Phishing Landscape 2026 – How Phishers Exploit Free Web Hosting Accounts
Colin Strutt and Dave Piscitello
In previous years, Interisle published comprehensive annual reports on phishing. This year, we’re taking a different approach and showing just the significant results of our analysis as a series of posts.
You can refer to previous full reports (such as Phishing Landscape 2025) for more details about our methodology and definitions of terms.
In the previous post, we looked at the gTLD registrars to see where cybercriminals are registering the most phishing domains.
In this post we turn our attention to how phishers are (ab)using free web hosting accounts. Here are the number of phishing attacks in each year’s study that were hosted on accounts created at free or cheap web sites:
The drop from the 2024 study to the 2025 study was largely the result of a decrease in phishing from Google blogspot accounts. The growth in the 2026 study appears to be as a result of significantly increased use of other providers’ subdomains:
What makes these free web hosting accounts
and their domains popular among phishers?
Phishers exploit the trusted name, e.g., Microsoft, or trust the valid SSL/HTTPS server certificate of these providers.
The base domains, e.g., pages.dev or windows.net, are trusted by enterprises: URLs containing these domains and any subdomains (accounts) are implicitly trusted.
AI tools offered by the subdomain provider (e.g., Vercel’s GenAI tool v0.dev) create nearly identical content to impersonated brand pages as well as fully functional logins or other scripts.
Many of these services are intended for developers (the obvious being pages.dev), and sites have difficulty identifying and removing obfuscated scripts or malicious payloads in a timely manner.
When we look across the six years of studies to see the top 5 each year, we see that lots of changes have occurred in this space:
In the next post, we turn our attention to the hosting networks (ASNs) that are being used by phishers.
Articles in this series (to date):