# Phishing URL statistics 2026

> 49,424 verified live phishing URLs analyzed: 69% sit on services anyone can sign up to, 94.2% use HTTPS. Method and data included.

Canonical: https://www.phishclean.com/research/phishing-urls
Last updated: 2026-11-05

We analyzed 49,424 verified phishing URLs that PhishTank listed as online on 5 November 2026, across 17,137 domains. At least 69% sit on services anyone can sign up to, and 94.2% use HTTPS. Every number below comes from one script, and its limits are listed under the tables.

## Key findings

1. At least 34,119 of the 49,424 verified phishing URLs PhishTank lists as online (69%) sit on services anyone can sign up to, not on a domain the attacker registered.

   [Link to this finding](https://www.phishclean.com/research/phishing-urls#services)
2. QR-code link services are the largest group of those services, holding 11,812 of 49,424 live phishing URLs (23.9%).

   [Link to this finding](https://www.phishclean.com/research/phishing-urls#largest-service)
3. 46,556 of 49,424 live phishing URLs (94.2%) use HTTPS, so a padlock says almost nothing about whether a page is safe.

   [Link to this finding](https://www.phishclean.com/research/phishing-urls#https)
4. The median live phishing URL was reported 623 days ago, and 30,271 of 49,424 (61.2%) were reported more than a year ago and are still listed as online.

   [Link to this finding](https://www.phishclean.com/research/phishing-urls#age)
5. Of 3,452 live phishing URLs impersonating one of 16 major brands, 1,777 (51.5%) have the brand's name anywhere in the hostname, so about half give no such clue in the address.

   [Link to this finding](https://www.phishclean.com/research/phishing-urls#brand-in-host)
6. Lookalike Unicode (punycode) hostnames and raw IP addresses are rare: 29 and 73 of 49,424 live phishing URLs (0.2% together).

   [Link to this finding](https://www.phishclean.com/research/phishing-urls#homograph)
7. 49,424 live phishing URLs sit on 17,137 registrable domains, and the ten largest of those domains hold 46.8% of the URLs.

   [Link to this finding](https://www.phishclean.com/research/phishing-urls#concentration)
8. PhishTank's volunteers named a specific impersonated brand on 4,813 of 49,424 live phishing URLs (9.7%); the rest are labelled "Other", so brand rankings from this list describe only that part.

   [Link to this finding](https://www.phishclean.com/research/phishing-urls#named-brand)

## Where the URLs sit

Share of all 49,424 URLs. A service only counts if it is on our hand-checked list, so these are floors.

| Type of service | URLs | Share |
| --- | --- | --- |
| QR-code link services | 11,812 | 23.9% |
| Website builders and free hosting | 10,897 | 22% |
| Online documents, forms and file sharing | 7,219 | 14.6% |
| Link shorteners and link-in-bio pages | 3,256 | 6.6% |
| Email marketing and tracking links | 935 | 1.9% |

## The ten largest domains

This shows where the URLs sit, not who is at fault: most of these are legitimate services whose free accounts or links were abused.

| Registrable domain | URLs | Share |
| --- | --- | --- |
| google.com | 5,507 | 11.1% |
| qrco.de | 4,591 | 9.3% |
| q-r.to | 3,511 | 7.1% |
| ead.me | 3,291 | 6.7% |
| bit.ly | 1,623 | 3.3% |
| weebly.com | 1,545 | 3.1% |
| adobe.com | 1,113 | 2.3% |
| campaign-archive.com | 824 | 1.7% |
| dropbox.com | 627 | 1.3% |
| wl.co | 488 | 1% |

## Brands named

Share of the 4,813 URLs with a named brand. One brand can lead this table because of a single reporting campaign.

| Impersonated brand | URLs | Share |
| --- | --- | --- |
| Allegro | 1,666 | 34.6% |
| Internal Revenue Service | 787 | 16.4% |
| Facebook | 373 | 7.7% |
| Amazon.com | 356 | 7.4% |
| Microsoft | 254 | 5.3% |
| Bradesco | 150 | 3.1% |
| Netflix | 123 | 2.6% |
| Optus | 123 | 2.6% |
| Comcast | 77 | 1.6% |
| Adobe | 73 | 1.5% |

## Top-level domains

Share of the 17,137 distinct domains, so one busy service counts once.

