Phishing Activity: Key Statistics Quarter over Quarter comparison: August 1, 2025 - October 31, 2025

Each reporting period, we analyze URLs, domain names, and IP addresses reported for phishing. We use these and other metadata — domain and IP address registration data, ICANN registry and registrar monthly reports, routing data, attack type, and other indicators — to report key statistics for each reporting period.

A comparison of key statistics for the periods May 1, 2025 - July 31, 2025 and August 1, 2025 - October 31, 2025 appears in the table below.

Measurement May to July 2025 August to October 2025 Change
in
Measurement
Total number of phishing reports collected from feeds (per quarter) 1,917,635 2,016,654 99,019
Phishing attacks reported 1,354,536 1,298,579 -55,957
Unique domain names reported for phishing 1,057,969 1,065,139 7,170
Maliciously registered domains reported for phishing 705,910 687,262 -18,648
Top-level Domains (TLDs) where we observed phishing 701 687 -14
gTLD Registrars that had domains under management reported for phishing 1,699 1,768 69
All Registrars that had domains under management reported for phishing 2,410 2,515 105
Hosting Networks (ASNs) where phishing web sites were reported 2,391 2,614 223
Brands targeted in phishing attacks 1,537 1,623 86
Number of phishing attacks using a subdomain reseller 105,785 94,205 -11,580

Quarterly Update:
Key Statistics
Quarter over Quarter:
Key Statistics		 Quarter over Quarter:
Top Level Domains		 Quarter over Quarter:
Registrars		 Quarter over Quarter:
Hosting Networks