Banking and payments

Robinhood lookalike domains

Greyphish has recorded 220 domains that resemble Robinhood since February 2026, 46 of them in the last 90 days. They split between combosquats (50%) and typosquats (41%). .com carries 74% of them, out of 27 endings in all. The pace has picked up, with 17 in the last 30 days against 6 in the 30 before. The busiest week began 13 July 2026, with 15 new ones. 16 certificates for unregistered .ph, .com.ph, .org.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
220
since February 2026
Last 90 days
46
17 in the last 30 days
Endings
27
most on .com (74%)
Serve a website
46%
of 26 checked; 42% publish MX

What kind of lookalikes

Combosquats111 (50%)

The brand spelled correctly with a word added, such as login or support. More

Typosquats91 (41%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Homoglyphs18 (8%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Words most often added to the name in the last 90 days: support (4), app (4), claim (4), web (3), help (3).

Lookalikes per week

TypoComboHomoglyph
8
15
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-2037010
2026-04-271203
2026-05-040202
2026-05-111203
2026-05-180112
2026-05-250213
2026-06-015117
2026-06-082305
2026-06-151102
2026-06-220202
2026-06-295005
2026-07-060202
2026-07-13114015
2026-07-202417
2026-07-270101
2026-08-032204
2026-08-102518
2026-08-171102
2026-08-240000
2026-08-312002
2026-09-070101
2026-09-140202
2026-09-210404
2026-09-280000
2026-10-0527110
2026-10-120101

Endings

The 8 most used of the 27 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com16374.1%
.xyz73.2%
.online52.3%
.org52.3%
.live41.8%
.net41.8%
.app31.4%
.info31.4%

Where they are registered

For the 153 with a registrar in WHOIS (70% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy2516.3%Retail
NICENIC INTERNATIONAL GROUP1711.1%Retail
Spaceship1610.5%Retail
Media Elite Holdings127.8%Retail
Dynadot106.5%Retail
NameBright63.9%Retail
NameSilo63.9%Retail
Namecheap63.9%Retail

What the live ones do

26 of these lookalikes were registered and checked for a website and mail: 12 (46%) served a website and 11 (42%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists 2 of the 12 live ones checked against it (17%).

14 were tracked while live and 3 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Robinhood; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • robinhoodwebdesign[.]com
    Combo, Oct 13Serves a website
  • robinhoof[.]com
    Typo, Oct 10Not checked
  • robinhoodhelpline[.]com
    Combo, Oct 10Serves a website
  • verify-robinhood[.]com
    Combo, Oct 8No site or mail when checked
  • robinhoodrefundra[.]org
    Combo, Oct 8Serves a websiteMX records
  • robinhoodsupports[.]us
    Combo, Oct 8Serves a websiteMX records
  • roblnhoodl[.]com
    Homoglyph, Oct 7Listed by Google Web RiskNo site or mail when checked
  • robinhoodalert[.]com
    Combo, Oct 7MX records
  • robinhoos[.]com
    Typo, Oct 7Not checked
  • robinhoodrefunds[.]org
    Combo, Oct 5Serves a websiteMX records

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Robinhood. Domains listed resemble Robinhood by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.