Productivity

Intercom lookalike domains

Greyphish has recorded 80 domains that resemble Intercom since February 2026, 9 of them in the last 90 days. They split between typosquats (48%) and combosquats (44%). .com carries 72% of them, out of 19 endings in all. 3 certificates for unregistered .com.ph, .ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
80
since February 2026
Last 90 days
9
3 in the last 30 days
Endings
19
most on .com (73%)
Serve a website
79%
of 14 checked; 79% publish MX

What kind of lookalikes

Typosquats38 (48%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Combosquats35 (44%)

The brand spelled correctly with a word added, such as login or support. More

Homoglyphs7 (9%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Lookalikes per week

TypoComboHomoglyph
3
6
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-204206
2026-04-270101
2026-05-040101
2026-05-110101
2026-05-180101
2026-05-251102
2026-06-010000
2026-06-081102
2026-06-153003
2026-06-221012
2026-06-290000
2026-07-063003
2026-07-131001
2026-07-201102
2026-07-271001
2026-08-031001
2026-08-100000
2026-08-170000
2026-08-240011
2026-08-310000
2026-09-070000
2026-09-140000
2026-09-210000
2026-09-280101
2026-10-050202
2026-10-120000

Endings

The 8 most used of the 19 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com5872.5%
.ru33.8%
.com.au22.5%
.nl22.5%
.ca11.3%
.cc11.3%
.ch11.3%
.cloud11.3%

Where they are registered

For the 51 with a registrar in WHOIS (64% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy1529.4%Retail
NameBright713.7%Retail
Amazon23.9%Retail
Dreamscape Networks International23.9%Retail
Dynadot23.9%Retail
Nicreg23.9%Retail
PDR23.9%Retail
Alibaba Cloud12.0%Retail

What the live ones do

14 of these lookalikes were registered and checked for a website and mail: 11 (79%) served a website and 11 (79%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

2 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Intercom; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • intercomhelpcenter[.]com
    Combo, Oct 11Not checked
  • tv-intercomcenter-rheinmain-website[.]de
    Combo, Oct 9MX records
  • intercomservice[.]com
    Combo, Oct 1No site or mail when checked
  • interc0m[.]com
    Homoglyph, Aug 27Not checked
  • intercol[.]com
    Typo, Aug 6Not checked
  • intercomi[.]com
    Typo, Jul 29Not checked
  • myintercom[.]co[.]za
    Combo, Jul 20Not checked
  • intercom1[.]com
    Typo, Jul 20Not checked
  • interfom[.]com
    Typo, Jul 16Not checked
  • ntercom[.]com
    Typo, Jul 9Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Intercom. Domains listed resemble Intercom by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.