San Francisco, CA: March 27, 2026 – The Anti-Phishing Working Group (APWG) counted about 3.8 million phishing attacks in 2025, slightly above the 3.76 million recorded in 2024. Activity peaked in the second quarter with 1,130,393 attacks, after 1,003,924 in the first quarter, and then eased to 892,494 in the third quarter and 853,244 in the fourth.
Almost every one of those attacks relies on a domain, whether it is a look-alike of a well-known brand, a compromised legitimate site or a freshly registered address used for a few days. APWG also reported that scams are increasingly delivered by social media, SMS and QR codes rather than email alone.
Inside many organisations, ownership of domains is still split. IT runs DNS, legal handles trademarks and marketing registers the campaign names, and no single team sees the whole portfolio or the abuse aimed at it.
“Phishing succeeds at the seams between teams. A single view of the domain portfolio, the brand abuse around it and the security controls on it closes most of those seams,” says Marcus Whitfield, cybersecurity and digital risk intelligence expert at MarkScout.
MarkScout recommends a combined approach: one inventory of owned domains, continuous monitoring for look-alikes, registry lock and multi-factor authentication on critical names, and enforced email authentication on every domain that sends mail.