Lookalike domain report

Lookalikes per week

In the last 7 days: 2,271 typosquats, 2,189 combosquats and 228 homoglyphs, 4,578 of them from certificate logs and 110 from zone files. The tall bars from July to early September are mostly certificates for unregistered .ph names; the CT monitoring guide explains why.

Where lookalikes are registered

Registrars of lookalikes first seen in the last 30 days, for the 13,601 with a registrar in WHOIS. Brand-protection registrars mostly hold defensive registrations made by the brands themselves.

How old lookalikes are when first seen

Age is the time between WHOIS creation and Greyphish's first sighting. Fresh domains are mostly combosquats; old ones are mostly typosquats renewing certificates. The combosquatting guide breaks this down by type.

How long live lookalikes stay up

Every lookalike seen serving a site in the last 30 days is checked until it goes down (3 failed checks in a row). Of 3,132 live, 65 were listed by Google Web Risk (median 1d 0h after first sighting) and 83 went down (median 2d 21h). Most are never reported by anyone, so these numbers measure neglect as much as registrar speed. See what to do about a lookalike.

Longest-lived, by registrar

Longest-lived, by hosting network

Registrars and networks with at least three tracked live lookalikes. A + means the median one is still up.

Methodology

• Sources. A self-hosted reader of public Certificate Transparency logs, and daily zone files for generic TLDs from ICANN's Centralized Zone Data Service.
• Brands. About 1,250 widely impersonated public brands, each with its own page once there is enough data. Domains that Greyphish customers watch, and anything derived from their watchlists, are excluded from every figure on this page.
• Matching. dnstwist permutations of each brand domain (typosquats and homoglyphs, including punycode), plus brand keywords, matched as whole words, combined with modifiers associated with impersonation (combosquats). Each domain is counted once, on the day it was first seen.
• Registrars and age come from WHOIS for the subset of lookalikes looked up; registrar names are grouped into families.
• Live and down. A lookalike counts as live when it serves a website, and as down after 3 consecutive failed checks. Google Web Risk listings are checked through Google's API.
• Caveats. A match means a domain resembles a brand, not that it is malicious or unaffiliated; many are defensive registrations, parked names or unrelated businesses. Certificate logs also contain names that were never registered, such as the .ph wave in July and August 2026, which inflates those weeks.

Citing this report

Greyphish, "Lookalike domain report", Sima Technologies LLC, https://greyphish.com/report, accessed on the date you read it. Figures change hourly; note the "data as of" time above. For questions, use the contact page.