Instagram and WhatsApp are the most impersonated platforms we track
They carry 51% of the domains with a critical detection across this platform set.
What we identified on 2026-11-04
10 detection surfaces, each stating the period it covers. Impersonation figures count registrable domains with a critical detection. Free to quote with attribution.
Identity capture
Taking the login. Two separate detections, not halves of a total — a few domains trip both.
3.8× the 5.47% baseline across the 540,675 domains we hold registration data for. Measured over 1,691 critical detections to date, 5.55% of all of them, as of 2026-11-05.
domains impersonating a platform
5 observations of those domains, on the most recent complete day shared by every feed
Source: Datazag · as of 2026-11-04
login pages built to look like a service someone already trusts
on 2026-11-04 · 5 observations
typical day 147 domains · median over 48 complete days
domains impersonating a watchlist brand
18 observations of those domains, on the most recent complete day shared by every feed
Source: Datazag · as of 2026-11-04
aimed at a name on the watchlist — a test list, so read it as a sample rather than a total
on 2026-11-04 · 18 observations
typical day 84 domains · median over 91 complete days
Command and control
Using it. Where a bought credential turns into access.
malware domains
40,144 of 64,402 domains on the malware list
Source: Datazag · as of 2026-11-05
listed by an indicator feed and present in our corpus · standing list as of 2026-11-05
c2 domains
11 of 60 domains on the c2 list
Source: Datazag · as of 2026-11-05
listed by an indicator feed and present in our corpus · standing list as of 2026-11-05
bulletproof hosting
546 distinct domains, on the most recent complete day shared by every feed
Source: Datazag · as of 2026-11-04
hosting that ignores abuse reports · all severities
typical day 1,562 · median over 77 complete days
Drill downCover and reach
Where campaigns hide. Counts over the whole corpus, not a single day.
prefixes carrying a listed threat IP
the whole corpus, on the snapshot the threat artifact was built from
Source: Datazag · as of 2026-11-04
prefixes on a do-not-route list
the whole corpus, on the snapshot the threat artifact was built from
Source: Datazag · as of 2026-11-04
IP addresses with a threat score
the whole corpus, on the snapshot the threat artifact was built from
Source: Datazag · as of 2026-11-04
domains using a disposable email provider
749,225 of 367.9M resolving domains
Source: Datazag · as of 2026-11-04
domains parked on a recognized platform
35,510,308 of 367.9M resolving domains
Source: Datazag · as of 2026-11-04
Who is being impersonated
A page built to pass for a service, or a domain built to pass for a name.
Platforms impersonated
Domains with a critical detection, over 48 complete days.
- 1Instagram4,76992,336 observations
- 2WhatsApp2,70857,050 observations
- 3Amazon2,19626,185 observations
- 4Google1,01615,942 observations
- 5Netflix94318,989 observations
- 6Microsoft60311,679 observations
- 7Pinterest48910,685 observations
- 8YouTube4568,708 observations
Brands impersonated
Domains with a critical detection, over 91 complete days. Watchlist brands only. Customer brands are never published.
- 1Binance1,23117,245 observations
- 2Chase3002,253 observations
- 3WhatsApp2962,655 observations
- 4NatWest1844,091 observations
- 5Kaufland67869 observations
- 6Baidu58412 observations
- 7Apple44477 observations
- 8Toyota38668 observations
This ranks a defined watchlist, not the internet: it shows what is most impersonated among the brands we watch. Watch terms that are ordinary words (brand, square, jordan, enterprise, prime, mobil) are excluded, because a domain containing the word is not impersonating a brand by that name.
United States, Singapore and Hong Kong host the most detected impersonation infrastructure
They account for 94% of domains with a critical detection in this sample. Hosting location follows where capacity is cheap and plentiful, so it describes the market an operator bought from rather than the operator.
Countries hosting domains with a critical platform impersonation detection
Detection volume is uneven from day to day
The busiest of 21 days carried 36 detections against a typical 16. The variation is real but not dominated by single events.
Red alerts arrive in bursts, not at a steady rate
22 domains on a typical day, 88 on the busiest of the last 28 complete days. Registrable domains, counted once however often they were observed. Critical severity only — the band that means act now rather than review later.
iCloud was the most impersonated platform in the week beginning 2026-10-26
Ranked by registrable domains with a critical detection in the week beginning 2026-10-26. The arrow is the move against the week before. Only the top eight are published, so “unranked” means outside that week’s eight rather than newly appearing. The newest ranked week is the newest with a critical detection, which is not always last week.
| # | Platform | Domains | Observations | vs week before |
|---|---|---|---|---|
| 1 | iCloud | 2 | 2 | ▲ 1 |
All of it lands on 317 networks
Every critical impersonation detection resolves to a set of autonomous systems small enough to list, and 181 of them carry ten or more. Impersonation is not spread thinly across the internet; it concentrates.
Networks hosting a critical impersonation detection
complete collection days, across the platform and brand lanes
Source: Datazag · as of 2026-11-04
Counted over complete collection days, across both impersonation lanes.
Networks carrying ten or more critical impersonation detections
181 of 317 networks hosting a critical detection
Source: Datazag · as of 2026-11-04
A network with one detection may be a victim of its own customer. Ten is a pattern.
The figures
Free to quote with attribution. Open the notes on a card before you do.
Impersonation domains registered in the last 90 days
350 of 1,691 critical impersonation domains with registration data
Source: Datazag · as of 2026-11-05
Impersonation domains whose first certificate is under 30 days old
181 of 13,645 critical impersonation domains with a certificate observed
Source: Datazag · as of 2026-11-05
Critical impersonation domains with registration data
1,691 of 30,488 critical impersonation domains
Source: Datazag · as of 2026-11-05
Impersonation domains that can receive mail
207 of 8,264 critical impersonation domains we can observe
Source: Datazag · as of 2026-11-05
Query these statistics directly
Every figure on this page is served as Parquet. Same format as the corpus itself.
SELECT * FROM read_parquet('https://observatory.datazag.com/observatory_statistics.parquet');