Where Phishing Lives in 2026: 29,300 Indicators Analyzed

TL;DR — We analyzed 29,300 phishing indicators that PhishEye's feeds and hunting collected between 15 July and 20 October 2026. Almost a third of them (9,169, or 31.3%) do not sit on a domain the attacker registered at all, but on a free hosting, site-builder, developer or storage platform. Google's free services host more of that phishing than Cloudflare's: 3,560 indicators on Firebase Hosting, Blogger, Google Sites, Google Docs and smaller Google services, against 2,354 on Cloudflare Pages, Workers, R2 and Tunnels. Vercel (1,046) and GitHub Pages (662) come next, and those four operators carry 83% of all platform-hosted phishing in the data. That is also why .app (2,839) and .dev (2,503) are the second and third most common TLDs after .com: 93.8% of the .dev indicators are pages.dev, workers.dev or r2.dev subdomains, and more than two in five of the .app ones are on vercel.app, netlify.app or lovable.app. The .dev ones are platform addresses, not registered domains, and so are many of the .app ones. Among the named public brands, Google (1,168), Roblox (827) and Facebook/Meta (644) lead, and three crypto wallets together (Ledger, Trezor, MetaMask) account for 351. No public feed saw more than a third of the data: the largest, OpenPhish, contributed 9,161 (31.3%), while PhishEye's own Certificate Transparency and MerkleMap hunting found 10,656, almost none of which any public feed reported.

About this data. This is PhishEye's own data, not a synthesis of other reports. It is an aggregate export, taken on 20 October 2026, of the phishing indicators (URLs, domains and IP addresses) in PhishEye's threat feed: what the public feeds we ingest published (OpenPhish, PhishTank, PhishStats, Phishunt, TweetFeed, urlscan.io title searches and four bulk blocklists), plus what our own Certificate Transparency and MerkleMap hunting found, mostly for the brands we monitor. Every indicator was first seen between 15 July and 20 October 2026. Indicators that no source re-reports for 30 days are deleted unless they matched a brand we protect, so this is a recent-weighted snapshot of what our feeds and hunting collected, not a census of all phishing on the internet. Brands that PhishEye monitors for customers are pooled and never named. The export contains no URLs, domains or customer data, only counts. We publish the tables behind every chart below as CSV and JSON.

Why we published this

Most phishing statistics describe email: how many messages, which lures, which brand was in the subject line. Our 2026 phishing statistics roundup collects the best of those. This report looks at the other end of the link: where the phishing page itself is hosted, which TLDs it sits under, which brands it impersonates, and which sources ever saw it. Those are the questions that decide how fast a page can be reported, blocked and taken down, and they are questions a phishing-protection company can answer from its own pipeline.

Five charts below show the main tables, each followed by what we think defenders should do about it. The numbers are counts of unique indicators, not of attacks, emails or victims, and the limits of the data are set out in the methodology section.

Almost a third of phishing sits on free platforms

Of the 29,300 indicators, 19,717 (67.3%) are on a domain of their own: one the attacker registered, or a legitimate site they compromised. The export cannot tell those two apart. 414 (1.4%) point straight at an IP address. The remaining 9,169 (31.3%) live on someone else's platform: a subdomain such as <project>.pages.dev or <project>.web.app, a Blogger blog, a Google Sites page, a Google Docs or Forms link, a GitHub Pages site, an IPFS gateway path or a public storage bucket. We matched each host against 39 groups of free hosting, site-builder, developer and storage services.

That 31.3% probably understates platform hosting in public phishing reports. More than a third of this data comes from our own Certificate Transparency hunting, which by design looks for newly certified lookalike domains, and those land in the own-domain bucket: of the 6,012 indicators we have probed for liveness (5,931 of them CT detections), 5,760 (95.8%) sit on own or other domains. This export does not break hosting down by source, so we cannot give the platform share for public-feed reports alone.

