Lookalike domain report: March 2 to March 8, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 8 certificates for unregistered .ws, .com.ph, .ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
2,350 typosquats, 3,110 combosquats and 210 homoglyphs; 5,516 first seen in certificate logs and 154 in zone files. The week before had 5,073. Most were on .com (3,409), .hl.cn (354), .com.cn (178), .xyz (143).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Meta | 575 | 10.1% |
| Microsoft | 209 | 3.7% |
| Apple | 153 | 2.7% |
| 145 | 2.6% | |
| Crypto.com | 141 | 2.5% |
| Target | 109 | 1.9% |
| Adobe | 99 | 1.7% |
| Charles Schwab | 94 | 1.7% |
| Blockchain | 82 | 1.4% |
| Ledger | 80 | 1.4% |
Where they were registered
For the 3,738 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 626 | 16.8% | Retail |
| Dynadot | 316 | 8.5% | Retail |
| Cloudflare | 208 | 5.6% | Retail |
| Key-Systems | 203 | 5.4% | Retail |
| NameBright | 162 | 4.3% | Retail |
| Namecheap | 147 | 3.9% | Retail |
| Above.com | 116 | 3.1% | Retail |
| Porkbun | 100 | 2.7% | Retail |
| Spaceship | 100 | 2.7% | Retail |
| NameSilo | 95 | 2.5% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
hubsp0t[.]com, a homoglyph of HubSpot. A homoglyph first seen on 3 Mar.d0cker[.]com, a homoglyph of Docker. A homoglyph first seen on 4 Mar.walrmart[.]com, a homoglyph of Walmart. A homoglyph first seen on 5 Mar.snnapchat[.]com, a homoglyph of Snapchat. A homoglyph first seen on 6 Mar.motion[.]so, a homoglyph of Notion. A homoglyph first seen on 4 Mar.feciex[.]com, a homoglyph of FedEx. A homoglyph first seen on 4 Mar.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: March 2 to March 8, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W10.