Lookalike domain report: July 6 to July 12, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 5,642 certificates for unregistered .com.ph, .ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
624 typosquats, 527 combosquats and 58 homoglyphs; 1,186 first seen in certificate logs and 23 in zone files. The week before had 1,023. Most were on .com (837), .xyz (63), .info (23), .net (23).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Keeper | 138 | 11.4% |
| Apple | 54 | 4.5% |
| Malwarebytes | 46 | 3.8% |
| Meta | 39 | 3.2% |
| LastPass | 38 | 3.1% |
| Humble Bundle | 32 | 2.6% |
| Amazon | 31 | 2.6% |
| Mailchimp | 30 | 2.5% |
| Crypto.com | 30 | 2.5% |
| Microsoft | 25 | 2.1% |
Where they were registered
Registrar data is incomplete for this week, so the registrar ranking is left out: WHOIS covers 9% of its lookalikes.
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
xn--intagram-nvb[.]com, a homoglyph of Instagram. A homoglyph first seen on 7 Jul.xn--micrsoft-y3a[.]com, a homoglyph of Microsoft. A homoglyph first seen on 11 Jul.xn--amzn-rsa17b[.]com, a homoglyph of Amazon. A homoglyph first seen on 6 Jul.sp0tlfy[.]com, a homoglyph of Spotify. A homoglyph first seen on 6 Jul.soundcloucl[.]com, a homoglyph of SoundCloud. A homoglyph first seen on 7 Jul.orac1e[.]com, a homoglyph of Oracle. A homoglyph first seen on 7 Jul.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: July 6 to July 12, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W28.