The attraction for attackers is easy to see. A platform subdomain costs nothing, needs no registration and no payment details, is live in seconds, comes with a valid TLS certificate, and inherits the reputation of a parent domain that no company can afford to block. It also sidesteps every control that watches new domain registrations, because nothing is registered.

What defenders should do:

• Do not allow-list platform parent domains. web.app, pages.dev, vercel.app, github.io and blogspot.com host legitimate sites and phishing side by side. Mail and web filters should judge the full hostname, not the parent's reputation.
• Monitor platform subdomains, not just registrations. A brand name in yourbrand-login.pages.dev never appears in a newly-registered-domain feed. Brand monitoring has to search hostnames on the big platforms as well as new domains; this is the blind spot we documented in the phishing page brand tools cannot find.
• Report to the platform, not the registrar. For a platform subdomain the registered domain belongs to the platform itself (Google, Cloudflare, Vercel, GitHub), so the registrar will not act; the fastest route is the platform's abuse process. Our guide to taking down a phishing website covers finding the right channel, and our phishing takedown service files the report for you. Our companion study, How Fast Do Phishing Sites Come Down?, times what happens after the report goes in.

In our data, Google's free services host more phishing than Cloudflare's

Cloudflare is usually the name attached to phishing hosting, and its free products feature heavily in our own investigations, from Cloudflare Drop abuse to a SharePoint phishing kit on Workers. In this data, though, Google's free services carry more platform-hosted phishing than Cloudflare's: 3,560 indicators against 2,354, about 1.5 times as many.

On the Google side, Firebase Hosting (firebaseapp.com and web.app) is the single largest platform bucket in the data at 2,118 indicators, ahead of Cloudflare Pages at 1,985. Blogger adds 783, Google Sites 352 and Google Docs and Forms 290, with 17 more on translate.goog, App Engine and Cloud Storage. On Cloudflare's side, Pages (1,985) dwarfs Workers (235), R2 public buckets (127) and Quick Tunnels (7). Leaving out each side's smallest services (translate.goog, App Engine and Cloud Storage for Google; Quick Tunnels for Cloudflare) gives the same picture: 3,543 against 2,347.

Behind the two leaders come Vercel (1,046) and GitHub Pages (662). Together, those four operators account for 7,622 of the 9,169 platform-hosted indicators (83.1%). Then the long tail: IPFS gateways (237; see our IPFS quarantine-phishing case), Amazon S3 and CloudFront (204; for one S3-hosted chain see CAPTCHA-gated Outlook phishing on S3), Weebly (180), Netlify (160), Replit (151), GoDaddy Sites (115) and GitBook (102). The other 18 groups, from dynamic-DNS hosts and Webflow to Framer, Wix, Azure and AI app builders such as Lovable, add 398 between them.

Three caveats on this comparison. It counts phishing hosted on each operator's free platforms, so it does not include sites on their own domains that sit behind Cloudflare's proxy, which is a separate question (the APWG's figures on Cloudflare-fronted sites cover it). It also leaves out Google's redirectors, which host nothing: a share.google short link that sent a Netflix lure straight to a phishing kit appears in no hosting count, yet still lends the click Google's name. And a count of indicators is not a count of campaigns: a single operator who spins up hundreds of Firebase projects moves this number more than a hundred unrelated attackers would.

What defenders should do:

• Treat Google hosting as a first-class phishing source. Firebase, Blogger, Sites and Docs links are trusted by default in many organizations because Google is. Inspect and detonate them like any other unknown link.
• Keep abuse contacts for each operator ready. Google, Cloudflare, Vercel and GitHub each run their own phishing-report process, and between them they account for more than four in five platform-hosted indicators here.
• Expect the long tail to grow. Storage buckets, IPFS gateways and AI app builders each host only dozens or hundreds of indicators today, but every new free platform is a new place to host a kit.

Why .app and .dev rank so high: platform subdomains

Rank the indicators by TLD and you get .com (9,468, 32.3%), then .app (2,839, 9.7%) and .dev (2,503, 8.5%), ahead of .io (1,097), .org (1,071), .run (778), .net (764), .ru (713), .br (538) and .cn (300). Read naively, that looks like an epidemic of .app and .dev registrations. It isn't.

