Lookalike domain report: October 26 to November 1, 2026
Domains that imitate widely used brands, first seen in Certificate Transparency logs and ICANN zone files during this week: how many, which brands, where they were registered and what the live ones did. Free to cite with a link.
Published . A stored snapshot: these figures do not change. This week so far.
- 8,258 certificates for unregistered .ph, .com.ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Lookalikes per day
1,561 typosquats, 1,618 combosquats and 165 homoglyphs; 3,075 first seen in certificate logs and 269 in zone files. The week before had 3,032. Most were on .com (2,394), .net (90), .org (76), .xyz (61).
Most imitated brands
| Brand | Lookalikes | Share |
|---|---|---|
| Adobe | 139 | 4.2% |
| Crypto.com | 118 | 3.5% |
| Signal | 102 | 3.1% |
| Apple | 67 | 2.0% |
| United Airlines | 62 | 1.9% |
| Amazon | 60 | 1.8% |
| Steam | 57 | 1.7% |
| 54 | 1.6% | |
| Microsoft | 50 | 1.5% |
| 42 | 1.3% |
Where they were registered
For the 2,597 lookalikes with a registrar in WHOIS (100% of the week). Brand-protection registrars mostly hold defensive registrations made by the brands themselves.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| GoDaddy | 452 | 17.4% | Retail |
| Media Elite Holdings | 288 | 11.1% | Retail |
| NameBright | 202 | 7.8% | Retail |
| Namecheap | 107 | 4.1% | Retail |
| Cloudflare | 105 | 4.0% | Retail |
| Dynadot | 99 | 3.8% | Retail |
| Key-Systems | 90 | 3.5% | Retail |
| Spaceship | 89 | 3.4% | Retail |
| Squarespace | 87 | 3.4% | Retail |
| Tucows | 80 | 3.1% | Retail |
Age at first sighting
What the live ones did
1,560 of this week's lookalikes were registered, resolved and checked for a website and mail: 850 (54%) served a website and 720 (46%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
121 tracked live lookalikes went down during the week, a median 10d 3h after they were first seen. Of this week's own lookalikes, 1,579 were seen live and 3 listed by Google Web Risk by the end of the week.
Examples
One per brand, written with [.] so they cannot be clicked. A lookalike resembles a brand; it is not necessarily malicious, and none of these is a claim about who registered it or why.
firebaseappid[.]com, a combosquat of Google. Serves a website and publishes MX records.getfacebook[.]com, a combosquat of Facebook. Serves a website and publishes MX records.linkedinrecoverypartner[.]com, a combosquat of LinkedIn. Serves a website and publishes MX records.appleunlocks[.]com, a combosquat of Apple. Serves a website and publishes MX records.outlookportal[.]net, a combosquat of Microsoft. Serves a website and publishes MX records.mytiktok[.]at, a combosquat of TikTok. Serves a website and publishes MX records.
How this is counted
A week runs Monday to Sunday, UTC. Each domain is counted once, in the week Greyphish first saw it, and only for about 1,250 widely impersonated public brands: domains Greyphish customers watch, and anything derived from their watchlists, are excluded. The full method and caveats are on the live report.
Citing this week
Greyphish, "Lookalike domain report: October 26 to November 1, 2026", Sima Technologies LLC, https://greyphish.com/report/2026-W44.