| Top-level domain | Domains | Share |
| --- | --- | --- |
| .com | 5,846 | 34.1% |
| .app | 3,193 | 18.6% |
| .dev | 1,936 | 11.3% |
| .io | 541 | 3.2% |
| .sbs | 350 | 2% |
| .top | 310 | 1.8% |
| .shop | 294 | 1.7% |
| .click | 293 | 1.7% |
| .net | 236 | 1.4% |
| .cfd | 230 | 1.3% |

## Year each URL was reported

| Year | URLs | Share |
| --- | --- | --- |
| 2012 | 1 | 0% |
| 2013 | 2 | 0% |
| 2016 | 2 | 0% |
| 2017 | 8 | 0% |
| 2018 | 12 | 0% |
| 2019 | 7 | 0% |
| 2020 | 21 | 0% |
| 2021 | 161 | 0.3% |
| 2022 | 914 | 1.8% |
| 2023 | 6,717 | 13.6% |
| 2024 | 16,005 | 32.4% |
| 2025 | 7,449 | 15.1% |
| 2026 | 18,125 | 36.7% |

## What this means

A list of bad hostnames cannot block a phishing page on one of these services without blocking every customer of that service. PhishClean's own reported-phishing list leaves out popular hosts for that reason, so a link like this is only flagged if the page it leads to shows warning signs. You can paste a suspicious link into our [link checker](https://www.phishclean.com/check-link), which reads the address only and cannot vouch for what the page does.

## How this was measured

- **Source:** PhishTank's online-valid list, downloaded on 5 November 2026. These are URLs its community verified as phishing and that its own check still lists as online. PhishClean did not report or verify them.
- **Survivors only:** this is what is still listed, not all phishing. Pages taken down leave the list, so long-lived URLs are over-represented.
- **"Online" is PhishTank's check:** a redirect service can stay online after the page behind it is gone. We did not open any of the listed URLs, so each is counted where it is listed, not where it redirects.
- **Reported in bursts:** reports fall on 1,789 different days, and the busiest ten hold 8.8% of the URLs, so a single reporting campaign can move a number here.
- **Service list:** 86 domains and hosts, checked by hand and published with the [data](https://www.phishclean.com/research/phishing-urls.json). Anything not on it counts as "other", including services we could not identify.
- **Domains:** grouped by registrable domain using the Public Suffix List. Raw IP addresses are excluded from the domain and top-level domain counts.
- **Brand in hostname:** a simple search for the brand's name, across brands with a distinctive name. It also counts the brand's own domain, such as Adobe pages on adobe.com.
- **Rounding:** shares to one decimal place. A finding needs at least 20 URLs behind it to appear here.

## How to cite this

PhishClean, "Phishing URL statistics 2026", November 2026, https://www.phishclean.com/research/phishing-urls. Data: PhishTank.

Phishing data provided by [PhishTank](https://phishtank.org/). These figures and the [JSON download](https://www.phishclean.com/research/phishing-urls.json) are shared under [CC BY-SA 2.5](https://creativecommons.org/licenses/by-sa/2.5/), as the source requires.

## Questions

### What percentage of phishing sites use HTTPS?

94.2% in this snapshot: 46,556 of 49,424 verified phishing URLs that PhishTank lists as online use HTTPS. A padlock shows the connection is encrypted, not that the site is honest. [Link to this answer](https://www.phishclean.com/research/phishing-urls#share-https)

### Are most phishing links lookalike domains?

Not in this data. At least 34,119 of 49,424 live phishing URLs (69%) sit on services anyone can sign up to, including QR-code link services (11,812) and online documents and file sharing (7,219). Punycode lookalike hostnames account for 29. [Link to this answer](https://www.phishclean.com/research/phishing-urls#lookalike)

### How long do phishing links stay online?

The median URL still listed as online in this snapshot was reported 623 days earlier, and 61.2% were reported more than a year earlier. This describes the URLs that survived. Pages taken down leave the list, so it does not show how long a typical phishing page lasts. [Link to this answer](https://www.phishclean.com/research/phishing-urls#how-long)

### Are QR code links used for phishing?

Yes. QR-code link services carry 11,812 of the 49,424 live phishing URLs in this snapshot (23.9%). The service only redirects, so a warning about the link has to look at where it ends up. [Link to this answer](https://www.phishclean.com/research/phishing-urls#qr-links)

Last updated: 5 November 2026, when the data was downloaded.