Lookalike domain report: June 22 to June 28, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 2,263 certificates for unregistered .ph, .com.ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
214 typosquats, 471 combosquats and 40 homoglyphs; 704 first seen in certificate logs and 21 in zone files. The week before had 1,093. Most were on .com (402), .com.cn (35), .hl.cn (33), .xyz (28).
Most imitated brands
Where they were registered
For the 446 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 206 | 46.2% | Retail |
| Dynadot | 19 | 4.3% | Retail |
| Cloudflare | 15 | 3.4% | Retail |
| Namecheap | 14 | 3.1% | Retail |
| Hosting Concepts | 12 | 2.7% | Retail |
| NameSilo | 10 | 2.2% | Retail |
| AppCroNix Infotech Private | 9 | 2.0% | Retail |
| Name.com | 9 | 2.0% | Retail |
| Hostinger | 8 | 1.8% | Retail |
| Network Solutions | 8 | 1.8% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
xn--goog-31a2736b[.]com, a homoglyph of Google. A homoglyph first seen on 26 Jun.xn--pple-9na[.]com, a homoglyph of Apple. A homoglyph first seen on 28 Jun.xn--mirosoft-18a[.]com, a homoglyph of Microsoft. A homoglyph first seen on 23 Jun.adodle[.]com, a homoglyph of Adobe. A homoglyph first seen on 26 Jun.reddlit[.]com, a homoglyph of Reddit. A homoglyph first seen on 25 Jun.xn--opena-3sa[.]com, a homoglyph of OpenAI. A homoglyph first seen on 23 Jun.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: June 22 to June 28, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W26.