Security

Kaspersky lookalike domains

Greyphish has recorded 74 domains that resemble Kaspersky since February 2026, 6 of them in the last 90 days. Most of them (61%) are typosquats, a keystroke or two away from the real name. .com carries 77% of them, out of 10 endings in all. 33 certificates for unregistered .ph, .com.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
74
since February 2026
Last 90 days
6
1 in the last 30 days
Endings
10
most on .com (77%)
Typosquats
61%
the most common kind

What kind of lookalikes

Typosquats45 (61%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Combosquats28 (38%)

The brand spelled correctly with a word added, such as login or support. More

Homoglyphs1 (1%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Lookalikes per week

TypoCombo
3
5
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboTotal
2026-04-20101
2026-04-27000
2026-05-04101
2026-05-11000
2026-05-18101
2026-05-25000
2026-06-01022
2026-06-08055
2026-06-15101
2026-06-22022
2026-06-29000
2026-07-06000
2026-07-13022
2026-07-20011
2026-07-27011
2026-08-03000
2026-08-10000
2026-08-17000
2026-08-24000
2026-08-31000
2026-09-07011
2026-09-14011
2026-09-21000
2026-09-28000
2026-10-05000
2026-10-12000

Endings

The 8 most used of the 10 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com5777.0%
.com.cn56.8%
.co.uk22.7%
.de22.7%
.hl.cn22.7%
.org22.7%
.com.tw11.4%
.jp11.4%

Where they are registered

For the 58 with a registrar in WHOIS (78% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
Dynadot2339.7%Retail
Above.com46.9%Retail
GoDaddy46.9%Retail
PDR35.2%Retail
GMO Internet Group23.5%Retail
Hello Internet23.5%Retail
Internet Domain Service BS23.5%Retail
NameSilo23.5%Retail

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Kaspersky; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • my-kaspersky[.]co[.]uk
    Combo, Sep 18Not checked
  • kasperskylogin[.]com
    Combo, Sep 7Not checked
  • kaspersky-update[.]com
    Combo, Aug 2Not checked
  • kaspersky-secure[.]com[.]cn
    Combo, Jul 23Not checked
  • app-kaspersky[.]com[.]cn
    Combo, Jul 19Not checked
  • web-kaspersky[.]com[.]cn
    Combo, Jul 19Not checked
  • kasperskydirect[.]com
    Combo, Jun 27Not checked
  • kasperskyofficial[.]com
    Combo, Jun 23Not checked
  • kasperskyw[.]com
    Typo, Jun 20Not checked
  • app-kaspersky[.]hl[.]cn
    Combo, Jun 14Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Kaspersky. Domains listed resemble Kaspersky by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.