PhishPin / Brands Live Phishing Data / Social & messaging
Social & messaging phishing: which brands are copied the most
22 social & messaging brands are tracked in PhishPin's index. Together they have 15,705 hostnames in phishing feeds and 647 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated social & messaging
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | 44% | 90 · Critical | 6,838 | 37 | |
| 2 | 21% | 94 · Critical | 3,338 | 228 | |
| 3 | Telegram | 14% | 83 · Critical | 2,220 | 51 |
| 4 | 7% | 73 · High | 1,113 | 21 | |
| 5 | TikTok | 5% | 76 · Critical | 745 | 69 |
| 6 | Discord | 3% | 70 · High | 540 | 36 |
| 7 | X (Twitter) | 2% | 63 · High | 355 | 18 |
| 8 | YouTube | 1% | 58 · High | 136 | 28 |
| 9 | VK | 1% | 50 · Elevated | 131 | 7 |
| 10 | Snapchat | 1% | 47 · Elevated | 116 | 4 |
| 11 | 1% | 52 · Elevated | 105 | 14 | |
| 12 | LINE | 0% | 45 · Elevated | 31 | 23 |
| 13 | 0% | 43 · Elevated | 14 | 51 | |
| 14 | Tinder | 0% | 34 · Moderate | 8 | 21 |
| 15 | Twitch | 0% | 30 · Moderate | 8 | 8 |
| 16 | 0% | 28 · Moderate | 6 | 9 | |
| 17 | 0% | 14 · Low | 1 | 4 | |
| 18 | KakaoTalk | 0% | 15 · Moderate | 0 | 13 |
| 19 | 0% | 6 · Low | 0 | 2 | |
| 20 | Bluesky | 0% | 4 · Low | 0 | 1 |
| 21 | Quora | 0% | 4 · Low | 0 | 1 |
| 22 | Viber | 0% | 4 · Low | 0 | 1 |
Common lures against social & messaging
- A "your account will be disabled" warning from a fake copyright or policy team.
- A verification-badge offer or "you have been selected" message that leads to a cloned login.
- A login-code request that tricks you into handing over the SMS or app code.
- A message from a hacked friend with a link to "see this video of you".
Red flags
- Official platforms do not threaten to delete your account within hours.
- Links come through DMs or comments instead of the app's own notification centre.
- You are asked for a login code, or to log in again from a link.
If you already clicked or entered details
Recover the account through the platform's own help page, revoke unknown sessions and connected apps, reset the password and switch on authenticator-app 2FA. Warn your contacts that messages from you may be fake.
Is your social platform being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which social & messaging brands are impersonated the most?
Facebook leads with 6,838 hostnames in phishing feeds, followed by WhatsApp (3,338) as of 1 Nov 2026.
How can I spot phishing that targets social & messaging?
Official platforms do not threaten to delete your account within hours. Links come through DMs or comments instead of the app's own notification centre. You are asked for a login code, or to log in again from a link.
What should I do if I fall for a fake social platform page?
Recover the account through the platform's own help page, revoke unknown sessions and connected apps, reset the password and switch on authenticator-app 2FA. Warn your contacts that messages from you may be fake.