This Week in Phishing and Malware: What the Security Feeds Show

Nov 2, 2026 · 4 minute read · By IsSiteLegit

On 2 November 2026, public security feeds listed 300 phishing links, 24,993 malware download links and 31,550 malware servers. The simple lesson: scam pages often sit on free hosting that looks harmless, so judge the full address and the message that brought you there, not just how polished the page looks.

This is a snapshot, not a full picture of the internet. Feeds only list what has already been found and reported. New scam sites can appear before any feed knows about them.

What the feeds list right now

Here are the totals from the feeds on 2 November 2026:

• Phishing links: 300
• Malware download links: 24,993
• Malware servers: 31,550

Phishing pages try to trick you into typing a password or card details. Malware links point to files that can harm your device. They are different problems, so they get different advice below.

Which brands phishing addresses imitate

In the phishing links listed that day, one name stood out: Roblox, with 25 links. After that came Facebook (5), Instagram (3), Airbnb (2), Coinbase (2) and iCloud (2). Booking and Google had 1 each.

In total, 14% of the phishing links imitated a recognisable brand. The rest did not clearly name one in the address.

A few of these are popular with younger users, like Roblox. Fake "free currency" or "free item" pages are a common trick. A real company will not ask you to log in through a link on a random page to claim a prize.

Domain endings and free hosting platforms

The most common endings in phishing addresses were:

• .dev: 124
• .com: 65
• .app: 31
• .in: 6
• .net: 6
• .io: 5
• .rw: 5
• .com.et: 4

The ending alone does not make a site bad. Plenty of honest sites use .dev and .app. But it helps to know where scammers are active.

More telling is the hosting. 56% of the phishing links sat on free site-building or hosting platforms. The top ones were:

• pages.dev: 120
• vercel.app: 23
• blogspot.com: 7
• netlify.app: 5
• github.io: 4
• workers.dev: 4
• duckdns.org: 2
• framer.app: 2

These services are legitimate and used by many real developers and small businesses. Scammers use them because they are free and quick. If a page claiming to be your bank or a big brand lives on an address like that, treat it as a warning sign. Big brands use their own domains.

Where malware downloads are hosted

The malware hosts in the feeds look surprising at first:

• raw.githubusercontent.com: 19,613 links
• github.com: 3,052
• wsimg.com: 1,098
• google.com: 193

These are not scam sites. They are large, legitimate services where anyone can upload files. Criminals abuse that openness to store harmful files, and the feeds list the individual links. Most files on these services are safe.

The practical point: a trusted name in the address does not prove a particular file is safe. What matters is who shared the link with you and why. By ending, 24,448 of the malware links used .com, mostly because of those big hosts.

Practical takeaways

1. Read the whole address, not just the start. The real domain is the part just before the first single slash. Our guide on checking a link before clicking shows how.
2. Be wary of big brands on free hosting. A login page for a famous service should be on that company's own domain.
3. Do not run files from unsolicited links. This applies even when the link points to a well-known site. Get software from the official source you went to yourself.
4. Ignore "free prize" offers in games and social apps. Roblox topped the list for a reason.
5. Go to the source directly. If a text or email worries you, open the company's app or type its real website yourself. Our page on fake delivery and toll texts covers a common example.

What our own checks showed

In the last 7 days, people ran 79 checks on IsSiteLegit. Of those, 68 came back likely legit, 8 got a caution and 3 were rated high risk. Most sites people check are fine, but a few are not. You can browse sites we have flagged on our high-risk page.

What a check can and can't tell you

Automated checks, including ours, use public signals such as domain age, security blacklists, look-alike names and page content. They can miss brand-new scam sites that no feed has listed yet. A good result is not a guarantee of safety. Use it alongside your own judgment.

If you already paid or clicked

• Clicked but entered nothing: close the page. Run a security scan on your device if you opened a download.
• Entered a password: change it right away on the real site, and anywhere you reused it. Turn on two-step login.
• Downloaded a file: disconnect from the internet, scan the device, and change important passwords from a different, clean device.
• Paid by card or transfer: call your bank or card issuer straight away and ask about stopping or reversing the payment.
• Report it: in the US, use reportfraud.ftc.gov. In the UK, use Action Fraud.

Not sure about a website? Paste it into the free IsSiteLegit checker and see the evidence for yourself.

Written with AI from IsSiteLegit's data and published after an automatic fact check: every number in this post comes from that data. Figures from security feeds describe the links listed on the day of the post. Where we link to a website’s IsSiteLegit result, a "likely legit" rating describes what our automated checks found when they ran. It is not an endorsement of the company, its products or its offers. How we write.