Telecoms

Deutsche Telekom lookalike domains

Greyphish has recorded 77 domains that resemble Deutsche Telekom since February 2026, 12 of them in the last 90 days. They split between combosquats (58%) and typosquats (35%). .com carries 53% of them, out of 21 endings in all. The pace has picked up, with 5 in the last 30 days against 3 in the 30 before. 22 certificates for unregistered .com.ph, .ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
77
since February 2026
Last 90 days
12
5 in the last 30 days
Endings
21
most on .com (53%)
Serve a website
73%
of 11 checked; 55% publish MX

What kind of lookalikes

Combosquats45 (58%)

The brand spelled correctly with a word added, such as login or support. More

Typosquats27 (35%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Homoglyphs5 (6%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Lookalikes per week

TypoComboHomoglyph
2
4
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-202114
2026-04-270000
2026-05-040000
2026-05-111102
2026-05-180000
2026-05-250000
2026-06-010101
2026-06-081102
2026-06-150101
2026-06-221001
2026-06-290000
2026-07-061102
2026-07-130101
2026-07-202002
2026-07-271001
2026-08-030000
2026-08-100000
2026-08-170000
2026-08-240000
2026-08-310000
2026-09-071113
2026-09-140000
2026-09-210202
2026-09-280202
2026-10-050101
2026-10-120000

Endings

The 8 most used of the 21 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com4153.3%
.de1114.3%
.at22.6%
.info22.6%
.net22.6%
.ru22.6%
.tel22.6%
.tk22.6%

Where they are registered

For the 40 with a registrar in WHOIS (52% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
NameBright922.5%Retail
GoDaddy512.5%Retail
Dynadot37.5%Retail
Deutsche Telekom25.0%Retail
Internet Domain Service BS25.0%Retail
Namecheap25.0%Retail
Tucows25.0%Retail
Aceville12.5%Retail

What the live ones do

11 of these lookalikes were registered and checked for a website and mail: 8 (73%) served a website and 6 (55%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists none of the 3 live ones checked against it.

3 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Deutsche Telekom; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • telekomcenterathens[.]gr
    Combo, Oct 11Serves a websiteMX records
  • telekomweboldalam[.]hu
    Combo, Oct 4Serves a websiteMX records
  • get-telekom[.]ru
    Combo, Oct 4MX records
  • telekom-online-vertrag[.]de
    Combo, Sep 23Not checked
  • realtelekom[.]com
    Combo, Sep 22Not checked
  • telekolm[.]com
    Typo, Sep 13Not checked
  • telekonm[.]com
    Homoglyph, Sep 12Not checked
  • telekom-login[.]cyou
    Combo, Sep 9Not checked
  • telekmo[.]com
    Typo, Jul 27Not checked
  • elekom[.]com
    Typo, Jul 25Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Deutsche Telekom. Domains listed resemble Deutsche Telekom by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.