Productivity

Monday lookalike domains

Greyphish has recorded 167 domains that resemble Monday since February 2026, 16 of them in the last 90 days. They split between typosquats (52%) and combosquats (37%). .com carries 80% of them, out of 23 endings in all. The pace has picked up, with 7 in the last 30 days against 3 in the 30 before. 4 certificates for unregistered .ph, .com.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
167
since February 2026
Last 90 days
16
7 in the last 30 days
Endings
23
most on .com (80%)
Serve a website
45%
of 20 checked; 45% publish MX

What kind of lookalikes

Typosquats87 (52%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Combosquats62 (37%)

The brand spelled correctly with a word added, such as login or support. More

Homoglyphs18 (11%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Words most often added to the name in the last 90 days: app (3).

Lookalikes per week

TypoComboHomoglyph
3
6
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-203115
2026-04-271023
2026-05-041102
2026-05-110101
2026-05-181102
2026-05-251203
2026-06-011001
2026-06-080101
2026-06-150101
2026-06-223003
2026-06-290202
2026-07-063014
2026-07-130000
2026-07-202204
2026-07-271001
2026-08-030000
2026-08-100101
2026-08-170202
2026-08-240101
2026-08-310000
2026-09-070000
2026-09-141001
2026-09-210000
2026-09-280000
2026-10-050606
2026-10-120000

Endings

The 8 most used of the 23 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com13480.2%
.xyz63.6%
.net31.8%
.ai21.2%
.org21.2%
.sbs21.2%
.top21.2%
.agency10.6%

Where they are registered

For the 133 with a registrar in WHOIS (80% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy3224.1%Retail
NameBright96.8%Retail
Namecheap96.8%Retail
Dynadot86.0%Retail
Media Elite Holdings64.5%Retail
Spaceship64.5%Retail
eNom64.5%Retail
Hostinger53.8%Retail

What the live ones do

20 of these lookalikes were registered and checked for a website and mail: 9 (45%) served a website and 9 (45%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists none of the 4 live ones checked against it.

4 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Monday; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • mondaywebs[.]com
    Combo, Oct 10Serves a websiteMX records
  • mondayweb[.]xyz
    Combo, Oct 9No site or mail when checked
  • mondayapps[.]xyz
    Combo, Oct 7Not checked
  • mondayappstore[.]com
    Combo, Oct 7Serves a website
  • mondayservicestaging[.]com
    Combo, Oct 6Not checked
  • mondaydirectory[.]com
    Combo, Oct 5Serves a website
  • mondayj[.]com
    Typo, Sep 16Not checked
  • truemonday[.]com
    Combo, Aug 27Not checked
  • mondayapp[.]xyz
    Combo, Aug 19Not checked
  • mymonday[.]xyz
    Combo, Aug 18Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Monday. Domains listed resemble Monday by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.