Lookalike domain report: September 28 to October 4, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- 371 certificates for unregistered .com.ph, .ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
2,832 typosquats, 933 combosquats and 229 homoglyphs; 3,888 first seen in certificate logs and 106 in zone files. The week before had 3,970. Most were on .com (3,132), .de (133), .net (76), .co.uk (61).
Most imitated brands
Where they were registered
Registrar data is incomplete for this week, so the registrar ranking is left out: WHOIS covers 62% of its lookalikes.
What the live ones did
744 of this week's lookalikes were registered, resolved and checked for a website and mail: 363 (49%) served a website and 341 (46%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
23 tracked live lookalikes went down during the week, a median 4d 3h after they were first seen. Of this week's own lookalikes, 709 were seen live and 21 listed by Google Web Risk by the end of the week.
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
google-activate[.]com, a combosquat of Google. Serves a website and publishes MX records.getlinkedinaccounts[.]com, a combosquat of LinkedIn. Serves a website and publishes MX records.applerecovery[.]nl, a combosquat of Apple. Serves a website and publishes MX records.microsoft365login[.]com, a combosquat of Microsoft. Serves a website and publishes MX records.githubhelp[.]forum, a combosquat of GitHub. Serves a website and publishes MX records.xn--mazon-wqa[.]de, a homoglyph of Amazon. Serves a website and publishes MX records.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: September 28 to October 4, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W40.