Lookalike domain report: April 27 to May 3, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
Lookalikes per day
342 typosquats, 732 combosquats and 37 homoglyphs; 1,064 first seen in certificate logs and 47 in zone files. The week before had 2,339. Most were on .com (556), .com.cn (159), .hl.cn (28), .de (26).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Meta | 176 | 15.8% |
| 52 | 4.7% | |
| Microsoft | 45 | 4.1% |
| Crypto.com | 41 | 3.7% |
| Freshdesk | 34 | 3.1% |
| Apple | 33 | 3.0% |
| ExpressVPN | 32 | 2.9% |
| Amazon | 28 | 2.5% |
| NordVPN | 26 | 2.3% |
| Signal | 25 | 2.3% |
Where they were registered
For the 605 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| Danesco Trading | 126 | 20.8% | Retail |
| GoDaddy | 101 | 16.7% | Retail |
| Namecheap | 33 | 5.5% | Retail |
| Dynadot | 25 | 4.1% | Retail |
| Porkbun | 22 | 3.6% | Retail |
| Hostinger | 19 | 3.1% | Retail |
| Registrar of Domain Names REG.RU | 17 | 2.8% | Retail |
| NameSilo | 13 | 2.1% | Retail |
| Above.com | 11 | 1.8% | Retail |
| NICENIC INTERNATIONAL GROUP | 11 | 1.8% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
xn--bookng-s9a[.]com, a homoglyph of Booking. A homoglyph first seen on 28 Apr.xn--netflx-fwa[.]com, a homoglyph of Netflix. A homoglyph first seen on 27 Apr.g0og1e[.]com, a homoglyph of Google. A homoglyph first seen on 27 Apr.gitlhub[.]com, a homoglyph of GitHub. A homoglyph first seen on 28 Apr.xn--tiktk-p29a[.]com, a homoglyph of TikTok. A homoglyph first seen on 30 Apr.wlhatsapp[.]com, a homoglyph of WhatsApp. A homoglyph first seen on 3 May.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: April 27 to May 3, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W18.