{
  "meta": {
    "title": "Where Phishing Lives in 2026: 29,300 Indicators Analyzed",
    "url": "https://phisheye.com/blog/where-phishing-lives-2026",
    "publisher": "PhishEye Threat Research",
    "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
    "exported": "2026-10-20",
    "first_seen_from": "2026-07-15",
    "first_seen_to": "2026-10-20",
    "population": "Unique phishing indicators (URLs, domains, IPs) collected by PhishEye's public-feed ingestion and its own Certificate Transparency / MerkleMap hunting. Items not re-seen for 30 days are deleted unless they matched a customer brand, so this is a recent-weighted snapshot, not a census of phishing.",
    "notes": [
      "by_feed_source overlaps: an indicator reported by several feeds counts once in each.",
      "Brand-monitoring and hunt-token brands are pooled and not named.",
      "No liveness or lifespan data is included; none should be derived from these counts."
    ]
  },
  "total_indicators": 29300,
  "tables": {
    "indicator_type": {
      "url": 18117,
      "domain": 11112,
      "ip": 71
    },
    "hosting": {
      "own_or_other_domain": 19717,
      "free_platform": 9169,
      "ip_literal": 414
    },
    "platform_by_operator": {
      "Google": 3560,
      "Cloudflare": 2354,
      "Vercel": 1046,
      "GitHub Pages": 662,
      "IPFS gateways": 237,
      "Amazon (S3, CloudFront)": 204,
      "Weebly": 180,
      "Netlify": 160,
      "Replit": 151,
      "GoDaddy Sites": 115,
      "GitBook": 102,
      "Other platforms (18 groups)": 398
    },
    "platform_by_hostname": {
      "firebaseapp/web.app": 2118,
      "pages.dev": 1985,
      "vercel.app": 1046,
      "blogspot": 783,
      "github.io": 662,
      "sites.google.com": 352,
      "docs.google.com": 290,
      "ipfs gateway": 237,
      "workers.dev": 235,
      "amazonaws (s3 etc.)": 203,
      "weebly": 180,
      "netlify.app": 160,
      "replit": 151,
      "r2.dev": 127,
      "godaddysites.com": 115,
      "gitbook.io": 102,
      "dyndns": 86,
      "webflow.io": 69,
      "framer": 41,
      "square.site": 40,
      "webcindario.com": 35,
      "azure": 31,
      "wixsite": 31,
      "backblazeb2.com": 23,
      "onrender.com": 14,
      "cpanel temp host": 10,
      "translate.goog": 9,
      "trycloudflare.com": 7,
      "lovable.app": 7,
      "appspot.com": 5,
      "surge.sh": 3,
      "storage.googleapis.com": 3,
      "telegra.ph": 3,
      "herokuapp.com": 1,
      "jimdo": 1,
      "ngrok": 1,
      "cloudfront.net": 1,
      "wordpress.com": 1,
      "notion.site": 1
    },
    "tld_top25": {
      "com": 9468,
      "app": 2839,
      "dev": 2503,
      "io": 1097,
      "org": 1071,
      "run": 778,
      "net": 764,
      "ru": 713,
      "br": 538,
      "ip-literal": 414,
      "cn": 300,
      "de": 295,
      "se": 290,
      "site": 240,
      "xyz": 236,
      "in": 225,
      "co": 207,
      "ca": 206,
      "eu": 193,
      "online": 192,
      "uk": 188,
      "info": 179,
      "au": 177,
      "shop": 154,
      "mu": 151,
      "other (317 groups)": 5882
    },
    "tld_known_platform_subdomains": {
      ".dev": {
        "total": 2503,
        "known_platform": 2347,
        "platforms": [
          "pages.dev",
          "workers.dev",
          "r2.dev"
        ]
      },
      ".app": {
        "total": 2839,
        "known_platform": 1213,
        "platforms": [
          "vercel.app",
          "netlify.app",
          "lovable.app"
        ]
      },
      ".io": {
        "total": 1097,
        "known_platform": 833,
        "platforms": [
          "github.io",
          "gitbook.io",
          "webflow.io"
        ]
      }
    },
    "brand": {
      "Google": 1168,
      "Roblox": 827,
      "Facebook/Meta": 644,
      "Microsoft": 291,
      "Amazon": 261,
      "Netflix": 231,
      "Instagram": 203,
      "Allegro": 169,
      "Ledger": 167,
      "WhatsApp": 161,
      "Apple/iCloud": 158,
      "Trezor": 116,
      "Internal Revenue Service": 116,
      "PayPal": 95,
      "MetaMask": 68,
      "Other public brands": 792,
      "Brand-monitoring / hunt-token brands (pooled, not named)": 6691,
      "No brand inferred": 17142
    },
    "source_channel": {
      "phisheye_ct_merklemap": 10656,
      "public_feeds_only": 18644
    },
    "feed_source_overlapping": {
      "OpenPhish": 9161,
      "PhishEye CT hunter": 6623,
      "PhishTank": 5187,
      "PhishEye MerkleMap sweep": 4033,
      "PhishStats": 2096,
      "Phishunt": 1506,
      "TweetFeed": 853,
      "urlscan.io title search": 56,
      "phishing-database-links": 17,
      "phishing-army": 7,
      "phishdestroy": 4,
      "phishing-database-domains": 3
    }
  }
}