Both TLDs are where the big free platforms put their customers' sites. 2,347 of the 2,503 .dev indicators (93.8%) are subdomains of pages.dev, workers.dev or r2.dev, Cloudflare's three developer platforms, which leaves just 156 that could be registered .dev domains. For .app, at least 1,213 of the 2,839 (42.7%) are on vercel.app, netlify.app or lovable.app, and an unknown further share is on Firebase's web.app, which our export counts together with firebaseapp.com and so cannot be split by TLD. The same effect shows up in .io, where 833 of the 1,097 indicators (75.9%) are on github.io, gitbook.io or webflow.io.

So when a TLD ranking puts .app or .dev near the top, check whether it counts registrable domains or full hostnames. Ours counts the last label of every host, which is why the platforms show through. The ranking for registered-domain abuse is the one you get after taking the platform suffixes out, and in this data that leaves .com far ahead; .dev drops to 156, .io to 264, and .app to at most 1,626, less an unknown number of web.app hosts.

What defenders should do:

• Do not block .app or .dev wholesale. You would block Google's own services and a large share of legitimate developer sites, and barely touch the attacker, who can move to another platform in minutes.
• Score the registrable domain, using the Public Suffix List. Most of these platform suffixes are in the list's private section, so <project>.pages.dev is treated as its own site rather than as part of pages.dev. Reputation, age and allow-list logic should work at that level.
• Read TLD statistics with the platform question in mind, including ours. A TLD's phishing count says as much about which platforms live under it as about the registry.

Which brands the phishing impersonates

Brand attribution needs care in feed data, because most indicators do not say who they are impersonating. 17,142 indicators (58.5%) carry no inferred brand at all. Another 6,691 (22.8%) are lookalikes of brands PhishEye monitors or hunts for, mostly found by our CT hunting; they cover 19 brands, which we pool and do not name. That leaves 5,467 indicators (18.7%) with a well-known public brand, and the top 15 of those are below.

Google leads with 1,168 indicators (21.4% of the public-brand indicators), followed by Roblox (827) and Facebook/Meta (644). Meta's brands are bigger still if counted together: with Instagram (203) and WhatsApp (161) they reach 1,008. Then come Microsoft (291), Amazon (261) and Netflix (231), the Polish marketplace Allegro (169), Ledger (167), Apple/iCloud (158), Trezor and the US Internal Revenue Service (116 each), PayPal (95) and MetaMask (68).

Two patterns stand out. Among the named public brands, gaming and social accounts outrank enterprise logins such as Microsoft: Roblox alone has more indicators than Microsoft, Amazon and Netflix combined (827 against 783). And crypto wallets form a cluster: Ledger, Trezor and MetaMask together account for 351 indicators (6.4%), more than Microsoft's 291. Hardware-wallet and browser-wallet phishing usually ends with a fake "recovery" page that asks for the seed phrase, and a stolen seed phrase empties the wallet with no bank to call.

This ranking differs from email-based brand rankings, which tend to put Microsoft first. That is expected: those count phishing messages, while we count unique hosted indicators, and brand inference on a URL depends on the brand name or a recognizable page appearing in it. Treat the order as indicative, not as a market-share table.

What defenders should do:

• If you are a consumer brand, assume you are a target, not only if you are a bank. Games, marketplaces and social apps feature heavily among the named brands here. Brand protection monitoring should cover your logins, your app stores and the free platforms above.
• Wallet makers and exchanges should hunt for seed-phrase pages specifically. Watch for your brand on platform subdomains and new domains, and tell customers plainly that you will never ask for a recovery phrase.
• Watch for lookalikes, not just exact names. A large share of brand phishing is invisible to brand inference because it never spells the brand correctly. Typosquatting protection catches the misspelled, hyphenated and combo-squatted versions.

