Phishing Index / Week 46, 2026 (7 days to 9 Nov)
Most impersonated brands in phishing - Week 46, 2026 (7 days to 9 Nov)
Facebook, USPS and Coinbase top the PhishPin Phishing Index for the 7 days to 9 Nov 2026. 1,030 brands were impersonated across 709,841 phishing hostnames; Google rose fastest.
📄 Extended PDF edition: Top 50 brands · all key findings · top brands in every industry
Top 25 most impersonated brands
Phishing hostnames using each brand name, and the change versus the previous period.
Bait words: account verify support · example lure: www[.]googletagmanager[.]com
Which industries are targeted
Share of brand-impersonating phishing hostnames by industry.
Phishing activity trend
Total phishing hostnames for the 2,108 brands tracked throughout the period (94,767 to 94,815).
Most new lookalike domains
Registered in the last 15 days.
How attackers build fake addresses
Patterns across every brand-impersonating hostname in the period.
DOMAIN ENDINGS
BAIT WORDS
Example lures seen this period
A few illustrative hostnames, defanged so they cannot be clicked. Not a complete list.
m-facebookk[.]com[.]vnuspss[.]pages[.]dev237780coinbase[.]comwhatsappweb[.]netportal-liv-e-ap-p-ledger[.]typedream[.]appallegrolokalnie[.]pl-oferta723106578[.]sbswebtelegram[.]eu[.]orgappleid-suporte[.]comKey findings
- Facebook was the most impersonated brand in PhishPin's index in the 7 days to 9 November 2026, with 7,394 phishing hostnames using its name.
- The three most impersonated brands were Facebook, USPS and Coinbase.
- 1,030 of the 2,108 brands PhishPin tracks were being impersonated, across 709,841 phishing hostnames analysed.
- Crypto exchanges & wallets was the most targeted industry (23,383 phishing hosts across 74 brands).
- The fastest-rising brand was Google, up 6 phishing hosts (+1%) compared with the previous period.
- QQ / Tencent attracted the most new lookalike domain registrations (813 in 15 days).
- The most common bait word in phishing hostnames was "login".
Methodology
PhishPin indexes every hostname reported by six independent phishing and malware intelligence engines and screens newly registered domains from the previous 15 days. A hostname counts toward a brand when the brand name appears in it as a distinct word or distinctive string and the host is not one of the brand's own domains. Counts show what was reported in the period, not what is online at one moment; many hosts have already been taken down. Changes compare with the closest earlier daily snapshot (2026-11-07). Data comes from PhishPin's engine sources and is provided as is. Listed hostnames may be phishing, infected or carry malware, so never visit them, and have a certified security expert review any data before you act on it; PhishPin is not responsible for loss or damage from its use (see phishpin.com/terms/).
Journalists, researchers and bloggers are welcome to quote these findings - please credit PhishPin and link to this page.
PhishPin (2026). Most impersonated brands in phishing - Week 46, 2026 (7 days to 9 Nov). PhishPin Phishing Index. https://www.phishpin.com/reports/2026-w46← Week 45, 2026 (7 days to 2 Nov)All reports
Is your brand in this index?
Get a confidential 24-hour audit of the lookalike domains and phishing sites targeting your brand.
Unlock the extended report
Top 50 brands, every key finding and the top brands in each industry. Tell us who you are, then download the PDF or view the charts online.