Productivity

Bluehost lookalike domains

Greyphish has recorded 67 domains that resemble Bluehost since February 2026, 16 of them in the last 90 days. Most of them (66%) are typosquats, a keystroke or two away from the real name. .com carries 94% of them, out of 5 endings in all. The pace has picked up, with 11 in the last 30 days against 1 in the 30 before. 9 certificates for unregistered .com.ph, .ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
67
since February 2026
Last 90 days
16
11 in the last 30 days
Endings
5
most on .com (94%)
Serve a website
54%
of 13 checked; 100% publish MX

What kind of lookalikes

Typosquats44 (66%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Combosquats22 (33%)

The brand spelled correctly with a word added, such as login or support. More

Homoglyphs1 (1%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Words most often added to the name in the last 90 days: web (6), support (3).

Lookalikes per week

TypoComboHomoglyph
3
6
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-200000
2026-04-272002
2026-05-040101
2026-05-110000
2026-05-180000
2026-05-251001
2026-06-010000
2026-06-080101
2026-06-150000
2026-06-220000
2026-06-291001
2026-07-062013
2026-07-131001
2026-07-202002
2026-07-271102
2026-08-030000
2026-08-100000
2026-08-170101
2026-08-240000
2026-08-310000
2026-09-070000
2026-09-140000
2026-09-211001
2026-09-281102
2026-10-050606
2026-10-120202

Endings

The 5 most used of the 5 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com6394.0%
.com.au11.5%
.me11.5%
.net11.5%
.xyz11.5%

Where they are registered

For the 56 with a registrar in WHOIS (84% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy1730.4%Retail
Above.com916.1%Retail
Network Solutions58.9%Retail
Dynadot35.4%Retail
Hostinger35.4%Retail
Internet Domain Service BS35.4%Retail
Namecheap23.6%Retail
Spaceship23.6%Retail

What the live ones do

13 of these lookalikes were registered and checked for a website and mail: 7 (54%) served a website and 13 (100%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists none of the 6 live ones checked against it.

7 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Bluehost; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • bluehostwebsolutions[.]com
    Combo, Oct 14Serves a websiteMX records
  • bluehostwebsecurity[.]com
    Combo, Oct 14Serves a websiteMX records
  • bluehosthelpdesk[.]com
    Combo, Oct 9MX records
  • bluehostsupportsucks[.]com
    Combo, Oct 8Not checked
  • bluehostwebteam[.]com
    Combo, Oct 6Serves a websiteMX records
  • bluehostsupporthub[.]com
    Combo, Oct 6MX records
  • bluehostwebservers[.]com
    Combo, Oct 6Not checked
  • bluehostwebmail[.]com
    Combo, Oct 5MX records
  • bluehostweblab[.]com
    Combo, Oct 3MX records
  • blluehost[.]com
    Typo, Oct 1Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Bluehost. Domains listed resemble Bluehost by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.