Lookalike domain report: September 14 to September 20, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Live and mail checks did not yet cover this week; they cover lookalikes first seen from 17 September 2026.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 34 certificates for unregistered .ph, .com.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
3,743 typosquats, 395 combosquats and 347 homoglyphs; 4,400 first seen in certificate logs and 85 in zone files. The week before had 2,239. Most were on .com (3,906), .de (79), .org (61), .net (54).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| TripAdvisor | 87 | 1.9% |
| Home Depot | 68 | 1.5% |
| RingCentral | 56 | 1.2% |
| Lenovo | 48 | 1.1% |
| GameStop | 46 | 1.0% |
| Staples Inc. | 43 | 1.0% |
| Rolex | 37 | 0.8% |
| Amazon | 36 | 0.8% |
| WordPress.com | 36 | 0.8% |
| Priceline | 36 | 0.8% |
Where they were registered
For the 3,872 lookalikes with a registrar in WHOIS (95% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 529 | 13.7% | Retail |
| Corsearch | 484 | 12.5% | Brand protection |
| Cloudflare | 193 | 5.0% | Retail |
| Namecheap | 191 | 4.9% | Retail |
| PDR | 187 | 4.8% | Retail |
| Dynadot | 179 | 4.6% | Retail |
| Spaceship | 129 | 3.3% | Retail |
| Network Solutions | 105 | 2.7% | Retail |
| CSC | 102 | 2.6% | Brand protection |
| NameBright | 97 | 2.5% | Retail |
Age at first sighting
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
baldu[.]com, a homoglyph of Baidu. A homoglyph first seen on 17 Sep.bililbili[.]com, a homoglyph of Bilibili. A homoglyph first seen on 14 Sep.dailymotiom[.]com, a homoglyph of Dailymotion. A homoglyph first seen on 19 Sep.intci[.]com, a homoglyph of Intel. A homoglyph first seen on 18 Sep.fandor[.]com, a homoglyph of Fandom, Inc.. A homoglyph first seen on 20 Sep.merriam-wedster[.]com, a homoglyph of Merriam-Webster. A homoglyph first seen on 14 Sep.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: September 14 to September 20, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W38.