Topic starter
11/11/2026 6:05 pm
TL;DR: Phishing infrastructure in U.S. financial services expanded to almost 40,000 unique URLs in H1 2026, Netcraft reports, with abuse spread across hundreds of hosts and registrars. Financial defenders now have to treat hosting churn as part of the attack surface, not just the impersonated brand.
Editorial analysis by NHI Mgmt Group, based on content published by Netcraft: “H1 Phishing Landscape Report: U.S. Financial Sector”.
By the numbers:
- Netcraft observed 645 distinct hosting providers and 576 distinct domain registrars in the same H1 2026 view.
- Free developer and app-hosting services accounted for 12.6% of phishing URL volume in H1 2026.
- PayPal impersonation accounted for nearly 30% of all observed financial-sector phishing URLs.
Key questions
Q: Why do payment brands attract so much phishing activity?
A: Payment brands attract phishing because criminals can use familiar logos, checkout language, and account recovery prompts to steal card data, credentials, and one-time passcodes at scale.
Q: How does free hosting help phishing operations?
A: Free hosting helps because it lets attackers publish convincing lures, then makes replacement easy after takedowns or blocklisting.
Q: How should teams disrupt phishing campaigns that rotate hosts quickly?
A: Disrupt them by correlating domains, certificates, hosting IPs, and page fingerprints, then blocking the shared infrastructure rather than each URL alone.
Practitioner guidance
- Cluster phishing by campaign infrastructure Group domains, hosting providers, registrars and page templates into one incident stream so takedown work targets the operation rather than each URL in isolation.
- Prioritise brand-abuse monitoring for payment journeys Focus detection on impersonation of payment brands, customer login pages and account-recovery flows where a convincing logo or form can turn trust into loss.
- Track free-hosting abuse as a recurring pattern Create detections for repeated abuse on developer and app-hosting services, then escalate when the same service is used across multiple short-lived phishing sites.
Bottom line: Financial-sector phishing now scales through disposable infrastructure, so the defender’s problem is campaign disruption rather than only URL removal.
Glossary terms: Phishing-as-a-service, Registrar opacity, Lookalike Domain, Account Takeover
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Disposable phishing infrastructure has become a governance problem, not just a detection problem. When attackers can spin up and abandon hosts quickly, the key question is who owns disruption across registrars, hosting providers and brand abuse channels. That shifts the control conversation from isolated URL blocking to campaign-level governance and evidence sharing. Practitioners should manage phishing as an infrastructure lifecycle issue, not only a message-filtering issue.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: What signs suggest a phishing cluster is being reused?
A: Signs of reuse include the same page template, identical form fields, repeated JavaScript or image assets, shared certificate details, and the same registration or hosting patterns across different domains. A cluster may also reuse name servers, redirect chains, phishing kit parameters, or tracking IDs. Those overlaps show the campaign is being relaunched from a common operator playbook.
👉 Read our full editorial: Phishing infrastructure scales faster when free hosting is easy to abuse