Malicious websites today
17,416
Malicious websites this week
92,061
Malicious websites this month
465,984
Total malicious websites
21,850,537
TLD distribution
- .com - 50.1%
- .top - 17.1%
- .xyz - 10.1%
- .cc - 6.3%
- .buzz - 3.4%
- .shop - 3.3%
- .net - 3.0%
- .cn - 2.6%
- .org - 2.3%
- .info - 1.8%
Threat trend
21.4M21.6M21.7M21.9M
Threats26/0902/1008/1013/1019/1025/10
Recent threats
https://fileditchfiles.me/alpha4/0171b1935edb...
Risk score9/10- The submitted URL is a direct link to a RAR archive on fileditchfiles.me, a throwaway anonymous file-hosting domain, and the filename 'ultrakill-steamrip.com.rar' falsely implies it comes from SteamRIP.
- The archive is disguised as a pirated game download (ULTRAKILL), a common lure for distributing infostealers, loaders and other trojans packaged as cracked games.
https://crypto-mmm.com
Risk score10/10- The site promises a fixed return of 10% every two days on Bitcoin deposits, which is an unsustainable and implausible rate typical of Ponzi and high-yield investment scams.
- The branding 'MMM' and the 'Ideology' section reference the notorious MMM Ponzi scheme, and the 'donation to the fund' wording is a familiar way to dodge investment regulation.
https://besira.net
Risk score10/10- The site is a media aggregation portal that distributes official Islamic State (ISIS) propaganda, including the An-Naba newspaper, Amaq news agency reports, and releases from the Al-Furqan, Al-Hayat, and Al-Furat media foundations.
- The page openly declares allegiance to the Islamic State and its self-declared caliphate, and presents itself as providing access to official and supporter media in one place.
https://alfustat.link
Risk score9/10- The site is an archive of official Islamic State (ISIS) propaganda, including Al-Naba newspaper issues, Al-Furqan and Al-Hayat Media Center releases, Amaq-style official news, nasheeds, and provincial (wilayat) media.
- Content includes official battle reports celebrating killings, such as fighters killing Christian captives by beheading in Mozambique and ambushes on the Nigerian army, which glorify and promote terrorist violence.
https://vnpaykhachsan24h.com
Risk score9/10- The domain vnpaykhachsan24h.com is not an official VNPAY domain, yet the page copies the VNPAY brand name, logo, banners, and the legal entity name of the Vietnamese payment company, which is clear brand impersonation.
- The domain was registered on October 2, 2026, only about three weeks before analysis, and the registrant is listed as a generic address, which is typical of throwaway phishing infrastructure.
https://giaohangnhanh.online
Risk score10/10- The site imitates the well-known Vietnamese courier brand Giao Hàng Nhanh (GHN) through its domain name, logo styling and brand name, but it runs on a generic .online domain and is not the official GHN site.
- The page uses a mass-produced WordPress template that contains leftover placeholder text such as 'WooCommerce not Found' and a theme path named 'thietkewebwordpress', which points to a cloned or hastily built site and not a genuine logistics company.
https://appfakebill.online
Risk score10/10- The page is a Vietnamese game account shop that sells Free Fire, Liên Quân, LMHT, TFT, Tốc Chiến and CF accounts. It has a card top-up form asking for carrier, denomination, card serial and card code, which is a typical way to harvest prepaid card codes or steal funds.
- The domain appfakebill.online was registered on November 14, 2025. The name suggests fake bills or receipts and has no connection to the game brands it advertises, which is typical of a disposable scam domain.
https://hkdt-cp.com
Risk score9/10- The page is a clone of a Google Play Store listing hosted on hkdt-cp.com, which is not a Google domain, so it impersonates the official app store to lend false legitimacy.
- It impersonates the Vietnamese Ministry of Public Security's 'Cổng Dịch vụ công Bộ Công An' app, using the official emblem and government branding to trick victims into trusting it.
https://motogearvip-outlets.shop
Risk score9/10- The site impersonates the legitimate motorcycle gear brand REV'IT! by using its logo, product names, and a copyright line reading 'REV'IT! Sport International' on an unrelated, generically named .shop domain, which is a typical counterfeit storefront pattern.
- The domain was registered only about 8 days ago, and brand-impersonating shops on freshly registered domains are commonly short-lived fraud operations.
https://myfidelitysite.com
Risk score9/10- The page imitates a Fidelity Investments plan sponsor login portal, using Fidelity branding, logos, trademark notices, and the FMR LLC corporate address and copyright line to appear legitimate.
- The domain myfidelitysite.com is not an official Fidelity domain. It embeds the brand name in a generic third-party domain, a common technique for impersonating a financial institution.
https://cccstyle.shop
Risk score9/10- The domain cccstyle.shop was registered today and impersonates CCC, a well-known Polish footwear retailer, using its logo and branding. The legitimate retailer operates on ccc.eu, not on a .shop lookalike domain.
- Every product carries an identical 74% discount, for example RIDER V at 50 zł down from 199.99 zł and socks at 6.25 zł. Uniform, extreme discounts on name brands such as Puma, Adidas, Vans, Lacoste and Reebok are a classic sign of a fake store.
https://yankeestore.shop
Risk score9/10- The domain yankeestore.shop was registered only two days ago, yet it presents itself as a Helly Hansen (HH) outlet. The domain name has no connection to the brand, which strongly suggests an unauthorized counterfeit storefront.
- Nearly every product is advertised at exactly 90% off, such as a €280 jacket for €28 and a €1,800 dry suit for €180. Discounts this deep and uniform on premium outdoor gear are a typical sign of a fake shop that collects payments without delivering goods.
Miễn trừ trách nhiệm: Chúng tôi không đảm bảo kết quả chính xác và không chịu trách nhiệm cho bất cứ điều gì.