Q1 2026 Global Scam Intelligence Report

ScamLens processed 3,108,723 threat intelligence records in Q1 2026, aggregated from 90+ real-time sources. This report presents five key findings from the data:

1. Phishing remains the dominant threat vector. Our database tracked 809,386 unique phishing URLs from PhishTank, OpenPhish, and community-verified submissions — a volume that reflects the continued industrialization of phishing kit deployment.
2. Scam storefronts are scaling through cheap TLDs. 468,729 domains flagged as scam-related were concentrated on TLDs with low registration costs: .top (111,952), .xyz (109,639), .shop (82,062), and .click (51,865).
3. Cryptocurrency wallet drainers are the fastest-growing category. ScamSniffer data shows 330,248 drainer-linked addresses, while MetaMask's community blocklist contributes 253,080 flagged domains — suggesting wallet-connect phishing is now a mass-market scam technique.
4. Bitcoin dominates crypto scam targeting. 78% of cryptocurrency addresses analyzed (620 of 796) were Bitcoin addresses, reflecting the chain's use as the primary payment rail in investment fraud, sextortion, and ransomware.
5. Multi-source consensus scoring reduces false positives. Domains flagged by only 1 of 90+ sources have a 34% false positive rate. Domains flagged by 3+ independent sources have a <2% false positive rate — validating ScamLens's cross-referencing methodology.

ScamLens aggregates threat intelligence from 10 primary feed categories. The table below shows the contribution of each major source to the Q1 2026 dataset:

TLD (Top-Level Domain) choice is a strong early indicator of scam intent. While .com dominates by absolute volume due to market share, high-risk TLDs have abuse rates 10-50x higher than trusted TLDs when normalized by registration count.

ScamLens analyzed 796 cryptocurrency addresses across 4 blockchain networks in Q1 2026. The distribution reveals clear patterns in how different chains are exploited:

Q1 2026 saw continued growth in AI-assisted scam operations across three categories:

5.1 Deepfake voice cloning

Voice cloning attacks now require as little as 3 seconds of sample audio. Attackers use cloned voices to impersonate family members ("grandparent scams"), company executives (business email compromise), and bank representatives. ScamLens's AI Voice Clone Scam Guide documents four primary attack patterns and five identification techniques.

5.2 AI-generated phishing content

Traditional phishing detection relied on spelling errors, grammar mistakes, and template-like language. LLM-generated phishing emails eliminate these signals. ScamLens's content analyzer uses AI to detect manipulation tactics and urgency patterns rather than surface-level text quality, maintaining detection effectiveness against AI-written scams.

5.3 Fake investment platform proliferation

AI tools enable rapid creation of convincing investment platform websites with fabricated trading dashboards, fake customer testimonials, and professional marketing copy. These sites typically appear on recently registered .top/.xyz/.shop domains — ScamLens's domain age + TLD risk scoring catches the majority of these operations within hours of deployment.

Data collection

All data in this report was collected through ScamLens's automated threat intelligence aggregation pipeline, which runs continuously on Cloudflare Workers. The pipeline queries 90+ sources including:

• Feed-based sources (automated sync): Hagezi TIF, Phishing Database, Scam Blocklist, ScamSniffer, MetaMask Blocklist, Phishing Army, Red Flag Domains, Maltrail, OpenPhish, PhishTank
• API-based sources (per-query): Google Safe Browsing, VirusTotal, IPQualityScore, AbuseIPDB, Cloudflare Radar, URLScan.io, SecurityTrails, Shodan, RDAP, GoPlus Security, Etherscan, Moralis, Token Sniffer, Chainalysis sanctions, OpenSanctions
• Community sources: User-submitted reports, votes, and comments via scamlens.org

Scoring methodology

Trust scores (0-100) are calculated using 15+ weighted factors documented at scamlens.org/methodology. The scoring algorithm is deterministic and reproducible — the same inputs always produce the same score.

Evidence labeling

All AI-generated assessments in this report and on the ScamLens platform are labeled with evidence tiers:

• [FACT] — Data directly from verified threat intelligence sources
• [INFERENCE] — Pattern-based analysis derived from multiple data points
• [UNVERIFIED] — Signals that require additional confirmation

Limitations

• This report covers data processed by ScamLens and does not represent all global scam activity
• Crypto address analysis is limited to addresses submitted by users; it is not an exhaustive blockchain scan
• Feed-based threat intelligence may contain false positives from upstream sources; ScamLens mitigates this through multi-source cross-validation
• Geographic visitor data (Section 2) reflects ScamLens user distribution, not scam origin distribution

Data availability

Researchers and institutions may request access to anonymized datasets from this report for academic use. Contact [email protected] with institutional affiliation and intended use.