Cross-customer intelligence from every domain PhishFence monitors. Which TLDs are hosting the most typosquats right now, which registrars keep them alive, which industries are drawing the heat. Anonymized and refreshed every 15 minutes.
Alerts detected
225
Across every monitored brand, last 90 days.
Top TLD
.com
188 variants detected.
Top registrar
MarkMonitor Inc.
139 lookalikes registered here.
Peak 97 alerts / day
Stacked by confidence. A tall red bar is a phishing wave you would have wanted to know about.
Where lookalike domains are being registered. Legacy TLDs dominate by volume; cheap new gTLDs dominate by attacker cost efficiency.
The registrars attackers use most. A high number doesn't mean the registrar is complicit; it correlates with low price, permissive policies, and market share.
Which sectors are absorbing the most attention. Customers tag their protected brand on onboarding; unclassified rows bucket under "Unclassified".
How each alert was caught. CT-log monitoring catches certificates issued for lookalikes before the domain is live; DNS scans catch what's already resolving.
Our scoring across every alert this window. Critical and high are the ones worth paging on; low captures speculative registrations that may not be used for anything.
Our judgement of what each alert actually is. Confirmed phishing is fetched-and-verified; registered lookalike is just a squatting registration without active content.
Updated . Data aggregated across every brand monitored by PhishFence. No customer identifiers or per-brand counts leave this page.