Netcraft Blog

Scam loss reports from Singapore, Australia, and the U.S. reveal a clear divide: countries pairing fraud statistics with active controls are better equipped to disrupt scams.

In the June 2026 survey we received responses from 1,489,396,284 sites across 304,146,307 domains and 14,653,771 web-facing computers. This reflects a change of 21.1 million sites, 2.0 million domains, and 81,854 web-facing computers. Cloudflare experienced the largest gain of 4.1 million sites (+1.73%) this month, and now accounts fo...

June 4, 2026 | Social media impersonation is reshaping phishing. Learn why attackers are shifting beyond email and how security teams can improve phishing detection.

June 2, 2026 | A newly observed phishing campaign impersonates payment verification to harvest selfies, videos, location data, and device information. Learn how camera-first phishing turns browser permissions into a powerful collection channel.

In the May 2026 survey we received responses from 1,468,295,818 sites across 302,162,421 domains and 14,571,917 web-facing computers. This reflects a change of 34.6 million sites, 3.0 million domains, and 373,769 web-facing computers. Cloudflare experienced the largest gain of 10.6 million sites (+4.66%) this month, and now accounts f...

May 28, 2026 | DMARC protects your domain but not against lookalike phishing domains. Learn how to detect typosquatting domains and malicious infrastructure at scale.

May 27, 2026 | Netcraft uncovers how EvilTokens enables large-scale OAuth device code phishing campaigns, abuses Microsoft authentication flows, and powers emerging attacks like GhostPairing.

May 26, 2026 | Netcraft research reveals how threat actors are exploiting the 2026 FIFA World Cup through fake ticket sales, betting scams, phishing, and fraudulent hospitality sites.

May 21, 2026 | Phishing attacks succeed in hours, but DMCA workflows can take days. Explore the operational risks of takedown delays and why security teams need faster disruption methods.

May 20, 2026 | Thousands of fake World Cup domains were registered months before kickoff. Learn how domain aging helps attackers build trust before phishing sites go live.