Lookalike domain report: March 23 to March 29, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 4 certificates for unregistered .ph, .ws names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
1,534 typosquats, 2,555 combosquats and 138 homoglyphs; 4,183 first seen in certificate logs and 44 in zone files. The week before had 4,612. Most were on .com (2,277), .com.cn (543), .hl.cn (204), .net (105).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Meta | 803 | 19.0% |
| Microsoft | 127 | 3.0% |
| Apple | 126 | 3.0% |
| Crypto.com | 124 | 2.9% |
| 93 | 2.2% | |
| Booking | 82 | 1.9% |
| Charles Schwab | 70 | 1.7% |
| Binance | 68 | 1.6% |
| Adobe | 58 | 1.4% |
| Signal | 49 | 1.2% |
Where they were registered
For the 2,540 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| Media Elite Holdings | 429 | 16.9% | Retail |
| GoDaddy | 371 | 14.6% | Retail |
| Dynadot | 167 | 6.6% | Retail |
| Above.com | 122 | 4.8% | Retail |
| Cloudflare | 87 | 3.4% | Retail |
| Namecheap | 83 | 3.3% | Retail |
| Tucows | 71 | 2.8% | Retail |
| Internet Domain Service BS | 70 | 2.8% | Retail |
| Spaceship | 63 | 2.5% | Retail |
| NameSilo | 57 | 2.2% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
xn--amaon-7hb[.]com, a homoglyph of Amazon. A homoglyph first seen on 28 Mar.xn--shopfy-zk8b[.]com, a homoglyph of Shopify. A homoglyph first seen on 24 Mar.t-moibile[.]com, a homoglyph of T-Mobile. A homoglyph first seen on 24 Mar.repilt[.]com, a homoglyph of Replit. A homoglyph first seen on 25 Mar.cignna[.]com, a homoglyph of Cigna. A homoglyph first seen on 28 Mar.workbay[.]com, a homoglyph of Workday. A homoglyph first seen on 27 Mar.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: March 23 to March 29, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W13.