Phishing Index / October 2026
Most impersonated brands in phishing: October 2026
Facebook, USPS and WhatsApp top the PhishPin Phishing Index for October 2026. 396 brands were impersonated across 478,081 phishing hostnames; GoDaddy rose fastest.
📄 Extended PDF edition: Top 50 brands · all key findings · top brands in every industry
Top 25 most impersonated brands
Phishing hostnames using each brand name, and the change versus the previous period.
Bait words: signin update support · example lure: comcast3dsf[.]webcindario[.]com
Which industries are targeted
Share of brand-impersonating phishing hostnames by industry.
Phishing activity trend
Total phishing hostnames for the 279 brands tracked throughout the period (47,302 to 48,069).
Biggest risers
Largest increase in phishing hostnames.
Most new lookalike domains
Registered in the last 15 days.
How attackers build fake addresses
Patterns across every brand-impersonating hostname in the period.
DOMAIN ENDINGS
BAIT WORDS
Example lures seen this period
A few illustrative hostnames, defanged so they cannot be clicked. Not a complete list.
m-facebookk[.]com[.]vnuspss[.]pages[.]devwhatsapp[.]blazagency[.]comorangepro0[.]godaddysites[.]comallegro[.]1290hh905982[.]restwebtelegram[.]eu[.]orgapple-casereport[.]commail[.]8724319-coinbase[.]comKey findings
- Facebook was the most impersonated brand in PhishPin's index for October 2026, with 6,838 phishing hostnames using its name.
- The three most impersonated brands were Facebook, USPS and WhatsApp.
- 396 of the 579 brands PhishPin tracks were being impersonated, across 478,081 phishing hostnames analysed.
- Social & messaging was the most targeted industry (15,705 phishing hosts across 17 brands).
- The fastest-rising brand was GoDaddy, up 137 phishing hosts (+5%) compared with the previous period.
- WhatsApp attracted the most new lookalike domain registrations (228 in 15 days).
- The most common bait word in phishing hostnames was "login".
- Daily tracking began on 26 October 2026, so this first monthly report covers 26-31 October 2026.
Methodology
PhishPin indexes every hostname reported by six independent phishing and malware intelligence engines and screens newly registered domains from the previous 15 days. A hostname counts toward a brand when the brand name appears in it as a distinct word or distinctive string and the host is not one of the brand's own domains. Counts show what was reported in the period, not what is online at one moment; many hosts have already been taken down. Changes compare with the closest earlier daily snapshot (2026-10-26). Daily tracking began on 26 October 2026, so this first monthly report covers 26-31 October 2026.
Journalists, researchers and bloggers are welcome to quote these findings - please credit PhishPin and link to this page.
PhishPin (2026). Most impersonated brands in phishing: October 2026. PhishPin Phishing Index. https://www.phishpin.com/reports/2026-10← Week 44, 2026 (7 days to 30 Oct)All reports
Is your brand in this index?
Get a confidential 24-hour audit of the lookalike domains and phishing sites targeting your brand.
Unlock the extended report
Top 50 brands, every key finding and the top brands in each industry. Tell us who you are, then download the PDF or view the charts online.