2026-09-14000
2026-09-21000
2026-09-28101
2026-10-05011
2026-10-12000

Endings

The 4 most used of the 4 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com4593.8%
.cc12.1%
.org12.1%
.website12.1%

Where they are registered

For the 43 with a registrar in WHOIS (90% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy818.6%Retail
Dynadot37.0%Retail
Namecheap37.0%Retail
GMO Internet Group24.7%Retail
Hostinger24.7%Retail
NameBright24.7%Retail
OpusDNS24.7%Retail
Spaceship24.7%Retail

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Authy; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • authyapp[.]website
    Combo, Oct 10Not checked
  • authyo[.]com
    Typo, Oct 2Not checked
  • app-accounts-authy[.]org
    Combo, Sep 3Not checked
  • outhy[.]com
    Typo, Aug 17Not checked
  • verifyauthy[.]com
    Combo, Aug 16Not checked
  • ajthy[.]com
    Typo, Jul 4Not checked
  • iuthy[.]com
    Typo, Jul 1Not checked
  • sauthy[.]com
    Typo, Jun 17Not checked
  • auhy[.]com
    Typo, Jun 17Not checked
  • aathy[.]com
    Typo, Jun 7Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Authy. Domains listed resemble Authy by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.