Lookalike domain report: April 20 to April 26, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 1 certificate for unregistered .vg names (registry wildcard) is excluded: the registry answers for any name under that ending, so nobody had to register one to get a certificate for it.
Lookalikes per day
828 typosquats, 1,447 combosquats and 64 homoglyphs; 2,306 first seen in certificate logs and 33 in zone files. The week before had 2,422. Most were on .com (1,204), .com.cn (333), .hl.cn (95), .org (49).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Meta | 414 | 17.7% |
| Crypto.com | 85 | 3.6% |
| 75 | 3.2% | |
| Apple | 74 | 3.2% |
| Microsoft | 68 | 2.9% |
| Shopify | 68 | 2.9% |
| ExpressVPN | 63 | 2.7% |
| NordVPN | 56 | 2.4% |
| Ledger | 56 | 2.4% |
| Booking | 51 | 2.2% |
Where they were registered
For the 1,328 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| Danesco Trading | 199 | 15.0% | Retail |
| GoDaddy | 192 | 14.5% | Retail |
| NameBright | 80 | 6.0% | Retail |
| Namecheap | 63 | 4.7% | Retail |
| Registrar of Domain Names REG.RU | 51 | 3.8% | Retail |
| Above.com | 46 | 3.5% | Retail |
| Dynadot | 45 | 3.4% | Retail |
| Squarespace | 42 | 3.2% | Retail |
| Spaceship | 37 | 2.8% | Retail |
| Gname | 32 | 2.4% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
ibooking[.]com, a homoglyph of Booking. A homoglyph first seen on 24 Apr.evenntbrite[.]com, a homoglyph of Eventbrite. A homoglyph first seen on 20 Apr.leclger[.]com, a homoglyph of Ledger. A homoglyph first seen on 20 Apr.xn--googl-mza[.]com, a homoglyph of Google. A homoglyph first seen on 20 Apr.xn--fcebook-s3a[.]com, a homoglyph of Facebook. A homoglyph first seen on 24 Apr.xn--insagram-ryb[.]com, a homoglyph of Instagram. A homoglyph first seen on 20 Apr.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: April 20 to April 26, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W17.