Lookalike domain report: October 5 to October 11, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- 10,950 certificates for unregistered .com.ph, .ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
2,015 typosquats, 2,174 combosquats and 214 homoglyphs; 4,291 first seen in certificate logs and 112 in zone files. The week before had 3,994. Most were on .com (3,128), .de (121), .org (115), .net (106).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Adobe | 194 | 4.4% |
| Crypto.com | 165 | 3.7% |
| 111 | 2.5% | |
| Apple | 101 | 2.3% |
| United Airlines | 97 | 2.2% |
| Amazon | 95 | 2.2% |
| Microsoft | 77 | 1.7% |
| Delta | 52 | 1.2% |
| Ledger | 49 | 1.1% |
| Steam | 46 | 1.0% |
Where they were registered
For the 3,430 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 708 | 20.6% | Retail |
| Dynadot | 214 | 6.2% | Retail |
| Cloudflare | 173 | 5.0% | Retail |
| Namecheap | 163 | 4.8% | Retail |
| NameBright | 152 | 4.4% | Retail |
| Squarespace | 136 | 4.0% | Retail |
| Spaceship | 115 | 3.4% | Retail |
| MarkMonitor | 81 | 2.4% | Brand protection |
| Network Solutions | 80 | 2.3% | Retail |
| GMO Internet Group | 77 | 2.2% | Retail |
Age at first sighting
What the live ones did
2,147 of this week's lookalikes were registered, resolved and checked for a website and mail: 1,124 (52%) served a website and 965 (45%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
75 tracked live lookalikes went down during the week, a median 1d 19h after they were first seen. Of this week's own lookalikes, 2,180 were seen live and 22 listed by Google Web Risk by the end of the week.
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
get-alpha-drive[.]com, a combosquat of Google. Serves a website and publishes MX records.instagramhelpservice[.]net, a combosquat of Instagram. Serves a website and publishes MX records.linkedinaccounts[.]shop, a combosquat of LinkedIn. Serves a website and publishes MX records.appleverify-id[.]com, a combosquat of Apple. Serves a website and publishes MX records.office-support-therling[.]de, a combosquat of Microsoft. Serves a website and publishes MX records.whatsappwebb[.]com, a combosquat of WhatsApp. Serves a website and publishes MX records.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: October 5 to October 11, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W41.