Lookalike domain report: May 11 to May 17, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 1 certificate for unregistered .ws names (registry wildcard) is excluded: the registry answers for any name under that ending, so nobody had to register one to get a certificate for it.
Lookalikes per day
214 typosquats, 989 combosquats and 38 homoglyphs; 1,198 first seen in certificate logs and 43 in zone files. The week before had 1,335. Most were on .com (457), .com.cn (386), .cn (26), .xyz (25).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Meta | 418 | 33.7% |
| Amazon | 62 | 5.0% |
| Microsoft | 42 | 3.4% |
| Crypto.com | 37 | 3.0% |
| Apple | 30 | 2.4% |
| 28 | 2.3% | |
| United Airlines | 21 | 1.7% |
| Ledger | 21 | 1.7% |
| Fidelity | 19 | 1.5% |
| Booking | 16 | 1.3% |
Where they were registered
For the 516 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 115 | 22.3% | Retail |
| Name SRS | 50 | 9.7% | Retail |
| Namecheap | 30 | 5.8% | Retail |
| Dynadot | 23 | 4.5% | Retail |
| Media Elite Holdings | 19 | 3.7% | Retail |
| Spaceship | 17 | 3.3% | Retail |
| NameSilo | 16 | 3.1% | Retail |
| Sav | 16 | 3.1% | Retail |
| Internet Domain Service BS | 14 | 2.7% | Retail |
| PDR | 14 | 2.7% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
diiscord[.]com, a homoglyph of Discord. A homoglyph first seen on 12 May.gooqie[.]com, a homoglyph of Google. A homoglyph first seen on 12 May.faceb0ok[.]com, a homoglyph of Facebook. A homoglyph first seen on 15 May.xn--instagrm-3qd[.]com, a homoglyph of Instagram. A homoglyph first seen on 14 May.xn--twtter-xva[.]com, a homoglyph of Twitter. A homoglyph first seen on 15 May.nnicrosoft[.]com, a homoglyph of Microsoft. A homoglyph first seen on 15 May.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: May 11 to May 17, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W20.