Streaming and media

Tidal lookalike domains

Greyphish has recorded 111 domains that resemble Tidal since February 2026, 22 of them in the last 90 days. They split between typosquats (54%) and combosquats (35%). .com carries 76% of them, out of 13 endings in all. The pace has picked up, with 6 in the last 30 days against 4 in the 30 before. The busiest week began 15 June 2026, with 10 new ones.

Data as of . Public sources only.

Lookalikes seen
111
since February 2026
Last 90 days
22
6 in the last 30 days
Endings
13
most on .com (76%)
Serve a website
55%
of 11 checked; 64% publish MX

What kind of lookalikes

Typosquats60 (54%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Combosquats39 (35%)

The brand spelled correctly with a word added, such as login or support. More

Homoglyphs12 (11%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Words most often added to the name in the last 90 days: app (3).

Lookalikes per week

TypoComboHomoglyph
5
10
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-206006
2026-04-271001
2026-05-041102
2026-05-111001
2026-05-181102
2026-05-250000
2026-06-010011
2026-06-081001
2026-06-1537010
2026-06-221001
2026-06-292114
2026-07-060606
2026-07-132103
2026-07-203014
2026-07-271113
2026-08-030101
2026-08-100112
2026-08-170101
2026-08-241012
2026-08-310000
2026-09-070101
2026-09-140101
2026-09-210000
2026-09-280000
2026-10-050505
2026-10-120000

Endings

The 8 most used of the 13 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com8475.7%
.xyz119.9%
.co.uk32.7%
.app21.8%
.com.au21.8%
.net21.8%
.ai10.9%
.au10.9%

Where they are registered

For the 76 with a registrar in WHOIS (68% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy3140.8%Retail
Network Solutions56.6%Retail
Cloudflare45.3%Retail
Dynadot45.3%Retail
Hosting Concepts34.0%Retail
NameBright34.0%Retail
Tucows34.0%Retail
Alibaba Cloud22.6%Retail

What the live ones do

11 of these lookalikes were registered and checked for a website and mail: 6 (55%) served a website and 7 (64%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists none of the 5 live ones checked against it.

5 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Tidal; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • tidalweb[.]xyz
    Combo, Oct 8No site or mail when checked
  • tidalaccounting[.]app
    Combo, Oct 6Serves a website
  • tidalbillingsolutions[.]com
    Combo, Oct 6Serves a websiteMX records
  • tidalservices[.]co[.]uk
    Combo, Oct 5MX records
  • tidalaccounting[.]ca
    Combo, Oct 5Serves a websiteMX records
  • tidalweb[.]com[.]au
    Combo, Sep 17Not checked
  • tidal-marine-general-service[.]com
    Combo, Sep 13Not checked
  • tideal[.]com
    Typo, Aug 28Not checked
  • tibal[.]com
    Homoglyph, Aug 28Not checked
  • tidalapp[.]xyz
    Combo, Aug 23Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with Tidal. Domains listed resemble Tidal by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.