Big tech

Ionos lookalike domains

Greyphish has recorded 117 domains that resemble Ionos since September 2026, 117 of them in the last 90 days. Nearly all of them (91%) are typosquats, a keystroke or two away from the real name. .de carries 43% of them, out of 5 endings in all. The pace has picked up, with 108 in the last 30 days against 9 in the 30 before. The busiest week began 5 October 2026, with 44 new ones.

Data as of . Public sources only.

Lookalikes seen
117
since September 2026
Last 90 days
117
108 in the last 30 days
Endings
5
most on .de (43%)
Typosquats
91%
the most common kind

What kind of lookalikes

Typosquats106 (91%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Homoglyphs10 (9%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

TLD swaps1 (1%)

The brand name exactly, under a different ending.

Lookalikes per week

TypoHomoglyphTLD swap
22
44
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoHomoglyphTLD swapTotal
2026-04-200000
2026-04-270000
2026-05-040000
2026-05-110000
2026-05-180000
2026-05-250000
2026-06-010000
2026-06-080000
2026-06-150000
2026-06-220000
2026-06-290000
2026-07-060000
2026-07-130000
2026-07-200000
2026-07-270000
2026-08-030000
2026-08-100000
2026-08-170000
2026-08-240000
2026-08-310000
2026-09-078109
2026-09-14171018
2026-09-21172120
2026-09-28212023
2026-10-05422044
2026-10-121203

Endings

The 5 most used of the 5 top-level domains these lookalikes sit under.

EndingLookalikesShare
.de5042.7%
.com4235.9%
.co.uk1210.3%
.fr1210.3%
.uk10.9%

Where they are registered

For the 51 with a registrar in WHOIS (44% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy815.7%Retail
NameBright59.8%Retail
OVH59.8%Retail
Unstoppable Domains59.8%Retail
Cloudflare47.8%Retail
NAMECARE23.9%Retail
NICENIC INTERNATIONAL GROUP23.9%Retail
Namecheap23.9%Retail

What the live ones do

Google Web Risk lists none of the 5 live ones checked against it.

6 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Ionos; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • xn--oos-eib76c[.]com
    Shown in a browser as ɨoǹos[.]com
    Homoglyph, Oct 13No site or mail when checked
  • inos[.]com
    Typo, Oct 12Not checked
  • xn--onos-upa[.]de
    Shown in a browser as íonos[.]de
    Homoglyph, Oct 12Not checked
  • iunos[.]com
    Typo, Oct 10Not checked
  • iojnos[.]com
    Typo, Oct 9Not checked
  • ionoso[.]com
    Typo, Oct 9Not checked
  • iobos[.]de
    Typo, Oct 9Not checked
  • ionoos[.]de
    Typo, Oct 9Not checked
  • iinos[.]com
    Typo, Oct 8Not checked
  • ionols[.]de
    Typo, Oct 8Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Ionos. Domains listed resemble Ionos by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.