Phishing Activity: Key Statistics Quarter over Quarter comparison: November 1, 2025 - January 31, 2026

Each reporting period, we analyze URLs, domain names, and IP addresses reported for phishing. We use these and other metadata — domain and IP address registration data, ICANN registry and registrar monthly reports, routing data, attack type, and other indicators — to report key statistics for each reporting period.

A comparison of key statistics for the periods August 1, 2025 - October 31, 2025 and November 1, 2025 - January 31, 2026 appears in the table below.

Measurement August to October 2025 November to January 2026 Change
in
Measurement
Total number of phishing reports collected from feeds (per quarter) 2,016,654 1,861,264 -155,390
Phishing attacks reported 1,298,579 1,206,064 -92,515
Unique domain names reported for phishing 1,065,139 867,685 -197,454
Maliciously registered domains reported for phishing 687,262 559,618 -127,644
Top-level Domains (TLDs) where we observed phishing 687 726 39
gTLD Registrars that had domains under management reported for phishing 1,768 1,775 7
All Registrars that had domains under management reported for phishing 2,515 2,496 -19
Hosting Networks (ASNs) where phishing web sites were reported 2,614 2,530 -84
Brands targeted in phishing attacks 1,623 1,741 118
Number of phishing attacks using a subdomain reseller 94,205 163,341 69,136

Quarterly Update:
Key Statistics
Quarter over Quarter:
Key Statistics		 Quarter over Quarter:
Top Level Domains		 Quarter over Quarter:
Registrars		 Quarter over Quarter:
Hosting Networks