Lookalike domain report: October 12 to October 18, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- 7,579 certificates for unregistered .ph, .com.ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
1,524 typosquats, 1,574 combosquats and 145 homoglyphs; 3,209 first seen in certificate logs and 34 in zone files. The week before had 4,403. Most were on .com (2,336), .net (83), .org (82), .de (53).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Adobe | 138 | 4.3% |
| Crypto.com | 107 | 3.3% |
| United Airlines | 104 | 3.2% |
| Apple | 98 | 3.0% |
| Amazon | 58 | 1.8% |
| Microsoft | 54 | 1.7% |
| Orange | 49 | 1.5% |
| Delta | 47 | 1.4% |
| 43 | 1.3% | |
| Ledger | 39 | 1.2% |
Where they were registered
For the 2,563 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 440 | 17.2% | Retail |
| NameBright | 167 | 6.5% | Retail |
| Above.com | 152 | 5.9% | Retail |
| Cloudflare | 136 | 5.3% | Retail |
| Dynadot | 132 | 5.1% | Retail |
| Namecheap | 132 | 5.1% | Retail |
| Squarespace | 107 | 4.2% | Retail |
| Spaceship | 81 | 3.2% | Retail |
| NameSilo | 73 | 2.9% | Retail |
| Network Solutions | 72 | 2.8% | Retail |
Age at first sighting
What the live ones did
1,496 of this week's lookalikes were registered, resolved and checked for a website and mail: 831 (56%) served a website and 722 (48%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
81 tracked live lookalikes went down during the week, a median 4d 9h after they were first seen. Of this week's own lookalikes, 1,518 were seen live and 19 listed by Google Web Risk by the end of the week.
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
googleloginalert[.]com, a combosquat of Google. Serves a website and publishes MX records.getfacebook[.]info, a combosquat of Facebook. Serves a website and publishes MX records.linkedincenterparcs[.]be, a combosquat of LinkedIn. Serves a website and publishes MX records.icloudaccountants[.]com[.]au, a combosquat of Apple. Serves a website and publishes MX records.get-office[.]net, a combosquat of Microsoft. Serves a website and publishes MX records.pinterestwebsite[.]com, a combosquat of Pinterest. Serves a website and publishes MX records.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: October 12 to October 18, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W42.