No single feed sees more than a third

The last table counts where each indicator came from. OpenPhish is the largest public source, with 9,161 indicators (31.3% of all), followed by PhishTank (5,187), PhishStats (2,096), Phishunt (1,506) and TweetFeed (853). urlscan.io title searches add 56 and four bulk blocklists 31.

PhishEye's own hunting found 10,656 indicators (36.4% of all): 6,623 from our Certificate Transparency hunter and 4,033 from a daily MerkleMap certificate sweep. These are lookalike domains caught by our hunting rules, mostly for brands we monitor, picked up when a certificate is issued for them, which can happen before the site goes live.

The striking number is the overlap, or rather the lack of it. An indicator reported by several sources counts once in each, yet all the source counts add up to only 29,546, just 246 more than the 29,300 unique indicators. That means at least 10,410 of our 10,656 CT detections (97.7%) were never reported by any of the public feeds we ingest, and the public feeds themselves rarely reported the same indicator as each other. Part of that is how overlap is measured: two feeds reporting different URLs on the same site count as two indicators. Even so, the conclusion is hard to avoid. Each source sees a different slice of phishing, and the brand-specific lookalikes a company most needs to know about are largely missing from the public feeds.

What defenders should do:

• Combine feeds rather than picking one. The largest public feed here supplied under a third of the indicators. Our guide to threat intelligence feeds covers how to combine and de-duplicate them.
• Add your own brand-specific hunting. Public feeds report phishing after someone has seen and flagged it. Certificate Transparency and DNS monitoring for your own brand find lookalikes at setup time; that is what our domain monitoring does.
• Measure coverage, not feed count. Ask how many of the phishing pages that actually hit your brand each source reported, and how early. Ten overlapping feeds can still miss the one that matters.

Methodology and limitations

Population. The export covers every indicator in PhishEye's threat feed on 20 October 2026: 29,301 items, of which one manual analyst entry with no feed source was excluded, leaving 29,300. Their first-seen dates run from 15 July to 20 October 2026. By type they are 18,117 URLs, 11,112 domains and 71 bare IP addresses. The export was produced with read-only queries and contains aggregate counts only: no URLs, domains, case data or customer names.

Sources. Public feeds (OpenPhish, PhishTank, PhishStats, Phishunt, TweetFeed), urlscan.io title searches, four bulk blocklists (Phishing.Database links and domains, Phishing Army, PhishDestroy) and PhishEye's own CT hunter and MerkleMap sweep. The CT channel hunts for newly certified lookalike domains, mostly of brands PhishEye monitors, which is why it contributes so many own-domain indicators and so few platform ones.

Classification.

• Hosting matches each indicator's host against 39 groups of free hosting, site-builder, developer and storage services (Cloudflare Pages, Workers and R2, Vercel, Netlify, GitHub Pages, Firebase, Blogger, Weebly, Wix, Google Sites and Docs, IPFS gateways, Replit, GoDaddy Sites, Webflow, Framer, Azure, Amazon S3, dynamic-DNS hosts and others). Everything else is "own or other domain" or "IP address". Firebase's firebaseapp.com and web.app are one group, and so are all IPFS gateways.
• TLD is the last DNS label of the host; 317 smaller TLD groups are pooled.
• Brand is named only when it is a well-known public brand, from a curated list or from public brand inference, and does not match any brand PhishEye monitors. Brand tokens from our own hunting are always pooled.
• Source counts are overlapping: an indicator reported by several feeds counts once in each.

Limitations.

• This is a snapshot of our collection, not of the internet. It is what these feeds published and what we hunted for, so it over-represents brands we monitor (through CT hunting) and the brands and platforms that public reporters see most.
• It is recent-weighted. Indicators no source re-reports for 30 days are deleted unless they matched a protected brand. Of the 8,829 indicators first seen 30 or more days before the export, 1,129 survive only because of such a match.
• Indicators are not campaigns. One operator with hundreds of subdomains weighs as much as hundreds of separate attackers. The counts show where phishing is placed, not how many actors are behind it.
• Brand coverage is partial. 58.5% of indicators have no inferred brand, and lookalike spellings often escape inference.
• No lifespans. PhishEye stores only each indicator's latest liveness check, not its history, so this report makes no claim about how long phishing stays online. The one liveness figure we are comfortable quoting is narrow: of the 5,931 CT-detected lookalikes we have probed, 994 (16.8%) had demonstrably gone (DNS removed or the server silent) at their most recent check, a reading taken at very different ages and from datacenter vantage points that cloaked kits can fool.

