Phishing Index / Week 44, 2026 (7 days to 30 Oct)
Most impersonated brands in phishing - Week 44, 2026 (7 days to 30 Oct)
Facebook, USPS and WhatsApp top the PhishPin Phishing Index for the 7 days to 30 Oct 2026. 396 brands were impersonated across 478,112 phishing hostnames; GoDaddy rose fastest.
📄 Extended PDF edition: Top 50 brands · all key findings · top brands in every industry
Top 25 most impersonated brands
Phishing hostnames using each brand name, and the change versus the previous period.
Bait words: signin update support · example lure: comcast3dsf[.]webcindario[.]com
Which industries are targeted
Share of brand-impersonating phishing hostnames by industry.
Phishing activity trend
Total phishing hostnames for the 279 brands tracked throughout the period (47,302 to 48,069).
Biggest risers
Largest increase in phishing hostnames.
How attackers build fake addresses
Patterns across every brand-impersonating hostname in the period.
DOMAIN ENDINGS
BAIT WORDS
Example lures seen this period
A few illustrative hostnames, defanged so they cannot be clicked. Not a complete list.
m-facebookk[.]com[.]vnusps[.]ovfki[.]cnwhatsapp[.]blazagency[.]comorangepro0[.]godaddysites[.]comallegro[.]1290hh905982[.]restwebtelegram[.]eu[.]orgvww-icloud[.]commail[.]8724319-coinbase[.]comKey findings
- Facebook was the most impersonated brand in PhishPin's index in the 7 days to 30 October 2026, with 6,836 phishing hostnames using its name.
- The three most impersonated brands were Facebook, USPS and WhatsApp.
- 396 of the 579 brands PhishPin tracks were being impersonated, across 478,112 phishing hostnames analysed.
- Social & messaging was the most targeted industry (15,700 phishing hosts across 17 brands).
- The fastest-rising brand was GoDaddy, up 137 phishing hosts (+5%) compared with the previous period.
- WhatsApp attracted the most new lookalike domain registrations (223 in 15 days).
- The most common bait word in phishing hostnames was "login".
Methodology
PhishPin indexes every hostname reported by six independent phishing and malware intelligence engines and screens newly registered domains from the previous 15 days. A hostname counts toward a brand when the brand name appears in it as a distinct word or distinctive string and the host is not one of the brand's own domains. Counts show what was reported in the period, not what is online at one moment; many hosts have already been taken down. Changes compare with the closest earlier daily snapshot (2026-10-26).
Journalists, researchers and bloggers are welcome to quote these findings - please credit PhishPin and link to this page.
PhishPin (2026). Most impersonated brands in phishing - Week 44, 2026 (7 days to 30 Oct). PhishPin Phishing Index. https://www.phishpin.com/reports/2026-w44Is your brand in this index?
Get a confidential 24-hour audit of the lookalike domains and phishing sites targeting your brand.
Unlock the extended report
Top 50 brands, every key finding and the top brands in each industry. Tell us who you are, then download the PDF or view the charts online.