GreyPhish

Cybersecurity Tooling

[GreyPhish @GreyPhish]

We have recorded 222 domains resembling Home Depot since February 2026, and 190 in the last 90 days alone. Most (84%) are typosquats: a keystroke or two from the real name.

Among the latest: homedepothelper[.]com

@HomeDepot

#brandprotection

[GreyPhish @GreyPhish]

One compromised login credential sat undetected for four months on a vendor SFTP site -- long enough to copy student records (names, DOBs, addresses, school IDs) on potentially millions of California students. Per CDE, SecurityWeek.

[GreyPhish @GreyPhish]

Last week (12–18 Oct): 3,243 new lookalike domains, down 26% on the week before.

Most imitated of 760 brands: Adobe 138, Crypto[.]com 107, United Airlines 104
48% of the 1,496 we checked publish MX records
81 live lookalikes went down

The full report is on our site.

[GreyPhish @GreyPhish]

Delta lookalikes, by the numbers:

602 since February 2026
189 in the last 90 days
108 different endings

Most (82%) are combosquats: the name spelled right with a word added, most often "web" or "service".

A recent one: deltaservicellc[.]co

@Delta

#threatintel

[GreyPhish @GreyPhish]

googlewebservices[.]org started publishing MX records on 18 Oct, 60 days after it was registered in August.

@GooglePlay

#infosec

[GreyPhish @GreyPhish]

telekomcenter[.]at

First seen in March. No live site at our previous check; on 18 Oct it started serving a live site.

It also publishes MX records.

[GreyPhish @GreyPhish]

Registered in September 2013, no MX records at our previous check. On 18 Oct, mydocker[.]com started publishing MX records.

@Docker

#DNS

[GreyPhish @GreyPhish]

1,058 domains that resemble Ledger since February 2026, 282 of them in the last 90 days, on 109 different endings.

Most (86%) are combosquats: the name spelled right with a word added, most often "wallet" or "app".

One of the latest:

ledgerapp-recovery[.]com

@Ledger

[GreyPhish @GreyPhish]

support-clients-microsoft[.]com

A name you'd recognise, plus "support" and "client". First seen on 12 Oct 2026.

It serves a live site and publishes MX records.

@Microsoft

#combosquatting

[GreyPhish @GreyPhish]

One stolen API credential for ConnectWise's MSP backup tool gave an attacker scripted sign-ins across 160+ Microsoft 365 tenants, seconds apart, in sorted ID order. In one tenant, a related app granted itself Global Admin and planted secrets set to expire in 2028. Per Huntress.

[GreyPhish @GreyPhish]

elsevıer[.]com

The substituted letters are lookalikes. Registered as xn--elsever-vfb[.]com.

@ElsevierConnect

#homoglyph

[GreyPhish @GreyPhish]

No live site at our previous check. On 17 Oct, minnecraft[.]net started serving a live site. Registered in February 2011.

@Minecraft

[GreyPhish @GreyPhish]

A recent Amazon lookalike: amazonappeal[.]com

It is one of 1,242 we have recorded since February 2026, 525 of them in the last 90 days.

Most (73%) are combosquats: the name spelled right with a word added, most often "service" or "web".

@amazon

#threatintel #brandprotection

[GreyPhish @GreyPhish]

salesforec[.]com started serving a live site on 15 Oct, 8049 days after it was registered in October 2004.

@salesforce

#DNS

[GreyPhish @GreyPhish]

Whoa, whoa, whoa-- we're creating a digital god. A hundred percent. https://t.co/U7VS1NCBeZ

[GreyPhish @GreyPhish]

A pre-auth zero-day in BeyondTrust's remote-support tool let a China-linked group harvest every credential it stored and wipe the logs -- undetected for a month. The tool meant to secure privileged access became the single point attackers wanted. Per BleepingComputer.

[GreyPhish @GreyPhish]

First seen on 13 Oct 2026:

desta-tis[.]de

One typo away from a name you know: a hyphen added.

It serves a live site.

#DNS

[GreyPhish @GreyPhish]

getapple[.]net started serving a live site on 14 Oct, 1099 days after it was registered in October 2023.

@Apple

#threatintel

[GreyPhish @GreyPhish]

Combosquatting, first seen on 12 Oct 2026:

getfacebook[.]info

A recognisable name plus "get", in one domain.

It serves a live site and publishes MX records.

#combosquatting #infosec

[GreyPhish @GreyPhish]

Registered in November 2024, no MX records at our previous check. On 15 Oct, oracleonline[.]net started publishing MX records.

@Oracle