Crypto phishing in Q2 2026: observed data

The fixed database query returns 46,871 unique domain records. Stored detections run from 1 April through 30 June 2026. Records appear on 90 of the quarter's 91 dates; 5 June contains no stored records.

The counts below are reproducible from the current PhishDestroy database. However, they describe only domains observed by this project. They are not estimates of all phishing activity, unique victims, criminal campaigns or market share.

Zero rows on a date can mean zero observations, an import gap or a collection interruption. Without a source-by-source ingestion ledger, we cannot infer which explanation applies. This report therefore calls those dates “dates with no stored records,” not “days with no phishing.”

The following values describe database coverage when queried on 4 August 2026. Enrichment may have occurred after the original detection, so these are not point-in-time Q2 vendor verdicts.

These coverage numbers are useful for planning a release. They are not suitable for vendor-performance comparisons because the table does not measure consistent observation time, submission policy or detection latency across vendors.

The cohort uses the stored first-detection field, a half-open UTC-style date interval and domain-level deduplication:

start: detected_at >= 2026-04-01 00:00:00
end:   detected_at <  2026-07-01 00:00:00
unit:  one distinct lowercase domain
query executed: 2026-08-04

What is counted

• one stored row for each unique domain returned by the date predicate;
• the timestamp when the record entered PhishDestroy, not the unknown start of the criminal campaign;
• domain records, not URLs, screenshots, individual pages, victims or threat-actor groups.

What was not inferred

• missing dates were not filled using averages;
• unchecked vendors were not converted to zero detections;
• current site status was not treated as the status at detection;
• missing brand, registrar or registration fields were not generated by a language model;
• the cohort was not extrapolated to global Internet prevalence.

The cohort supports data-engineering work, field-coverage review and case-level research. It also supports an exact headline about PhishDestroy observations. It does not support a claim about all global phishing.

A downloadable, immutable Q2 data release should be generated only after the following checks pass:

1. Explain the date with no stored records. Reconcile 5 June against each ingestion source and job log.
2. Verify collection continuity. A date containing records does not by itself prove that every input operated normally.
3. Freeze an immutable export. Assign a version, checksum, extraction time and stable download location.
4. Preserve source lineage. Distinguish upstream source identifiers from source systems and document deduplication.
5. Separate event-time and current fields. Status, vendor results and enrichment collected later must be labeled by observation time.
6. Run quality checks. Validate timestamps, registered-domain parsing, duplicate handling, placeholders and impossible creation dates.
7. Publish denominators. Every percentage must identify the eligible records, missing fields and calculation.

Future versions can add source-level continuity analysis and a fixed downloadable extract while preserving this method and change log.

The live DestroyList dataset is published separately under the project's CC0 1.0 public-domain dedication. This page does not provide a fixed Q2 download; the values are direct query results and can change if records are corrected or backfilled. Cite the query date with any reuse.

Recommended citation:

Corrections should identify the disputed value, the query or source record used for comparison and the proposed correction. Material changes will update the modification date and the visible release note.