Netcraft identified nearly 40,000 unique phishing URLs relevant to the US financial-services sector in the first half of 2026. The count measures URLs, not victims, confirmed losses or successful attacks. Its report describes campaigns spread across hundreds of providers, increasing use of free hosting, and a new host that Netcraft characterizes as “bulletproof.”
What Netcraft’s figures measure
In its report published September 22, 2026, Netcraft recorded nearly 40,000 unique phishing URLs relevant to US financial services during H1 2026. The URLs were associated with 645 distinct hosting providers and 576 distinct domain registrars. These are Netcraft’s observations and attributions, not a complete census of all phishing activity. They do not establish how many people encountered the sites or suffered losses. Netcraft’s H1 Phishing Landscape Report describes the observed infrastructure as widely distributed.
As an Amazon Associate I earn from qualifying purchases.
That spread matters because takedowns and investigations may involve many providers rather than a single hosting company or registrar. Netcraft says the infrastructure suggests automated domain rotation to keep operations running. That is the report’s interpretation of the observed infrastructure, not a measure of how often a campaign successfully returned after disruption.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How AI tools fit into the campaigns
Netcraft links 12.6% of observed phishing URL volume to free developer or application hosting. The report notes that free hosting is often built into AI website builders and cloners, and says agentic AI tools can automate website development and deployment. Together, those capabilities can reduce the work and time needed to set up campaign infrastructure.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The findings do not show that autonomous AI agents ran every campaign, nor do they quantify how many of the nearly 40,000 URLs were generated by AI. The defensible takeaway is narrower: AI tools and hosting bundled into website-building services can make it easier to create and deploy sites, while the report does not assign a share of URL volume specifically to AI-generated content. Netcraft’s analysis of free hosting and AI tools sets out that connection.
Which financial services and brands were targeted?
Targeting differed by subsector. In Netcraft’s observed phishing URL volume for H1, payment service providers accounted for 37.2%. Within that payment-service-provider activity, PayPal represented 80.6%. Within the separate card-network subsector, American Express accounted for 72.8%. These brand percentages use their respective subsectors as denominators; they are not shares of all phishing URLs in the report. Netcraft’s sector breakdown gives the figures.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The report also describes a change in one brand-focused campaign over time. A Darcula-based campaign impersonating Fidelity Investments accounted for more than half of the phishing infrastructure targeting Fidelity at the beginning of 2026, then declined to near-zero phishing sites by Q2. That is a campaign-specific Q1-to-Q2 change, not evidence that phishing targeting Fidelity as a whole ended. Netcraft’s Fidelity campaign analysis documents the shift.
Free tools Windows power users keep installed
One-click scans. No signup required.
What is Omegatech, and why did it draw attention?
Netcraft says Omegatech began operating in January 2026, claims a base in Seychelles and hosted roughly 3% of observed phishing attacks by June. Netcraft describes the provider as “bulletproof” and characterizes its Seychelles presence as a paper shell for transnational hosting. Those are Netcraft’s assessments; the report does not establish them as an independently adjudicated legal finding.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The distinction matters: the reported share describes observed attacks hosted through the provider by June, not the share of all phishing activity on the internet or a count of victims. Netcraft’s account of Omegatech explains its characterization and reported role.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A .es domain cluster shows how campaigns can scale
Netcraft traced 585 unique attack URLs to a cluster of 16 .es domains between March 25 and April 21, 2026. The domains impersonated 41 financial brands, and the report says their registration data was minimally disclosed. This example illustrates how a relatively small group of domains can support many URLs and impersonate multiple brands; it does not establish how many people visited the sites or whether the domains were operated by a single actor. Netcraft’s analysis of the .es cluster provides the campaign details.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What organizations and customers can take from the report
For financial firms, the findings support monitoring newly registered and lookalike domains, tracking abuse across hosting providers and registrars, and coordinating response efforts rather than relying on a single-provider takedown. The report’s broad provider count and example of domains serving multiple brands make infrastructure visibility particularly relevant.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFor customers, the URL count is not a measure of personal exposure. It does not show that a particular person’s account was targeted or compromised. The report also does not establish that consumers need a specific security product. Its central finding is about the scale and changing infrastructure of phishing activity targeting the US financial sector in the first half of 2026.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
