Lookalike domain report: September 21 to September 27, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- Takedown tracking did not yet cover this week; it began on 24 September 2026.
- 125 certificates for unregistered .com.ph, .ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
3,250 typosquats, 407 combosquats and 313 homoglyphs; 3,852 first seen in certificate logs and 118 in zone files. The week before had 4,485. Most were on .com (3,410), .de (64), .org (50), .net (40).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Home Depot | 96 | 2.4% |
| RingCentral | 91 | 2.3% |
| Staples Inc. | 72 | 1.8% |
| GameStop | 69 | 1.7% |
| Shutterstock | 61 | 1.5% |
| Lenovo | 58 | 1.5% |
| TripAdvisor | 50 | 1.3% |
| Priceline | 45 | 1.1% |
| LendingTree | 44 | 1.1% |
| Ancestry.com Inc. | 43 | 1.1% |
Where they were registered
For the 3,145 lookalikes with a registrar in WHOIS (89% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| Corsearch | 657 | 20.9% | Brand protection |
| GoDaddy | 427 | 13.6% | Retail |
| NameBright | 220 | 7.0% | Retail |
| Dynadot | 145 | 4.6% | Retail |
| Cloudflare | 142 | 4.5% | Retail |
| Spaceship | 109 | 3.5% | Retail |
| Namecheap | 100 | 3.2% | Retail |
| Cosmotown | 78 | 2.5% | Retail |
| NameSilo | 67 | 2.1% | Retail |
| Network Solutions | 62 | 2.0% | Retail |
Age at first sighting
What the live ones did
413 of this week's lookalikes were registered, resolved and checked for a website and mail: 183 (44%) served a website and 113 (27%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
google-maps-support[.]com, a combosquat of Google. Serves a website and publishes MX records.instagram-recover[.]com, a combosquat of Instagram. Serves a website and publishes MX records.find-my-icloud[.]pro, a combosquat of Apple. Serves a website and publishes MX records.office-365-support[.]tech, a combosquat of Microsoft. Serves a website and publishes MX records.vime0[.]com, a homoglyph of Vimeo. Serves a website and publishes MX records.prime-play-online[.]shop, a combosquat of Amazon. Serves a website and publishes MX records.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: September 21 to September 27, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W39.