GreyPhish

Cybersecurity Tooling

[GreyPhish @GreyPhish]

Delta lookalikes, by the numbers:

602 since February 2026
189 in the last 90 days
108 different endings

Most (82%) are combosquats: the name spelled right with a word added, most often "web" or "service".

A recent one: deltaservicellc[.]co

@Delta

#threatintel

[GreyPhish @GreyPhish]

googlewebservices[.]org started publishing MX records on 18 Oct, 60 days after it was registered in August.

@GooglePlay

#infosec

[GreyPhish @GreyPhish]

telekomcenter[.]at

First seen in March. No live site at our previous check; on 18 Oct it started serving a live site.

It also publishes MX records.

[GreyPhish @GreyPhish]

Registered in September 2013, no MX records at our previous check. On 18 Oct, mydocker[.]com started publishing MX records.

@Docker

#DNS

[GreyPhish @GreyPhish]

1,058 domains that resemble Ledger since February 2026, 282 of them in the last 90 days, on 109 different endings.

Most (86%) are combosquats: the name spelled right with a word added, most often "wallet" or "app".

One of the latest:

ledgerapp-recovery[.]com

@Ledger

[GreyPhish @GreyPhish]

support-clients-microsoft[.]com

A name you'd recognise, plus "support" and "client". First seen on 12 Oct 2026.

It serves a live site and publishes MX records.

@Microsoft

#combosquatting

[GreyPhish @GreyPhish]

One stolen API credential for ConnectWise's MSP backup tool gave an attacker scripted sign-ins across 160+ Microsoft 365 tenants, seconds apart, in sorted ID order. In one tenant, a related app granted itself Global Admin and planted secrets set to expire in 2028. Per Huntress.

[GreyPhish @GreyPhish]

elsevıer[.]com

The substituted letters are lookalikes. Registered as xn--elsever-vfb[.]com.

@ElsevierConnect

#homoglyph

[GreyPhish @GreyPhish]

No live site at our previous check. On 17 Oct, minnecraft[.]net started serving a live site. Registered in February 2011.

@Minecraft

[GreyPhish @GreyPhish]

A recent Amazon lookalike: amazonappeal[.]com

It is one of 1,242 we have recorded since February 2026, 525 of them in the last 90 days.

Most (73%) are combosquats: the name spelled right with a word added, most often "service" or "web".

@amazon

#threatintel #brandprotection

[GreyPhish @GreyPhish]

salesforec[.]com started serving a live site on 15 Oct, 8049 days after it was registered in October 2004.

@salesforce

#DNS

[GreyPhish @GreyPhish]

Whoa, whoa, whoa-- we're creating a digital god. A hundred percent. https://t.co/U7VS1NCBeZ

[GreyPhish @GreyPhish]

A pre-auth zero-day in BeyondTrust's remote-support tool let a China-linked group harvest every credential it stored and wipe the logs -- undetected for a month. The tool meant to secure privileged access became the single point attackers wanted. Per BleepingComputer.

[GreyPhish @GreyPhish]

First seen on 13 Oct 2026:

desta-tis[.]de

One typo away from a name you know: a hyphen added.

It serves a live site.

#DNS

[GreyPhish @GreyPhish]

getapple[.]net started serving a live site on 14 Oct, 1099 days after it was registered in October 2023.

@Apple

#threatintel

[GreyPhish @GreyPhish]

Combosquatting, first seen on 12 Oct 2026:

getfacebook[.]info

A recognisable name plus "get", in one domain.

It serves a live site and publishes MX records.

#combosquatting #infosec

[GreyPhish @GreyPhish]

Registered in November 2024, no MX records at our previous check. On 15 Oct, oracleonline[.]net started publishing MX records.

@Oracle

[GreyPhish @GreyPhish]

What the address bar would show: krogēr[.]com
What was registered: xn--krogr-lza[.]com

The e is an accented Latin lookalike.

@kroger

#IDN #homoglyph

[GreyPhish @GreyPhish]

Microsoft and Japan police took down YAM Store, a phishing-as-a-service marketplace behind 1 billion+ brand-impersonation messages to 75,000+ orgs in 150 countries, built on 17,000 phishing domains. No inbox filter outruns that scale. Per BleepingComputer.

[GreyPhish @GreyPhish]

No MX records at our previous check. On 14 Oct, citrixwebspace[.]com started publishing MX records. Registered in September 2018.

@citrix

#typosquatting #infosec