Banking and payments

Barclays lookalike domains

Greyphish has recorded 99 domains that resemble Barclays since February 2026, 24 of them in the last 90 days. They split between combosquats (60%) and typosquats (35%). .com carries 68% of them, out of 20 endings in all. The pace has slowed, with 6 in the last 30 days against 10 in the 30 before. 126 certificates for unregistered .ph, .com.ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
99
since February 2026
Last 90 days
24
6 in the last 30 days
Endings
20
most on .com (68%)
Serve a website
64%
of 11 checked; 45% publish MX

What kind of lookalikes

Combosquats59 (60%)

The brand spelled correctly with a word added, such as login or support. More

Typosquats35 (35%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Homoglyphs5 (5%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Words most often added to the name in the last 90 days: center (3), help (3).

Lookalikes per week

TypoComboHomoglyph
4
8
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-202103
2026-04-271203
2026-05-040000
2026-05-110000
2026-05-181203
2026-05-250213
2026-06-010303
2026-06-080101
2026-06-150000
2026-06-220101
2026-06-290101
2026-07-062518
2026-07-130000
2026-07-201203
2026-07-270000
2026-08-030202
2026-08-104105
2026-08-170000
2026-08-241001
2026-08-311102
2026-09-070505
2026-09-140000
2026-09-210000
2026-09-280101
2026-10-050303
2026-10-120202

Endings

The 8 most used of the 20 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com6767.7%
.org55.1%
.co.uk44.0%
.online44.0%
.help22.0%
.info22.0%
.net22.0%
.care11.0%

Where they are registered

For the 59 with a registrar in WHOIS (60% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy1627.1%Retail
Media Elite Holdings58.5%Retail
Dynadot46.8%Retail
Hostinger46.8%Retail
Alibaba Cloud23.4%Retail
CSC23.4%Brand protection
Cloudflare23.4%Retail
PDR23.4%Retail

What the live ones do

11 of these lookalikes were registered and checked for a website and mail: 7 (64%) served a website and 5 (45%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists 2 of the 6 live ones checked against it.

6 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Barclays; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • barclays-support[.]com
    Combo, Oct 12Listed by Google Web RiskNo site or mail when checked
  • barclayscenterbrooklyn[.]com
    Combo, Oct 12Serves a websiteMX records
  • barclayscenterpremium[.]com
    Combo, Oct 11Listed by Google Web RiskServes a website
  • barclayscentersuites[.]com
    Combo, Oct 10Serves a websiteMX records
  • barclaysappl[.]com[.]au
    Combo, Oct 8Serves a websiteMX records
  • barclays-online[.]co[.]uk
    Combo, Sep 11Not checked
  • officialbarclays[.]com
    Combo, Sep 11Not checked
  • barclayshelp[.]net
    Combo, Sep 9Not checked
  • barclays-login[.]co[.]uk
    Combo, Sep 8Not checked
  • barclays-verify[.]co[.]uk
    Combo, Sep 8Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Barclays. Domains listed resemble Barclays by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.