Lookalike domain report: April 6 to April 12, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
Lookalikes per day
767 typosquats, 1,593 combosquats and 84 homoglyphs; 2,417 first seen in certificate logs and 27 in zone files. The week before had 3,617. Most were on .com (1,278), .hl.cn (156), .click (93), .ru (68).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Meta | 218 | 8.9% |
| Microsoft | 109 | 4.5% |
| Apple | 107 | 4.4% |
| Charles Schwab | 103 | 4.2% |
| Crypto.com | 80 | 3.3% |
| Ledger | 71 | 2.9% |
| Adobe | 66 | 2.7% |
| 64 | 2.6% | |
| Binance | 47 | 1.9% |
| Blockchain | 47 | 1.9% |
Where they were registered
For the 1,452 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 230 | 15.8% | Retail |
| Dynadot | 146 | 10.1% | Retail |
| NameSilo | 76 | 5.2% | Retail |
| Squarespace | 58 | 4.0% | Retail |
| Namecheap | 57 | 3.9% | Retail |
| Spaceship | 51 | 3.5% | Retail |
| Cloudflare | 49 | 3.4% | Retail |
| NameBright | 41 | 2.8% | Retail |
| Hostinger | 39 | 2.7% | Retail |
| Tucows | 34 | 2.3% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
vider[.]com, a homoglyph of Viber. A homoglyph first seen on 11 Apr.lediger[.]com, a homoglyph of Ledger. A homoglyph first seen on 12 Apr.bashlane[.]com, a homoglyph of Dashlane. A homoglyph first seen on 12 Apr.fr0nt1er[.]com, a homoglyph of Frontier. A homoglyph first seen on 6 Apr.xn--twtter-q9a[.]com, a homoglyph of Twitter. A homoglyph first seen on 11 Apr.xn--zedesk-xt7b[.]com, a homoglyph of Zendesk. A homoglyph first seen on 8 Apr.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: April 6 to April 12, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W15.