PhishPin / Brands Live Phishing Data / Telecom & internet
Telecom & internet phishing: which brands are copied the most
42 telecom & internet brands are tracked in PhishPin's index. Together they have 2,349 hostnames in phishing feeds and 88 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated telecom & internet
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | Cox Communications | 20% | 53 · Elevated | 470 | 1 |
| 2 | Telstra | 16% | 51 · Elevated | 386 | 1 |
| 3 | BT | 13% | 49 · Elevated | 316 | 1 |
| 4 | Xfinity & Comcast | 8% | 50 · Elevated | 199 | 3 |
| 5 | O2 | 7% | 47 · Elevated | 175 | 2 |
| 6 | Vodafone | 7% | 46 · Elevated | 161 | 2 |
| 7 | Swisscom | 4% | 41 · Elevated | 103 | 1 |
| 8 | AT&T | 4% | 45 · Elevated | 95 | 4 |
| 9 | TalkTalk | 3% | 42 · Elevated | 76 | 3 |
| 10 | SFR | 3% | 38 · Elevated | 71 | 1 |
| 11 | Virgin Media | 2% | 31 · Moderate | 48 | 0 |
| 12 | Spectrum | 2% | 41 · Elevated | 43 | 6 |
| 13 | T-Mobile | 2% | 40 · Elevated | 43 | 5 |
| 14 | Frontier Communications | 2% | 44 · Elevated | 42 | 11 |
| 15 | Deutsche Telekom | 1% | 33 · Moderate | 30 | 2 |
| 16 | e& (Etisalat) | 1% | 31 · Moderate | 18 | 3 |
| 17 | TELUS | 1% | 24 · Moderate | 12 | 1 |
| 18 | Verizon | 0% | 30 · Moderate | 11 | 5 |
| 19 | Singtel | 0% | 26 · Moderate | 11 | 2 |
| 20 | Optus | 0% | 20 · Moderate | 11 | 0 |
| 21 | Optimum | 0% | 29 · Moderate | 7 | 8 |
| 22 | Jio | 0% | 15 · Moderate | 6 | 0 |
| 23 | CenturyLink | 0% | 13 · Low | 4 | 0 |
| 24 | DIRECTV | 0% | 23 · Moderate | 2 | 12 |
| 25 | MTN | 0% | 16 · Moderate | 2 | 3 |
| 26 | Bouygues Telecom | 0% | 9 · Low | 2 | 0 |
| 27 | Vodacom | 0% | 9 · Low | 2 | 0 |
| 28 | Movistar | 0% | 13 · Low | 1 | 3 |
| 29 | Safaricom | 0% | 13 · Low | 1 | 3 |
| 30 | Telkomsel | 0% | 9 · Low | 1 | 1 |
| 31 | Airtel | 0% | 6 · Low | 0 | 2 |
| 32 | Cricket Wireless | 0% | 4 · Low | 0 | 1 |
| 33 | Metro by T-Mobile | 0% | 4 · Low | 0 | 1 |
| 34 | BSNL | 0% | 0 · Low | 0 | 0 |
| 35 | Boost Mobile | 0% | 0 · Low | 0 | 0 |
| 36 | DISH Network | 0% | 0 · Low | 0 | 0 |
| 37 | Globe Telecom | 0% | 0 · Low | 0 | 0 |
| 38 | Mint Mobile | 0% | 0 · Low | 0 | 0 |
| 39 | Spark NZ | 0% | 0 · Low | 0 | 0 |
| 40 | Straight Talk | 0% | 0 · Low | 0 | 0 |
| 41 | TracFone | 0% | 0 · Low | 0 | 0 |
| 42 | US Cellular | 0% | 0 · Low | 0 | 0 |
Common lures against telecom & internet
- An "unpaid bill" or "service suspension" text with a payment link.
- A fake "account upgrade" or "free phone" offer that asks for card and PIN details.
- A notice that your email or voicemail is full that links to a cloned account page.
- A call or message about a SIM change that pushes you to verify your identity online.
Red flags
- Carriers rarely suspend service by text link with an hour's notice.
- The payment page is not on the provider's official site or app.
- You are asked for your account PIN, SSN or a one-time code to "restore" service.
If you already clicked or entered details
Sign in only through the provider's official app or site, set or change your account PIN, ask the carrier to add a port-out lock, and check that no new lines or forwarding were added.
Is your telecom provider being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which telecom & internet brands are impersonated the most?
Cox Communications leads with 470 hostnames in phishing feeds, followed by Telstra (386) as of 1 Nov 2026.
How can I spot phishing that targets telecom & internet?
Carriers rarely suspend service by text link with an hour's notice. The payment page is not on the provider's official site or app. You are asked for your account PIN, SSN or a one-time code to "restore" service.
What should I do if I fall for a fake telecom provider page?
Sign in only through the provider's official app or site, set or change your account PIN, ask the carrier to add a port-out lock, and check that no new lines or forwarding were added.