Social media

WeChat lookalike domains

Greyphish has recorded 124 domains that resemble WeChat since February 2026, 17 of them in the last 90 days. They split between typosquats (55%) and combosquats (42%). .com carries 73% of them, out of 27 endings in all. The pace has picked up, with 5 in the last 30 days against 4 in the 30 before. 42 certificates for unregistered .ph, .com.ph, .org.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.

Data as of . Public sources only.

Lookalikes seen
124
since February 2026
Last 90 days
17
5 in the last 30 days
Endings
27
most on .com (73%)
Serve a website
23%
of 13 checked; 38% publish MX

What kind of lookalikes

Typosquats68 (55%)

One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More

Combosquats52 (42%)

The brand spelled correctly with a word added, such as login or support. More

Homoglyphs4 (3%)

A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More

Words most often added to the name in the last 90 days: app (3).

Lookalikes per week

TypoComboHomoglyph
4
7
Apr 20
Jun 15
Aug 10
New lookalikes per week (UTC), by type, over the last 26 weeks. The last bar is this week so far.
Show as a table
Week ofTypoComboHomoglyphTotal
2026-04-204307
2026-04-271102
2026-05-040404
2026-05-111102
2026-05-180000
2026-05-251001
2026-06-013104
2026-06-082002
2026-06-153205
2026-06-222103
2026-06-292002
2026-07-062002
2026-07-132002
2026-07-201113
2026-07-271102
2026-08-030000
2026-08-102002
2026-08-172002
2026-08-240000
2026-08-310202
2026-09-070000
2026-09-140101
2026-09-210101
2026-09-281001
2026-10-051102
2026-10-120000

Endings

The 8 most used of the 27 top-level domains these lookalikes sit under.

EndingLookalikesShare
.com9173.4%
.online43.2%
.beauty21.6%
.cc21.6%
.top21.6%
.vip21.6%
.cfd10.8%
.click10.8%

Where they are registered

For the 80 with a registrar in WHOIS (65% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

RegistrarLookalikesShareType
Dynadot1012.5%Retail
Alibaba Cloud78.8%Retail
GoDaddy78.8%Retail
Gname67.5%Retail
NameSilo67.5%Retail
Spaceship67.5%Retail
NameBright56.3%Retail
Namecheap45.0%Retail

What the live ones do

13 of these lookalikes were registered and checked for a website and mail: 3 (23%) served a website and 5 (38%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists none of the 2 live ones checked against it.

2 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles WeChat; it is not necessarily malicious, and none of these is a claim about who registered it or why.

  • weclat[.]com
    Typo, Oct 10Not checked
  • wechatappapi[.]com
    Combo, Oct 5No site or mail when checked
  • aechat[.]com
    Typo, Oct 1Not checked
  • wechatapp[.]cc
    Combo, Sep 22Not checked
  • wechatweb[.]online
    Combo, Sep 17Not checked
  • wechat-app[.]vip
    Combo, Sep 6Serves a website
  • wechatupdate[.]help
    Combo, Sep 2Not checked
  • wechatl[.]com
    Typo, Aug 21Not checked
  • wechat6[.]com
    Typo, Aug 20Not checked
  • wechatu[.]com
    Typo, Aug 12Not checked

Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.

All brands with a page

Greyphish is not affiliated with WeChat. Domains listed resemble WeChat by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.