ProtonVPN lookalike domains

What kind of lookalikes

Lookalikes per week

Endings

The 8 most used of the 14 top-level domains these lookalikes sit under.

Where they are registered

For the 45 with a registrar in WHOIS (73% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

What the live ones do

Google Web Risk lists none of the 1 live ones checked against it.

1 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles ProtonVPN; it is not necessarily malicious, and none of these is a claim about who registered it or why.

• protonvpn-app[.]com[.]cn
  Combo, Oct 1Serves a website
• protonvpnx[.]com
  Typo, Aug 1Not checked
• protonvpn-app[.]help
  Combo, Jul 27Not checked
• ppotonvpn[.]com
  Typo, Jul 20Not checked
• protonvpn-secure[.]click
  Combo, Jul 19No site or mail when checked
• protonvpn-app[.]hl[.]cn
  Combo, Jul 7Not checked
• my-protonvpn-free[.]com
  Combo, Jun 22Not checked
• protonvpnsecure[.]com
  Combo, Jun 18Not checked
• protonvpn-web[.]com[.]cn
  Combo, Jun 13No site or mail when checked
• protonbpn[.]com
  Typo, Jun 2Not checked

Further reading

• What combosquatting is, with examples
• Homoglyph and punycode domains, explained
• How to find lookalike domains of your own company
• What to do about a lookalike domain
• The weekly lookalike domain report, across all monitored brands