Typosquatting & Brand Impersonation

**Executive summary:** This report analyzes typosquatting and brand-impersonation phishing activity, finding Internet Services (29.2%), Professional Services (26.09%), and Online Shopping (22.3%) to be the most targeted verticals; Google (28.8%), Microsoft (23.6%), and Amazon (22.3%) are the top impersonated brands. Attackers commonly obtain TLS certificates from Let's Encrypt (48.4%), Google Trust Services (21.5%), and GoDaddy (15.2%), register domains via registrars such as GoDaddy (21.7%), NameCheap (7.3%), and NameSilo (6.4%), and frequently use TLDs like .com (39.4%), .xyz (11.1%), and .top (5.4%) to increase the perceived legitimacy of phishing sites.