{
  "title": "Phishing URL Statistics 2026: 49,424 Live URLs Analyzed",
  "url": "https://www.phishclean.com/research/phishing-urls",
  "snapshot": "2026-11-05",
  "source": "PhishTank online-valid list, https://phishtank.org/",
  "license": "https://creativecommons.org/licenses/by-sa/2.5/",
  "services": [
    {
      "id": "qr",
      "label": "QR-code link services",
      "domains": [
        "qrco.de",
        "q-r.to",
        "ead.me",
        "qr-codes.io",
        "scanned.page",
        "flowcode.com",
        "qrcodeveloper.com"
      ]
    },
    {
      "id": "docs",
      "label": "Online documents, forms and file sharing",
      "hosts": [
        "docs.google.com",
        "drive.google.com",
        "script.google.com",
        "storage.cloud.google.com",
        "lookerstudio.google.com"
      ],
      "domains": [
        "forms.gle",
        "adobe.com",
        "dropbox.com",
        "office.com",
        "sharepoint.com",
        "jotform.com",
        "hsforms.com",
        "typeform.com",
        "forms.app",
        "evernote.com",
        "googleapis.com",
        "backblazeb2.com"
      ]
    },
    {
      "id": "builders",
      "label": "Website builders and free hosting",
      "hosts": [
        "sites.google.com",
        "www.sites.google.com"
      ],
      "domains": [
        "weebly.com",
        "weeblysite.com",
        "webcindario.com",
        "start.page",
        "webwave.dev",
        "myportfolio.com",
        "godaddysites.com",
        "w3spaces.com",
        "ukit.me",
        "ghost.io",
        "powr.io",
        "mybluehost.me",
        "tw1.ru",
        "systeme.io",
        "myclickfunnels.com",
        "temporary.site",
        "mytemp.website",
        "workers.dev",
        "pages.dev",
        "web.app",
        "firebaseapp.com",
        "netlify.app",
        "vercel.app",
        "github.io",
        "wixsite.com",
        "wix.com",
        "webflow.io",
        "framer.app",
        "blogspot.com",
        "wordpress.com",
        "000webhostapp.com",
        "ipfs.io"
      ]
    },
    {
      "id": "links",
      "label": "Link shorteners and link-in-bio pages",
      "domains": [
        "bit.ly",
        "tinyurl.com",
        "t.co",
        "did.li",
        "zpr.io",
        "surl.li",
        "reurl.cc",
        "ow.ly",
        "href.li",
        "urlz.fr",
        "is.gd",
        "tr.ee",
        "linkin.bio",
        "campsite.bio",
        "flow.page",
        "linqapp.com",
        "hipolink.net",
        "komi.io",
        "link.space",
        "ln.run",
        "share.google",
        "t.me"
      ]
    },
    {
      "id": "email",
      "label": "Email marketing and tracking links",
      "domains": [
        "campaign-archive.com",
        "list-manage.com",
        "rs6.net",
        "sendgrid.net",
        "elasticemail.com",
        "awstrack.me"
      ]
    }
  ],
  "study": {
    "total": 49424,
    "hosts": 21782,
    "domains": 17137,
    "https": 46556,
    "ip": 73,
    "punycode": 29,
    "namedBrand": 4813,
    "brandRows": 3452,
    "brandInHost": 1777,
    "medianDays": 623,
    "overYear": 30271,
    "datedRows": 49424,
    "onServices": 34119,
    "services": [
      {
        "id": "qr",
        "label": "QR-code link services",
        "count": 11812,
        "share": 23.9
      },
      {
        "id": "builders",
        "label": "Website builders and free hosting",
        "count": 10897,
        "share": 22
      },
      {
        "id": "docs",
        "label": "Online documents, forms and file sharing",
        "count": 7219,
        "share": 14.6
      },
      {
        "id": "links",
        "label": "Link shorteners and link-in-bio pages",
        "count": 3256,
        "share": 6.6
      },
      {
        "id": "email",
        "label": "Email marketing and tracking links",
        "count": 935,
        "share": 1.9
      }
    ],
    "topDomains": [
      {
        "domain": "google.com",
        "count": 5507,
        "share": 11.1
      },
      {
        "domain": "qrco.de",
        "count": 4591,
        "share": 9.3
      },
      {
        "domain": "q-r.to",
        "count": 3511,
        "share": 7.1
      },
      {
        "domain": "ead.me",
        "count": 3291,
        "share": 6.7
      },
      {
        "domain": "bit.ly",
        "count": 1623,
        "share": 3.3
      },
      {
        "domain": "weebly.com",
        "count": 1545,
        "share": 3.1
      },
      {
        "domain": "adobe.com",
        "count": 1113,
        "share": 2.3
      },
      {
        "domain": "campaign-archive.com",
        "count": 824,
        "share": 1.7
      },
      {
        "domain": "dropbox.com",
        "count": 627,
        "share": 1.3
      },
      {
        "domain": "wl.co",
        "count": 488,
        "share": 1
      }
    ],
    "topDomainsShare": 46.8,
    "reportDays": 1789,
    "busiest10DaysShare": 8.8,
    "brands": [
      {
        "brand": "Allegro",
        "count": 1666,
        "share": 34.6
      },
      {
        "brand": "Internal Revenue Service",
        "count": 787,
        "share": 16.4
      },
      {
        "brand": "Facebook",
        "count": 373,
        "share": 7.7
      },
      {
        "brand": "Amazon.com",
        "count": 356,
        "share": 7.4
      },
      {
        "brand": "Microsoft",
