Lookalike domain report: March 30 to April 5, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 1 certificate for unregistered .com.ws names (registry wildcard) is excluded: the registry answers for any name under that ending, so nobody had to register one to get a certificate for it.
Lookalikes per day
1,165 typosquats, 2,313 combosquats and 139 homoglyphs; 3,573 first seen in certificate logs and 44 in zone files. The week before had 4,227. Most were on .com (1,830), .com.cn (469), .sbs (95), .cyou (82).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Meta | 535 | 14.8% |
| Charles Schwab | 210 | 5.8% |
| CrowdStrike | 178 | 4.9% |
| Apple | 135 | 3.7% |
| Microsoft | 125 | 3.5% |
| Crypto.com | 99 | 2.7% |
| 95 | 2.6% | |
| Booking | 74 | 2.0% |
| Adobe | 57 | 1.6% |
| Amazon | 43 | 1.2% |
Where they were registered
For the 2,080 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 274 | 13.2% | Retail |
| CSC | 185 | 8.9% | Brand protection |
| Dynadot | 175 | 8.4% | Retail |
| NameBright | 127 | 6.1% | Retail |
| Namecheap | 81 | 3.9% | Retail |
| NameSilo | 77 | 3.7% | Retail |
| Above.com | 73 | 3.5% | Retail |
| Squarespace | 70 | 3.4% | Retail |
| Cloudflare | 68 | 3.3% | Retail |
| Spaceship | 68 | 3.3% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
applc[.]com, a homoglyph of Apple. A homoglyph first seen on 1 Apr.stack0verfl0w[.]com, a homoglyph of Stack Overflow. A homoglyph first seen on 4 Apr.walnnart[.]com, a homoglyph of Walmart. A homoglyph first seen on 30 Mar.rimtendo[.]com, a homoglyph of Nintendo. A homoglyph first seen on 1 Apr.scndgrid[.]com, a homoglyph of SendGrid. A homoglyph first seen on 3 Apr.gemmini[.]com, a homoglyph of Gemini. A homoglyph first seen on 2 Apr.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: March 30 to April 5, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W14.