Phishing Activity: Key Statistics Quarter over Quarter comparison: May 1, 2026 - July 31, 2026

Each reporting period, we analyze URLs, domain names, and IP addresses reported for phishing. We use these and other metadata — domain and IP address registration data, ICANN registry and registrar monthly reports, routing data, attack type, and other indicators — to report key statistics for each reporting period.

A comparison of key statistics for the periods February 1, 2026 - April 30, 2026 and May 1, 2026 - July 31, 2026 appears in the table below.

Measurement February to April 2026 May to July 2026 Change
in
Measurement
Total number of phishing reports collected from feeds (per quarter) 1,536,540 2,198,814 662,274
Phishing attacks reported 1,028,332 1,450,117 421,785
Unique domain names reported for phishing 732,837 1,129,248 396,411
Maliciously registered domains reported for phishing 588,102 914,576 326,474
Top-level Domains (TLDs) where we observed phishing 639 687 48
gTLD Registrars that had domains under management reported for phishing 1,452 1,878 426
All Registrars that had domains under management reported for phishing 2,158 2,763 605
Hosting Networks (ASNs) where phishing web sites were reported 2,430 2,870 440
Brands targeted in phishing attacks 1,610 1,598 -12
Number of phishing attacks using a subdomain reseller 95,769 102,947 7,178

Quarterly Update:
Key Statistics
Quarter over Quarter:
Key Statistics		 Quarter over Quarter:
Top Level Domains		 Quarter over Quarter:
Registrars		 Quarter over Quarter:
Hosting Networks