Cite this data. PhishEye Threat Research, "Where Phishing Lives in 2026: 29,300 Indicators Analyzed", 30 October 2026, https://phisheye.com/blog/where-phishing-lives-2026. The text, charts and the aggregate tables (CSV) (JSON) are licensed CC BY 4.0: reuse them freely with a link to this page.

FAQ

What share of phishing is hosted on free platforms? In PhishEye's data, 9,169 of 29,300 phishing indicators (31.3%) first seen between 15 July and 20 October 2026 sat on free hosting, site-builder, developer or storage platforms such as Firebase, Cloudflare Pages, Vercel, GitHub Pages and Blogger. 19,717 (67.3%) were on the attacker's own or a compromised domain, and 414 (1.4%) on raw IP addresses.

Which free platform hosts the most phishing? Google's services as a group: 3,560 platform-hosted indicators across Firebase Hosting (2,118), Blogger (783), Google Sites (352), Google Docs and Forms (290) and smaller services. Cloudflare's Pages, Workers, R2 and Tunnels hosted 2,354, Vercel 1,046 and GitHub Pages 662. The single largest product was Firebase Hosting, ahead of Cloudflare Pages (1,985).

Why do .app and .dev appear so often in phishing statistics? Because free platforms put their customers' sites under them. In our data 2,347 of 2,503 .dev phishing indicators (93.8%) were subdomains of pages.dev, workers.dev or r2.dev, and at least 1,213 of 2,839 .app indicators (42.7%) were on vercel.app, netlify.app or lovable.app, with more on Firebase's web.app. Most .app and .dev phishing is platform-hosted, not registered .app or .dev domains.

Which brands are impersonated most in phishing sites? Among indicators with a named public brand, Google led with 1,168, then Roblox (827), Facebook/Meta (644), Microsoft (291), Amazon (261) and Netflix (231). Meta's brands together (Facebook, Instagram, WhatsApp) reached 1,008, and the crypto wallets Ledger, Trezor and MetaMask together 351.

Is one phishing feed enough? No. The largest public feed in our data, OpenPhish, supplied 9,161 of 29,300 indicators (31.3%), and the sources barely overlapped: their counts add up to only 246 more than the number of unique indicators. PhishEye's own Certificate Transparency hunting found 10,656 indicators, at least 97.7% of which no public feed reported.

Can I use this data? Yes. The text, charts and aggregate tables are licensed CC BY 4.0. Cite "PhishEye Threat Research, Where Phishing Lives in 2026" with a link to https://phisheye.com/blog/where-phishing-lives-2026. The tables are available as CSV and JSON.

---

About the authors

PhishEye Threat Research is the anti-phishing and digital-risk-protection team behind PhishEye, a platform for typosquat and impersonation monitoring and automated takedown. We run daily threat hunting across passive DNS, Certificate Transparency and newly registered domain feeds, ingest the public phishing feeds counted in this report, and operate the abuse-reporting pipeline that files takedowns with hosts, platforms and registrars. Our first-hand investigations include IronToll, Cloudflare Drop abuse, a live SharePoint kit on Cloudflare Workers and the AI-built GiftWatch bank kit.

This report is built from PhishEye's own collection, counted as described in the methodology. We have not adjusted or extrapolated any figure. Every chart and table figure comes from the published tables; the few supplementary counts in the text (the excluded manual entry, the liveness probes and the retention figures) come from the same export and are described where they appear.

Spotted an error, or want a breakdown we did not publish? Contact the team at [email protected].