Phishing statistics 2026: one in three new phishing sites sits on free hosting

One in three new phishing sites now sits on a free website host. FFraud first listed 66,440 phishing domains between October 4 and November 2, 2026. Of those, 21,042, or 31.7 percent, were subdomains of a free host's own name. Tencent's EdgeOne Pages led with 8,938 names, ahead of Cloudflare Pages with 6,728 (FFraud data, measured November 3, 2026).

A free host gives anyone a working web address at no cost, under a name that many security tools already trust. Kaspersky described the effect in June 2026: such sites "appear to be established and secure to many protective solutions".

This page shows where the 66,440 names sat, which brands they imitated, and what it means for anyone who defends a sign-in page. The method comes at the end, plainly enough to be argued with. Our malicious IP statistics count the attacking addresses themselves.

#Where were new phishing sites hosted in October 2026?

Eight hosts carried nearly all of the free-hosted share. Each count below is a subdomain first seen by FFraud in those 30 days, under the host's shared name.

1. EdgeOne Pages8,938
2. Cloudflare Pages6,728
3. Vercel1,616
4. Netlify724
5. Blogger593
6. GitHub Pages491
7. Cloudflare Workers406
8. Lovable214

Source: FFraud phishing domain data, measured November 3, 2026

EdgeOne Pages was the largest single name. Cloudflare's three shared names held 7,147 together in the same 30 days: pages.dev, workers.dev and r2.dev. Cloud storage names added 552 more, and the free dynamic DNS name duckdns.org added 255.

Each host offers a free plan. Vercel's Hobby plan costs $0 a month, and Netlify's Free plan reads "$0 forever". EdgeOne Pages calls its free plan "permanently available", and Cloudflare Pages allows 500 builds a month on its free plan (each host's own pricing or limits page, read November 3, 2026).

#What surprised us: EdgeOne Pages jumped in mid-October

Until early October, FFraud saw a few dozen EdgeOne Pages phishing sites a week. From the week of October 12, it saw thousands a week.

1. Sep 739
2. Sep 1424
3. Sep 2133
4. Sep 2816
5. Oct 517
6. Oct 122,019
7. Oct 192,766
8. Oct 263,543

Source: FFraud phishing domain data, measured November 3, 2026

Read the jump with care. Part of it may show where FFraud's monitoring looked more closely. The abuse itself is documented elsewhere: in June 2026, Kaspersky counted more than 8,000 phishing emails using EdgeOne Pages in 30 days.

One more difference stands out. The Public Suffix List names pages.dev, workers.dev, vercel.app, netlify.app, github.io and blogspot.com. Its version of October 31, 2026 does not list edgeone.dev.

Browsers use that list to keep cookies apart and to highlight the important part of a name. On a listed host, each customer's subdomain counts as a site of its own.

#Which brands did the phishing pages imitate?

WhatsApp led by far. We counted names whose own part, before the host's name, holds a brand at the start of a word.

1. WhatsApp769
2. Ledger338
3. Binance115
4. Google106
5. Bank of America85
6. Trezor81
7. Netflix76
8. Facebook74
9. Coinbase71
10. Instagram54

Source: FFraud phishing domain data, measured November 3, 2026

Four of the ten are crypto wallets or exchanges: Ledger, Binance, Trezor and Coinbase. With MetaMask and Trust Wallet added, crypto names came to 652, counted once per brand.

#Where did the other phishing sites sit?

The other 44,591 sat on registered domain names, outside free hosts, cloud storage and dynamic DNS (FFraud data, same 30 days). The .shop ending alone held 8,442, almost as many as EdgeOne Pages.

#Are pages.dev and vercel.app links safe?

The platform name says nothing about the site behind it. Anyone can publish on these hosts with a free plan, so judge each full name as you would judge a new domain.

Check an unknown name before you sign in anywhere. The free domain reputation checker looks a name up on FFraud's phishing list, full subdomain included.

#What it means for someone defending a site

• Block the full hostname. One phishing subdomain on pages.dev says nothing about the next one.
• Never trust a link for its familiar host. A free host lends every customer its name and its valid certificate.
• Check links in support tickets and sign-up emails against a phishing list before anyone clicks.

#How to report a phishing site on a free host

Report it in two places: to Google and to the host. Google takes reports on its page "Report a Page to Google Safe Browsing". GitHub's policy, for one, lists "phishing or attempted phishing" among prohibited uses.

Send the full address to the host's abuse team as well, with the date you saw it.

#How we counted

The data set is FFraud's table of phishing domains, read on November 3, 2026. A name counts when FFraud first listed it between October 4 and November 2, 2026, in UTC. That date marks when FFraud saw the name, which can be later than its registration.

We sorted every name by its ending. A name counts as free-hosted when it ends in the shared name of one of 33 free website hosts, from EdgeOne Pages to Notion. Cloud storage, such as googleapis.com, and the dynamic DNS name duckdns.org were counted apart.

The shares reflect what FFraud's monitoring caught, and it watches some corners of the web more closely than others. The weekly chart uses the same table for September and October.

To check one name yourself, ask the free API at https://api.ffraud.com/public/domain/<name>. It answers is_phishing: true for a listed name and judges the full subdomain. On November 3, 2026, a listed edgeone.dev subdomain answered true, while pages.dev and vercel.app themselves answered false.

curl https://api.ffraud.com/public/domain/pages.dev

The phishing list itself is not part of the open data. The confirmed attackers and the throwaway email domains are, and the data is free to download.

#Questions people ask