What today’s scam links look like
Every day, Peekray counts the phishing links on two public lists, OpenPhish and PhishTank, and reads each address the way its checker does. These are the numbers, in sentences you can quote.
Counted 9 November 2026, 05:53 UTC · 47,287 phishing links · updated daily
Latest count
What the lists show
95%
of the 47,287 phishing links on the OpenPhish and PhishTank lists on 9 November 2026 started with https, so the padlock in the address bar doesn’t mean a site is safe.
58%
were on a platform anyone can sign up to, such as qrco.de, docs.google.com or web.app, rather than a website of their own.
under 1%
named one of the 46 brands Peekray’s address check knows, or a look-alike of it. That’s a lower bound: brands it doesn’t know aren’t counted, and a page can pretend to be a brand without naming it in the address.
Meta
was the brand named most often, in 89 links. Microsoft came next, with 84.
9 in 10 scam links on the lists use https, and 6 in 10 sit on a platform anyone can sign up to. That’s why Peekray follows each link to where it really goes and checks it, instead of judging it by how it looks. How to check a link in a text.
Brands
The brands scam links name
Peekray’s address check spotted a brand it knows in 471 of the 47,287 links. 323 had it in the site name itself, like royalmail-fee.example; the rest only later in the address, like a free site’s /paypal-login page.
- 1Meta89
- 2Microsoft84
- 3Google40
- 4MetaMask30
- 5Netflix23
- 6DPD20
- 7Coinbase19
- 8Apple17
- 9Discord16
- 10Spotify14
- 11Amazon12
- 12PayPal12
- 13DocuSign10
- 14Telegram10
- 15Binance8
Hosting
Where scam pages are hosted
27,457 links were on a platform anyone can sign up to. A well-known platform’s name at the end of an address, like pages.dev or weebly.com, says nothing about who made the page.
- 1qrco.de4,586
- 2docs.google.com3,980
- 3web.app1,915
- 4firebaseapp.com1,878
- 5bit.ly1,609
- 6weebly.com1,371
- 7r2.dev1,185
- 8sites.google.com1,160
- The lists. OpenPhish’s public feed and PhishTank’s list of verified phishing links that are still online. Peekray downloads them to check links, about once an hour while it’s in use and at least once a day, and counts them once a day. Both are free for non-commercial use, and Peekray is free.
- Each link once. A link on both lists counts once. So does the same address with and without “www.”, or with http and https.
- https. The address on the list begins with https rather than http.
- On a platform. The link is on a service where anyone can publish: a free website builder, a cloud host, a form or file-sharing site, or a link shortener. It’s the same list Peekray’s checker uses, and each platform is named by the address its users’ sites sit under, like pages.dev or docs.google.com.
- Names a brand. Peekray’s own address check, the one its checker uses, spots one of the 46 brands it knows in the address: in the site name, as a look-alike or a disguised spelling, or later in the address, like /paypal-login. A link on a shared site counts for the brand it names, not the site’s owner. Brands it doesn’t know, and pages that only show a brand once opened, aren’t counted, so this is a lower bound.
- What it can’t tell you. The lists hold links that people and companies reported, not every scam, and come from around the world, not only the UK. A brand’s name in the address doesn’t prove who a page copies. Malware links on URLhaus, the third list Peekray checks, aren’t part of these counts.
- Only counts. Peekray keeps the numbers, never the links.
| Day | Phishing links | https | On a platform | Name a brand |
|---|---|---|---|---|
| 47,287 | 95% | 58% | under 1% | |
| 47,654 | 94% | 58% | under 1% | |
| 48,199 | 94% | 58% | under 1% | |
| 48,657 | 94% | 58% | 1% | |
| 49,112 | 94% | 58% | under 1% | |
| 49,723 | 94% | 58% | under 1% | |
| 50,326 | 94% | 58% | under 1% |
Use these numbers
How to quote them
Please name Peekray, the day and this page. Each day’s numbers stay in the data file, so a number you quote can be checked later.
“On 9 November 2026, 95% of the 47,287 phishing links on the OpenPhish and PhishTank lists started with https.” Source: Peekray, phishing link statistics, peekray.com/research/phishing-link-statistics
Every day’s numbers (JSON) · Guides to everyday scams · hello@peekray.com
Let Peekray do it
Check where a link really goes before you tap.