Productivity

VMware lookalike domains

Greyphish has recorded 50 domains that resemble VMware since February 2026, 6 of them in the last 90 days. They split between typosquats (50%) and combosquats (38%). .com carries 80% of them, out of 8 endings in all. 2 certificates for unregistered .com.ph, .ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
50
since February 2026
Last 90 days
6
2 in the last 30 days
Endings
8
most on .com (80%)
Typosquats
50%
the most common kind

What kind of lookalikes

Typosquats25 (50%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Combosquats19 (38%)

The brand spelled correctly with a word added, such as login or support. More

Homoglyphs6 (12%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Lookalikes per week

TypoComboHomoglyph
4
7
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-202002
2026-04-270000
2026-05-040000
2026-05-110000
2026-05-180000
2026-05-250000
2026-06-010101
2026-06-080101
2026-06-150000
2026-06-222204
2026-06-291001
2026-07-061607
2026-07-130000
2026-07-201012
2026-07-270000
2026-08-030000
2026-08-100000
2026-08-170000
2026-08-240101
2026-08-310011
2026-09-070000
2026-09-141001
2026-09-210000
2026-09-280000
2026-10-050101
2026-10-120000

Endings

The 8 most used of the 8 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com4080.0%
.de36.0%
.in24.0%
.ca12.0%
.cfd12.0%
.life12.0%
.net12.0%
.org12.0%

Where they are registered

For the 35 with a registrar in WHOIS (70% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
GoDaddy1028.6%Retail
Namecheap411.4%Retail
NameBright38.6%Retail
Cloudflare25.7%Retail
PDR25.7%Retail
Spaceship25.7%Retail
Tucows25.7%Retail
Unstoppable Domains25.7%Retail

What the live ones do

1 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles VMware; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • vmwarehelpdesk[.]com
    Combo, Oct 8No site or mail when checked
  • vpware[.]com
    Typo, Sep 18Not checked
  • vrmware[.]com
    Homoglyph, Sep 5Not checked
  • vmware-update[.]org
    Combo, Aug 26Not checked
  • veware[.]com
    Typo, Jul 23Not checked
  • vmmware[.]com
    Homoglyph, Jul 21Not checked
  • mvware[.]com
    Typo, Jul 11Not checked
  • vmware-support[.]com
    Combo, Jul 10Not checked
  • vmware-service[.]de
    Combo, Jul 10Not checked
  • vmwareservice[.]de
    Combo, Jul 10Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with VMware. Domains listed resemble VMware by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.