Research

First-hand data from our own traps and monitoring, with the indicators defenders need.

1. Phish Watch · No. 2 · 24 Sep – 31 Oct 2026 Our most common phishing lure came from domains that can't exist

   A fake storage bill from top-level domains that aren't in the root zone, one casino operator behind ten domains, and crypto lures relayed by real websites' forms.

2. Phish Watch · No. 1 · September 2026 Real websites delivered one in six of the lures we trapped

   Lures delivered by real websites' contact forms, one redirect token behind eleven cloud buckets, and callback scams with no link to scan.