Lookalike domain report: June 1 to June 7, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
Lookalikes per day
222 typosquats, 487 combosquats and 28 homoglyphs; 682 first seen in certificate logs and 55 in zone files. The week before had 869. Most were on .com (382), .com.cn (34), .io (29), .xyz (20).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Meta | 63 | 8.5% |
| Apple | 37 | 5.0% |
| Crypto.com | 32 | 4.3% |
| Microsoft | 30 | 4.1% |
| 20 | 2.7% | |
| Trezor | 19 | 2.6% |
| Blockchain | 19 | 2.6% |
| Booking | 14 | 1.9% |
| Coinbase | 12 | 1.6% |
| Ledger | 12 | 1.6% |
Where they were registered
For the 456 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 107 | 23.5% | Retail |
| NameSilo | 35 | 7.7% | Retail |
| Dynadot | 34 | 7.5% | Retail |
| Namecheap | 32 | 7.0% | Retail |
| NICENIC INTERNATIONAL GROUP | 23 | 5.0% | Retail |
| Spaceship | 21 | 4.6% | Retail |
| Cloudflare | 18 | 4.0% | Retail |
| Amazon | 11 | 2.4% | Retail |
| Internet Domain Service BS | 9 | 2.0% | Retail |
| Key-Systems | 9 | 2.0% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
xn--t-moble-cza[.]com, a homoglyph of T-Mobile. A homoglyph first seen on 4 Jun.xn--gogle-jua[.]com, a homoglyph of Google. A homoglyph first seen on 4 Jun.xn--micrsoft-73a[.]com, a homoglyph of Microsoft. A homoglyph first seen on 1 Jun.xn--opena-r4a[.]com, a homoglyph of OpenAI. A homoglyph first seen on 4 Jun.xn--cloudfare-vub[.]com, a homoglyph of Cloudflare. A homoglyph first seen on 1 Jun.deczer[.]com, a homoglyph of Deezer. A homoglyph first seen on 7 Jun.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: June 1 to June 7, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W23.