Spirit lookalike domains
Greyphish has recorded 383 domains that resemble Spirit since February 2026, 74 of them in the last 90 days. Most of them (76%) are combosquats: Spirit spelled correctly with a word added, most often “center”, “win”, “app”. .com carries 51% of them, out of 61 endings in all. The pace has picked up, with 34 in the last 30 days against 21 in the 30 before. The busiest week began 29 June 2026, with 18 new ones. 6 certificates for unregistered .com.ph, .ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Data as of . Public sources only.
What kind of lookalikes
One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More
Words most often added to the name in the last 90 days: center (8), win (8), app (7), web (7), true (6), service (5).
Lookalikes per week
Show as a table
| Week of | Typo | Combo | Total |
|---|---|---|---|
| 2026-04-20 | 4 | 7 | 11 |
| 2026-04-27 | 1 | 3 | 4 |
| 2026-05-04 | 1 | 1 | 2 |
| 2026-05-11 | 0 | 3 | 3 |
| 2026-05-18 | 0 | 6 | 6 |
| 2026-05-25 | 0 | 9 | 9 |
| 2026-06-01 | 1 | 2 | 3 |
| 2026-06-08 | 0 | 3 | 3 |
| 2026-06-15 | 2 | 8 | 10 |
| 2026-06-22 | 1 | 3 | 4 |
| 2026-06-29 | 4 | 14 | 18 |
| 2026-07-06 | 1 | 8 | 9 |
| 2026-07-13 | 3 | 0 | 3 |
| 2026-07-20 | 2 | 9 | 11 |
| 2026-07-27 | 0 | 2 | 2 |
| 2026-08-03 | 0 | 4 | 4 |
| 2026-08-10 | 0 | 3 | 3 |
| 2026-08-17 | 1 | 4 | 5 |
| 2026-08-24 | 1 | 1 | 2 |
| 2026-08-31 | 0 | 6 | 6 |
| 2026-09-07 | 0 | 6 | 6 |
| 2026-09-14 | 0 | 2 | 2 |
| 2026-09-21 | 0 | 4 | 4 |
| 2026-09-28 | 1 | 7 | 8 |
| 2026-10-05 | 0 | 15 | 15 |
| 2026-10-12 | 0 | 5 | 5 |
Endings
The 8 most used of the 61 top-level domains these lookalikes sit under.
| Ending | Lookalikes | Share |
|---|---|---|
| .com | 197 | 51.4% |
| .de | 20 | 5.2% |
| .org | 20 | 5.2% |
| .net | 14 | 3.7% |
| .xyz | 10 | 2.6% |
| .ch | 8 | 2.1% |
| .store | 8 | 2.1% |
| .nl | 7 | 1.8% |
Where they are registered
For the 222 with a registrar in WHOIS (58% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 47 | 21.2% | Retail |
| NameBright | 22 | 9.9% | Retail |
| URL Solutions | 13 | 5.9% | Retail |
| Dynadot | 12 | 5.4% | Retail |
| Squarespace | 12 | 5.4% | Retail |
| Namecheap | 11 | 5.0% | Retail |
| Spaceship | 9 | 4.0% | Retail |
| Tucows | 8 | 3.6% | Retail |
What the live ones do
97 of these lookalikes were registered and checked for a website and mail: 58 (60%) served a website and 45 (46%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
Google Web Risk lists none of the 24 live ones checked against it (0%).
28 were tracked while live and 0 have since gone down. See what to do about a lookalike.
Recent examples
The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Spirit; it is not necessarily malicious, and none of these is a claim about who registered it or why.
spiritrenewed[.]orgCombo, Oct 13No site or mail when checkedspiritrecovery[.]orgCombo, Oct 13Serves a websitespiritdirected[.]comCombo, Oct 12Serves a websiteMX recordsspiritappsgame[.]comCombo, Oct 12Serves a websiteMX recordsspiritcenterforthenations[.]orgCombo, Oct 12Serves a websitespiritwebstudio[.]comCombo, Oct 11Serves a websiteMX recordsspiritapparel[.]storeCombo, Oct 11No site or mail when checkedspiritcenteredcoaching[.]comCombo, Oct 10Serves a websiteMX recordsspiritapproved[.]onlineCombo, Oct 10Serves a websitespiritrenewedcoaching[.]comCombo, Oct 9Serves a websiteMX records
Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.
Further reading
More in travel
Greyphish is not affiliated with Spirit. Domains listed resemble Spirit by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.