Over nine months of 2026, specialists received almost 50,000 reports of dangerous websites in the .RU and .RF domain zones. This is 32% more than in the same period last year. Most often, these reports concerned phishing sites used to deceive users and resources distributing malicious programs. These data are provided by the Coordination Center for .RU/.RF Domains based on the results of the "Domain Patrol" project.

From January to September, 49.53 thousand appeals were received, compared to 37.49 thousand in the same period of 2025. This is almost 80% of the total number of appeals for the entire last year — 62.17 thousand. The number of reports about the spread of malicious programs grew particularly rapidly. Over nine months, their number increased 1.9 times — from 7.15 thousand to 13.54 thousand. The share of such appeals rose from 19.1% to 27.3%.

The situation changed throughout the year

From February to April, more reports of websites with malicious software were received than of phishing. By the end of the first half of the year, this category took first place.

However, since May, phishing has again taken the lead. From January to September, the number of appeals about such sites increased by 17% and reached 29.6 thousand; a year earlier, it was 25.3 thousand. Phishing accounted for 59.8% of all appeals over nine months.

In total, as a result of reviewing the reports, 48.56 thousand malicious domains were blocked — this is 98% of the number of appeals. This figure is 32.6% higher than from January to September 2025. On average, it took 5.8 hours from receiving an appeal to blocking a domain.

AI helps fraudsters

Evgeny Pankov, data analyst at the Coordination Center for .RU/.RF Domains, explained the increase in the number of threats by the development of artificial intelligence. According to him, attackers can massively register domains, quickly create phishing sites on them, and automate attacks.

However, starting from September 1, domain administrators are gradually being authorized through ESIA. The Coordination Center expects that this measure will make it more difficult to register and use domains for phishing and other abuses.