        "count": 254,
        "share": 5.3
      },
      {
        "brand": "Bradesco",
        "count": 150,
        "share": 3.1
      },
      {
        "brand": "Netflix",
        "count": 123,
        "share": 2.6
      },
      {
        "brand": "Optus",
        "count": 123,
        "share": 2.6
      },
      {
        "brand": "Comcast",
        "count": 77,
        "share": 1.6
      },
      {
        "brand": "Adobe",
        "count": 73,
        "share": 1.5
      }
    ],
    "tlds": [
      {
        "tld": ".com",
        "count": 5846,
        "share": 34.1
      },
      {
        "tld": ".app",
        "count": 3193,
        "share": 18.6
      },
      {
        "tld": ".dev",
        "count": 1936,
        "share": 11.3
      },
      {
        "tld": ".io",
        "count": 541,
        "share": 3.2
      },
      {
        "tld": ".sbs",
        "count": 350,
        "share": 2
      },
      {
        "tld": ".top",
        "count": 310,
        "share": 1.8
      },
      {
        "tld": ".shop",
        "count": 294,
        "share": 1.7
      },
      {
        "tld": ".click",
        "count": 293,
        "share": 1.7
      },
      {
        "tld": ".net",
        "count": 236,
        "share": 1.4
      },
      {
        "tld": ".cfd",
        "count": 230,
        "share": 1.3
      }
    ],
    "years": [
      {
        "year": 2012,
        "count": 1,
        "share": 0
      },
      {
        "year": 2013,
        "count": 2,
        "share": 0
      },
      {
        "year": 2016,
        "count": 2,
        "share": 0
      },
      {
        "year": 2017,
        "count": 8,
        "share": 0
      },
      {
        "year": 2018,
        "count": 12,
        "share": 0
      },
      {
        "year": 2019,
        "count": 7,
        "share": 0
      },
      {
        "year": 2020,
        "count": 21,
        "share": 0
      },
      {
        "year": 2021,
        "count": 161,
        "share": 0.3
      },
      {
        "year": 2022,
        "count": 914,
        "share": 1.8
      },
      {
        "year": 2023,
        "count": 6717,
        "share": 13.6
      },
      {
        "year": 2024,
        "count": 16005,
        "share": 32.4
      },
      {
        "year": 2025,
        "count": 7449,
        "share": 15.1
      },
      {
        "year": 2026,
        "count": 18125,
        "share": 36.7
      }
    ]
  },
  "findings": [
    {
      "id": "services",
      "text": "At least 34,119 of the 49,424 verified phishing URLs PhishTank lists as online (69%) sit on services anyone can sign up to, not on a domain the attacker registered."
    },
    {
      "id": "largest-service",
      "text": "QR-code link services are the largest group of those services, holding 11,812 of 49,424 live phishing URLs (23.9%)."
    },
    {
      "id": "https",
      "text": "46,556 of 49,424 live phishing URLs (94.2%) use HTTPS, so a padlock says almost nothing about whether a page is safe."
    },
    {
      "id": "age",
      "text": "The median live phishing URL was reported 623 days ago, and 30,271 of 49,424 (61.2%) were reported more than a year ago and are still listed as online."
    },
    {
      "id": "brand-in-host",
      "text": "Of 3,452 live phishing URLs impersonating one of 16 major brands, 1,777 (51.5%) have the brand's name anywhere in the hostname, so about half give no such clue in the address."
    },
    {
      "id": "homograph",
      "text": "Lookalike Unicode (punycode) hostnames and raw IP addresses are rare: 29 and 73 of 49,424 live phishing URLs (0.2% together)."
    },
    {
      "id": "concentration",
      "text": "49,424 live phishing URLs sit on 17,137 registrable domains, and the ten largest of those domains hold 46.8% of the URLs."
    },
    {
      "id": "named-brand",
      "text": "PhishTank's volunteers named a specific impersonated brand on 4,813 of 49,424 live phishing URLs (9.7%); the rest are labelled \"Other\", so brand rankings from this list describe only that part."
    }
  ],
  "faq": [
    {
      "id": "share-https",
      "q": "What percentage of phishing sites use HTTPS?",
      "a": "94.2% in this snapshot: 46,556 of 49,424 verified phishing URLs that PhishTank lists as online use HTTPS. A padlock shows the connection is encrypted, not that the site is honest."
    },
    {
      "id": "lookalike",
      "q": "Are most phishing links lookalike domains?",
      "a": "Not in this data. At least 34,119 of 49,424 live phishing URLs (69%) sit on services anyone can sign up to, including QR-code link services (11,812) and online documents and file sharing (7,219). Punycode lookalike hostnames account for 29."
    },
    {
      "id": "how-long",
      "q": "How long do phishing links stay online?",
      "a": "The median URL still listed as online in this snapshot was reported 623 days earlier, and 61.2% were reported more than a year earlier. This describes the URLs that survived. Pages taken down leave the list, so it does not show how long a typical phishing page lasts."
    },
    {
      "id": "qr-links",
      "q": "Are QR code links used for phishing?",
      "a": "Yes. QR-code link services carry 11,812 of the 49,424 live phishing URLs in this snapshot (23.9%). The service only redirects, so a warning about the link has to look at where it ends up."
    }
  ]
}