PhaaS Tracker
Phishing is a product these days. Someone else writes the login page, keeps the branding current, handles the anti-bot check and the code prompt, and rents the whole thing out. The customer brings a domain and a mailing list. That is why the same page turns up on thousands of hosts with nothing changed but the logo, and why burning one domain costs whoever is running it almost nothing.
Domains added
New domains entering the feed each day over the last 30 days. 9,740 in total.
Recently added domains
50 recent additions, newest first.
| Domain | Added |
|---|---|
205f6372-38b1-4210-8fb2-5fb60958d372-00-cumdt5dulu1x[.]janeway[.]replit[.]dev | Jul 25, 2026 |
261957[.]xyz | Jul 25, 2026 |
268439[.]xyz | Jul 25, 2026 |
4698b52c-b60e-4745-ab32-ded3ee5b3e06-00-1ia5ii301vie8[.]janeway[.]replit[.]dev | Jul 25, 2026 |
agilery[.]co | Jul 25, 2026 |
anixctwmonsulting[.]vu | Jul 25, 2026 |
app--netcoin-auth[.]pages[.]dev | Jul 25, 2026 |
app-live-ledger-wllet[.]typedream[.]app | Jul 25, 2026 |
app[.]tmwebcg[.]wiki | Jul 25, 2026 |
appstart-site[.]wixstudio[.]com | Jul 25, 2026 |
auth-web-ledger-live-desktop[.]typedream[.]app | Jul 25, 2026 |
autorfqonfreeagent[.]generalreductionrevolutiondirect[.]click | Jul 25, 2026 |
basduno[.]sbs | Jul 25, 2026 |
begin-ledgeaapscdn[.]wixstudio[.]com | Jul 25, 2026 |
bovkaba[.]cfd | Jul 25, 2026 |
bridgs-applives[.]wixstudio[.]com | Jul 25, 2026 |
browser-ledgrcdn[.]wixstudio[.]com | Jul 25, 2026 |
ca-ndax-ca[.]webflow[.]io | Jul 25, 2026 |
cf491689[.]tw1[.]ru | Jul 25, 2026 |
choose-desktop[.]wixstudio[.]com | Jul 25, 2026 |
co-web-ledger-live-login[.]typedream[.]app | Jul 25, 2026 |
collect-flarefn[.]live | Jul 25, 2026 |
coloradoonlinemarketing[.]com | Jul 25, 2026 |
epicaccountcheck[.]guru | Jul 25, 2026 |
flarefn-phase1[.]live | Jul 25, 2026 |
flarefoundation-gain[.]xyz | Jul 25, 2026 |
flarefoundation-launch[.]xyz | Jul 25, 2026 |
io-started-trezo[.]wixstudio[.]com | Jul 25, 2026 |
landfomarkpool[.]nl | Jul 25, 2026 |
logi-ndax-usa[.]webflow[.]io | Jul 25, 2026 |
mcsostreet[.]com | Jul 25, 2026 |
meituamaxklog[.]gitbook[.]io | Jul 25, 2026 |
metamaek-walletx[.]gitbook[.]io | Jul 25, 2026 |
metamskxtnsn[.]gitbook[.]io | Jul 25, 2026 |
minfin[.]fgov[.]be[.]services[.]l4rmrpycy81al9apgkpqttrplbz3woyluj2xa6dxsugp1gybszzy[.]compasscare[.]health | Jul 25, 2026 |
myebox[.]be[.]services[.]l1wufw8z4pxqks3i6xbw7b6y27y5ualr9drnaupvuqi2tcemmdr7[.]compasscare[.]health | Jul 25, 2026 |
online-bridgesso[.]wixstudio[.]com | Jul 25, 2026 |
php-web-server--mexicoeducation[.]replit[.]app | Jul 25, 2026 |
proposal-peelcas[.]vercel[.]app | Jul 25, 2026 |
pub-b3b0680d42264c6f875784e03ade76f6[.]r2[.]dev | Jul 25, 2026 |
pub-e8f85a500a5c4ac5835b5ccd38453023[.]r2[.]dev | Jul 25, 2026 |
pub-fb9f5e86f3c44ed89dd929b10e12e82f[.]r2[.]dev | Jul 25, 2026 |
secure-web-ndxxa-cdns[.]typedream[.]app | Jul 25, 2026 |
sistenccias2026webbes[.]xo[.]je | Jul 25, 2026 |
www[.]minfin[.]fgov[.]be[.]services[.]l4rmrpycy81al9apgkpqttrplbz3woyluj2xa6dxsugp1gybszzy[.]compasscare[.]health | Jul 25, 2026 |
camps-odyssee-portail[.]web[.]app | Jul 24, 2026 |
gs4yb54uub[.]secureplatformshub[.]de | Jul 24, 2026 |
international[.]vu | Jul 24, 2026 |
trust[.]tg | Jul 24, 2026 |
wiizgood[.]com | Jul 24, 2026 |
Infrastructure
Hosting providers
Networks answering for the tracked domains
- 1 Cloudflare, Inc. 2,670
- 2 DigitalOcean, LLC 2,010
- 3 IONOS SE 1,362
- 4 Amazon.com, Inc. 312
- 5 Wildcard UK Limited 276
- 6 Omegatech LTD 213
- 7 Google LLC 194
- 8 FAST ZONE IT 190
Countries
Where those addresses geolocate
- 1 US 5,736
- 2 DE 1,430
- 3 NL 392
- 4 GB 330
- 5 FI 194
- 6 ES 178
- 7 HK 131
- 8 SG 86
Top-level domains
Registration patterns across the tracked set
- 1 .com 6,609
- 2 .net 1,573
- 3 .dev 807
- 4 .vu 680
- 5 .sbs 486
- 6 .de 373
- 7 .cfd 339
- 8 .top 330
