Phishing Index / Week 45, 2026 (7 days to 2 Nov)
Most impersonated brands in phishing - Week 45, 2026 (7 days to 2 Nov)
Facebook, USPS and WhatsApp top the PhishPin Phishing Index for the 7 days to 2 Nov 2026. 396 brands were impersonated across 478,043 phishing hostnames; GoDaddy rose fastest.
📄 Extended PDF edition: Top 50 brands · all key findings · top brands in every industry
Top 25 most impersonated brands
Phishing hostnames using each brand name, and the change versus the previous period.
Bait words: signin update support · example lure: comcast-xi[.]vercel[.]app
Which industries are targeted
Share of brand-impersonating phishing hostnames by industry.
Phishing activity trend
Total phishing hostnames for the 279 brands tracked throughout the period (47,302 to 48,069).
Biggest risers
Largest increase in phishing hostnames.
Most new lookalike domains
Registered in the last 15 days.
How attackers build fake addresses
Patterns across every brand-impersonating hostname in the period.
DOMAIN ENDINGS
BAIT WORDS
Example lures seen this period
A few illustrative hostnames, defanged so they cannot be clicked. Not a complete list.
m-facebookk[.]com[.]vnusps[.]serveftp[.]comwhatsapp[.]blazagency[.]comorangepro0[.]godaddysites[.]comallegro[.]1290hh905982[.]restwebtelegram[.]eu[.]orgvww-icloud[.]comcoinbase-connetct[.]vercel[.]appKey findings
- Facebook was the most impersonated brand in PhishPin's index in the 7 days to 2 November 2026, with 6,839 phishing hostnames using its name.
- The three most impersonated brands were Facebook, USPS and WhatsApp.
- 396 of the 579 brands PhishPin tracks were being impersonated, across 478,043 phishing hostnames analysed.
- Social & messaging was the most targeted industry (15,707 phishing hosts across 17 brands).
- The fastest-rising brand was GoDaddy, up 137 phishing hosts (+5%) compared with the previous period.
- WhatsApp attracted the most new lookalike domain registrations (225 in 15 days).
- The most common bait word in phishing hostnames was "login".
Methodology
PhishPin indexes every hostname reported by six independent phishing and malware intelligence engines and screens newly registered domains from the previous 15 days. A hostname counts toward a brand when the brand name appears in it as a distinct word or distinctive string and the host is not one of the brand's own domains. Counts show what was reported in the period, not what is online at one moment; many hosts have already been taken down. Changes compare with the closest earlier daily snapshot (2026-10-26).
Journalists, researchers and bloggers are welcome to quote these findings - please credit PhishPin and link to this page.
PhishPin (2026). Most impersonated brands in phishing - Week 45, 2026 (7 days to 2 Nov). PhishPin Phishing Index. https://www.phishpin.com/reports/2026-w45Is your brand in this index?
Get a confidential 24-hour audit of the lookalike domains and phishing sites targeting your brand.
Unlock the extended report
Top 50 brands, every key finding and the top brands in each industry. Tell us who you are, then download the PDF or view the charts online.