PhishPin / Brands Live Phishing Data / Tech, email & cloud
Tech, email & cloud phishing: which brands are copied the most
64 tech, email & cloud brands are tracked in PhishPin's index. Together they have 9,251 hostnames in phishing feeds and 577 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated tech, email & cloud
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | GoDaddy | 29% | 70 · High | 2,711 | 3 |
| 2 | Apple & iCloud | 23% | 88 · Critical | 2,119 | 142 |
| 3 | Microsoft 365 | 13% | 76 · Critical | 1,202 | 34 |
| 4 | Cloudflare | 8% | 64 · High | 719 | 7 |
| 5 | Yahoo | 6% | 50 · Elevated | 565 | 0 |
| 6 | WordPress | 5% | 69 · High | 451 | 39 |
| 7 | 3% | 69 · High | 277 | 76 | |
| 8 | IONOS | 2% | 49 · Elevated | 225 | 2 |
| 9 | Shopify | 2% | 61 · High | 199 | 32 |
| 10 | Dropbox | 1% | 45 · Elevated | 110 | 3 |
| 11 | DocuSign | 1% | 50 · Elevated | 103 | 9 |
| 12 | WeTransfer | 1% | 35 · Elevated | 82 | 0 |
| 13 | Wix | 1% | 39 · Elevated | 62 | 2 |
| 14 | Adobe | 1% | 42 · Elevated | 54 | 5 |
| 15 | Xiaomi | 1% | 51 · Elevated | 48 | 34 |
| 16 | AOL | 0% | 29 · Moderate | 36 | 0 |
| 17 | Zoom | 0% | 40 · Elevated | 28 | 10 |
| 18 | Huawei | 0% | 39 · Elevated | 28 | 8 |
| 19 | Hostinger | 0% | 40 · Elevated | 27 | 11 |
| 20 | Samsung | 0% | 41 · Elevated | 24 | 14 |
| 21 | OpenAI & ChatGPT | 0% | 46 · Elevated | 18 | 58 |
| 22 | Gmail | 0% | 31 · Moderate | 18 | 3 |
| 23 | Citrix | 0% | 29 · Moderate | 17 | 2 |
| 24 | Zendesk | 0% | 22 · Moderate | 15 | 0 |
| 25 | GitHub | 0% | 35 · Elevated | 14 | 11 |
| 26 | Canva | 0% | 24 · Moderate | 12 | 1 |
| 27 | Norton | 0% | 34 · Moderate | 10 | 15 |
| 28 | McAfee | 0% | 20 · Moderate | 7 | 1 |
| 29 | SendGrid | 0% | 20 · Moderate | 7 | 1 |
| 30 | Okta | 0% | 24 · Moderate | 6 | 4 |
| 31 | Sony | 0% | 22 · Moderate | 6 | 2 |
| 32 | Bluehost | 0% | 19 · Moderate | 6 | 1 |
| 33 | Salesforce | 0% | 26 · Moderate | 5 | 7 |
| 34 | Dell | 0% | 19 · Moderate | 4 | 2 |
| 35 | Twilio | 0% | 19 · Moderate | 4 | 2 |
| 36 | Namecheap | 0% | 17 · Moderate | 4 | 1 |
| 37 | Proton Mail | 0% | 13 · Low | 4 | 0 |
| 38 | Oracle | 0% | 22 · Moderate | 3 | 6 |
| 39 | Cisco | 0% | 11 · Low | 3 | 0 |
| 40 | Freshworks | 0% | 15 · Moderate | 2 | 2 |
| 41 | Zoho | 0% | 13 · Low | 2 | 1 |
| 42 | Figma | 0% | 9 · Low | 2 | 0 |
| 43 | Palo Alto Networks | 0% | 9 · Low | 2 | 0 |
| 44 | Squarespace | 0% | 9 · Low | 2 | 0 |
| 45 | Lenovo | 0% | 19 · Moderate | 1 | 10 |
| 46 | Sophos | 0% | 13 · Low | 1 | 3 |
| 47 | Avast | 0% | 9 · Low | 1 | 1 |
| 48 | Webex | 0% | 9 · Low | 1 | 1 |
| 49 | Bitdefender | 0% | 5 · Low | 1 | 0 |
| 50 | HP | 0% | 5 · Low | 1 | 0 |
| 51 | Slack | 0% | 5 · Low | 1 | 0 |
| 52 | Trend Micro | 0% | 5 · Low | 1 | 0 |
| 53 | Trello | 0% | 10 · Low | 0 | 5 |
| 54 | 1Password | 0% | 6 · Low | 0 | 2 |
| 55 | AnyDesk | 0% | 4 · Low | 0 | 1 |
| 56 | Fortinet | 0% | 4 · Low | 0 | 1 |
| 57 | TeamViewer | 0% | 4 · Low | 0 | 1 |
| 58 | VMware | 0% | 4 · Low | 0 | 1 |
| 59 | Atlassian (Jira & Confluence) | 0% | 0 · Low | 0 | 0 |
| 60 | CrowdStrike | 0% | 0 · Low | 0 | 0 |
| 61 | Kaspersky | 0% | 0 · Low | 0 | 0 |
| 62 | LastPass | 0% | 0 · Low | 0 | 0 |
| 63 | Malwarebytes | 0% | 0 · Low | 0 | 0 |
| 64 | Notion | 0% | 0 · Low | 0 | 0 |
Common lures against tech, email & cloud
- A "password expires today" or "mailbox full" email with a link to a fake sign-in page.
- A shared-document or e-signature request from a compromised contact that leads to a credential-harvesting page.
- A security alert about a login from an unfamiliar country that asks you to "secure your account".
- A billing or renewal notice with a phone number to call for a refund.
Red flags
- The sign-in page is on a domain you do not recognise, even if the logo and layout look perfect.
- A document or voicemail arrives from a colleague you were not expecting to hear from.
- The message pushes you to sign in immediately instead of going to the service yourself.
If you already clicked or entered details
Change the password from a clean device, sign out all sessions, review mailbox rules and connected apps for anything you did not create, and turn on multi-factor authentication. Tell your IT team, because stolen mailbox logins are often used to attack colleagues next.
Is your technology company being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which tech, email & cloud brands are impersonated the most?
GoDaddy leads with 2,711 hostnames in phishing feeds, followed by Apple & iCloud (2,119) as of 2 Nov 2026.
How can I spot phishing that targets tech, email & cloud?
The sign-in page is on a domain you do not recognise, even if the logo and layout look perfect. A document or voicemail arrives from a colleague you were not expecting to hear from. The message pushes you to sign in immediately instead of going to the service yourself.
What should I do if I fall for a fake technology company page?
Change the password from a clean device, sign out all sessions, review mailbox rules and connected apps for anything you did not create, and turn on multi-factor authentication. Tell your IT team, because stolen mailbox logins are often used to attack colleagues next.