Financial phishing campaigns can spread across hundreds of hosting providers and registrars, while phishing-as-a-service packages make it easier to build and run them. AI tools can further reduce the work of creating convincing pages and messages. Netcraft’s H1 2026 observations show the scale of that fragmented infrastructure—but they count URLs in one provider’s dataset, not every attack or campaign.
What Netcraft observed in US financial phishing
Netcraft counted nearly 40,000 unique phishing URLs associated with US financial services during the first half of 2026. Those URLs appeared across 645 hosting providers and 576 registrars. The figures describe Netcraft’s observed dataset for that period; they are not a census of all phishing activity, and a URL is not the same thing as a distinct campaign or victim.
As an Amazon Associate I earn from qualifying purchases.
| Measure | Netcraft’s H1 2026 observation | How to read it |
|---|---|---|
| Unique phishing URLs targeting US financial services | Nearly 40,000 | URLs observed by Netcraft in H1 2026, not a count of all attacks or campaigns. |
| Hosting providers represented | 645 | Providers associated with the observed URL set. |
| Registrars represented | 576 | Registrars associated with the observed URL set. |
| Free developer and application hosting | 12.6% | Share of URLs Netcraft observed targeting US financial services that used these hosting services. |
| Payment service providers | 37.2% | Share of Netcraft’s observed financial-sector phishing volume in this period. |
| PayPal | 80.6% | Share of observed activity within the payment-service-provider subsector—not 80.6% of all financial phishing. |
| American Express | 72.8% | Share of observed activity involving card networks, not all financial-sector phishing. |
Why campaigns use many providers
Hosting providers store or serve the pages; registrars handle the domains used to reach them. A campaign that uses many providers and registrars is harder to map and disrupt than one concentrated on a single service. It also means that blocking one domain or reporting one host may address only a part of the activity. Netcraft reported that infrastructure use changed between Q1 and Q2 of 2026, which indicates a changing provider mix. That change alone does not establish why any particular operator moved or whether a takedown caused it.
Netcraft described one example of infrastructure reuse: 16 .es domains generated 585 unique attack URLs between 25 March and 21 April 2026, impersonating 41 financial brands through subdomains. In such a setup, a domain can support numerous URLs and apparent brand identities, so counting URLs, domains, and campaigns yields different totals.
#1 Best Overall
Free developer and application-hosting services made up 12.6% of Netcraft’s observed URLs targeting US financial services in H1 2026. Their presence illustrates that phishing infrastructure need not rely solely on conventional paid web hosting. For defenders, the practical problem is to identify and verify suspicious pages across a broad and shifting set of services rather than assume that one provider or domain pattern contains the activity.
What phishing-as-a-service provides
Phishing-as-a-service (PhaaS) is a packaged model in which a provider supplies some of the tools or infrastructure needed to run a campaign. Instead of building everything independently, an operator may use ready-made templates, cloned websites, hosting, victim-interaction features, and campaign-management tools. LevelBlue has also described financial-sector offerings that include CAPTCHA authentication, obfuscation, and capabilities intended to bypass multifactor authentication. Features vary by service and can change over time.
The model lowers the amount of specialist work a customer needs to do; it does not mean that every campaign uses the same kit or service. Europol’s LabHost case provides a concrete example. The subscription service supplied phishing kits and hosting, enabled interactive engagement with victims, and offered campaign overview tools. Europol said LabHost facilitated phishing targeting users of hundreds of financial institutions.
Free tools Windows power users keep installed
One-click scans. No signup required.
LabHost was disrupted, but PhaaS was not thereby eliminated
On 18 April 2024, Europol announced the result of a year-long international operation against LabHost: 70 addresses were searched and 37 suspects were arrested. This is evidence of a substantial disruption to one service. It does not establish that all PhaaS providers, copied tools, or financial phishing campaigns ended.
How AI can lower some barriers
AI is an enabler, not a complete explanation for the activity Netcraft counted. Netcraft says generative-AI site builders and cloning tools can ease the work of creating and deploying malicious websites. INTERPOL’s 2024 financial fraud assessment describes AI and large language models alongside phishing- and ransomware-as-a-service as helping make fraud campaigns more sophisticated and professional without requiring advanced technical skills, and at relatively little cost.
These sources describe capabilities and a lower barrier to entry; they do not show that AI was used in every campaign or measure how much it contributed to Netcraft’s H1 2026 URL count. AI assistance also does not replace the infrastructure used to host and deliver a phishing page. Content creation, site cloning, hosting, and campaign operation are related parts of a workflow, but they are distinct capabilities.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How phishing reaches financial customers
Netcraft’s H1 2026 observations put payment service providers at 37.2% of its observed financial-sector phishing volume, with PayPal accounting for 80.6% of that subsector’s activity. These are nested shares from Netcraft’s dataset, not estimates of market-wide prevalence. Netcraft also reported that American Express represented 72.8% of observed activity involving card networks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Delivery can involve more than a direct link in a message. Trustwave’s 2024 financial-services report describes HTML and PDF attachments used to carry, conceal, or obscure phishing URLs. An HTML file can act as a phishing page or redirector, or be used for HTML smuggling; a PDF may contain a link, redirect, or QR code. These are examples reported in 2024, not an exhaustive list or a current ranking of delivery methods.
What consumers and financial organizations can do
For consumers
- Open your bank or payment service through its official app, a saved bookmark, or an address you type yourself rather than following an unexpected sign-in link.
- Treat unexpected attachments, QR codes, and requests to verify an account or payment as reasons to pause. If a message claims to be urgent, contact the institution using a trusted number or channel.
- Do not rely on a familiar logo or polished wording as proof that a page is genuine. Report suspicious messages or pages through the institution’s official reporting channel.
For organizations
- Monitor newly registered domains and suspicious links that imitate the organization or its services; Netcraft identifies these as useful defensive measures.
- Make it easy for customers and staff to verify account and payment requests through known channels, and strengthen verification procedures for sensitive actions.
- Assess suspicious URLs and pages across providers rather than treating a single host, registrar, or domain as the whole campaign. A takedown or block can help, but fragmented infrastructure means it may not address every related URL.
These measures can reduce exposure and improve detection, but none guarantees that a phishing attempt will be prevented.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
