Lookalike domain report: October 19 to October 25, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- 11,588 certificates for unregistered .ph, .com.ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
1,270 typosquats, 1,627 combosquats and 135 homoglyphs; 2,766 first seen in certificate logs and 266 in zone files. The week before had 3,243. Most were on .com (2,057), .xyz (196), .org (64), .net (59).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Adobe | 132 | 4.4% |
| Crypto.com | 125 | 4.1% |
| Apple | 77 | 2.5% |
| 70 | 2.3% | |
| United Airlines | 60 | 2.0% |
| Microsoft | 59 | 1.9% |
| Amazon | 56 | 1.8% |
| Delta | 47 | 1.6% |
| Ledger | 46 | 1.5% |
| Steam | 42 | 1.4% |
Where they were registered
For the 2,219 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 383 | 17.3% | Retail |
| NameBright | 175 | 7.9% | Retail |
| Namecheap | 122 | 5.5% | Retail |
| Dynadot | 110 | 5.0% | Retail |
| Cloudflare | 102 | 4.6% | Retail |
| Squarespace | 92 | 4.2% | Retail |
| Spaceship | 69 | 3.1% | Retail |
| Tucows | 64 | 2.9% | Retail |
| NameSilo | 56 | 2.5% | Retail |
| MarkMonitor | 55 | 2.5% | Brand protection |
Age at first sighting
What the live ones did
1,560 of this week's lookalikes were registered, resolved and checked for a website and mail: 786 (50%) served a website and 614 (39%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
83 tracked live lookalikes went down during the week, a median 8d 8h after they were first seen. Of this week's own lookalikes, 1,584 were seen live and 4 listed by Google Web Risk by the end of the week.
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
google-wallet[.]com, a combosquat of Google. Serves a website and publishes MX records.facebookloginn[.]com, a combosquat of Facebook. Serves a website and publishes MX records.xn--youube-rkb[.]com, a homoglyph of YouTube. Serves a website and publishes MX records.buy-linkedin-account[.]com, a combosquat of LinkedIn. Serves a website and publishes MX records.icloudappnow[.]com, a combosquat of Apple. Serves a website and publishes MX records.microsoftonline-advertising[.]com, a combosquat of Microsoft. Serves a website and publishes MX records.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: October 19 to October 25, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W43.