". com ( 9. 98 % ), a domain typically used as a browser - hijacking server and for phishing attacks, serving as a link in an infection chain. rounding out the local threats in east asia are the following domains : * e * v *. com ( 9. 37 % ), utilized in drive - by attacks ; * a *…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
87%
"22. 84 % ), and * e * p *. com ( 9. 36 % ) – are potentially fraudulent online trading platforms suspected of using forged licenses. these sites employ classic scam schemes where it ’ s impossible to withdraw any alleged earnings. in fifth place is a domain we ’ ll also see in th…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1566.002Spearphishing Link
85%
". com ). this site positions itself as a photo editing tool, but in reality, it serves as an intermediary server for uploading images used in phishing and other malicious campaigns. the scheme typically works like this : a victim clicks a link disguised as a harmless image, after…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1584.001Domains
81%
". com ( 9. 98 % ), a domain typically used as a browser - hijacking server and for phishing attacks, serving as a link in an infection chain. rounding out the local threats in east asia are the following domains : * e * v *. com ( 9. 37 % ), utilized in drive - by attacks ; * a *…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
81%
"next site appeared in 7 regions. it consists of a landing page for a fake antivirus solution presented as a browser extension ( * n * s *. com ). this extension redirects the user to a fake search engine page allowing it to collect data and track user activity, specifically searc…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
81%
"the default search engine for a fake one, and perform other malicious actions. furthermore, it maintains full control over all browser traffic. percentage of the * w * a *. com domain detections by region, january 2026 ( download ) this “ service ” has its largest share, 22. 25 %…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
78%
"malware distribution - * s *. gg ( 3. 49 % ) : a scam site masquerading as a play - to - earn blockchain game the ranking concludes with sites that overlap with the russian region. * a *. consulting ( 2. 42 % ) is a fake clone of a binary options site, and * a *. lol ( 2. 32 % ) …"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1584.001Domains
70%
"malware distribution - * s *. gg ( 3. 49 % ) : a scam site masquerading as a play - to - earn blockchain game the ranking concludes with sites that overlap with the russian region. * a *. consulting ( 2. 42 % ) is a fake clone of a binary options site, and * a *. lol ( 2. 32 % ) …"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1584.001Domains
62%
"crypto platforms and ai bots. the primary threats in latin american countries include financial loss through gambling and ponzi schemes, as well as the theft of nfts and other tokens. east asia distribution of the top 10 suspicious websites in east asia, january 2026 ( download )…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
62%
"25. 72 % ) and oceania ( 30. 92 % ), while also appearing in the top 10 for east asia ( 8. 01 % ) and africa ( 0. 88 % ). consequently, we can see that the majority of suspicious sites detected by our solutions worldwide are browser hijackers masquerading as security products. ne…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1176.001Browser Extensions
55%
"the default search engine for a fake one, and perform other malicious actions. furthermore, it maintains full control over all browser traffic. percentage of the * w * a *. com domain detections by region, january 2026 ( download ) this “ service ” has its largest share, 22. 25 %…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
51%
"m *. top ( 7. 84 % ), is an imitator of a well - known binary options broker. this suspicious site was recently registered and has a tellingly low rating on domain verification services. the second, * t * e *. ru ( 3. 25 % ), claims to be an educational platform and has a dubious…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
50%
"% ), canada ( 7. 21 % ), and oceania ( 1. 93 % ). in 4 out of the 10 regions, we identified several other recurring sites. one of them ( * n * p *. xyz ) mimics a repository for creative ai image generation prompts while capturing browser data. the domain hosting this site exhibi…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1566.002Spearphishing Link
49%
"whose activities are inherently unsafe. these sites often operate on the fringes of the law, even if they aren ’ t directly violating it. sometimes they use a cleverly crafted terms of service document as a loophole. these agreements might include clauses such as no - refund poli…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1176.001Browser Extensions
49%
"next site appeared in 7 regions. it consists of a landing page for a fake antivirus solution presented as a browser extension ( * n * s *. com ). this extension redirects the user to a fake search engine page allowing it to collect data and track user activity, specifically searc…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1584.001Domains
47%
"next site appeared in 7 regions. it consists of a landing page for a fake antivirus solution presented as a browser extension ( * n * s *. com ). this extension redirects the user to a fake search engine page allowing it to collect data and track user activity, specifically searc…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1584.001Domains
46%
"25. 72 % ) and oceania ( 30. 92 % ), while also appearing in the top 10 for east asia ( 8. 01 % ) and africa ( 0. 88 % ). consequently, we can see that the majority of suspicious sites detected by our solutions worldwide are browser hijackers masquerading as security products. ne…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1176.001Browser Extensions
45%
"canada ( 14. 35 % ). the third site ( * h * t *. com ) poses as a private browsing extension. in reality, it ’ s another potentially unwanted application designed for browser hijacking : it modifies settings, steals sensitive data ( cookies, browser history, and queries ), and ca…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
43%
"in europe, january 2026 ( download ) in the european region, we ’ ve found two unique domains. the first of these, * c * r *. org, has been identified as part of a chain for massive phishing and spam attacks, as well as other malicious activities. it accounts for a 16. 08 % share…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
42%
"in the. bar domain zone are frequently used for scams. in second place in the cis ( 15. 29 % ) and sixth in russia ( 3. 75 % ) is the domain * p * o *. ru, which is often associated with bots for inflating follower counts and automating community management. domains from fourth t…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
41%
"potentially fraudulent. one of the first things to check is the domain age. scam websites are often short - lived, appearing only for a few weeks or months before disappearing once users start reporting them. to check when the domain was created, use a whois lookup. if it ’ s les…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
38%
"canada ( 14. 35 % ). the third site ( * h * t *. com ) poses as a private browsing extension. in reality, it ’ s another potentially unwanted application designed for browser hijacking : it modifies settings, steals sensitive data ( cookies, browser history, and queries ), and ca…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1584.001Domains
38%
"##ing. south asia distribution of the top 10 suspicious websites in south asia, january 2026 ( download ) in south asian countries, we also observe a concentration of local suspicious sites specific to the region. the second most popular site in the region is * a * s *. com ( 12.…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1583.001Domains
37%
"be a cybersecurity expert to catch many red flags just by observing the site ’ s domain, visuals, language and behavior. for instance, scam sites often have strange or randomly generated names, filled with numbers, underscores, hyphens, or meaningless words, like best - shop43. c…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1584.001Domains
33%
". com ). this site positions itself as a photo editing tool, but in reality, it serves as an intermediary server for uploading images used in phishing and other malicious campaigns. the scheme typically works like this : a victim clicks a link disguised as a harmless image, after…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1566.002Spearphishing Link
31%
"manipulations to deceive users, tricking them into voluntarily handing over their personal data and transferring funds. by examining the top 10 suspicious sites across the world ’ s major regions, we can draw several conclusions. on average, the most prevalent threats globally ar…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
We explain what suspicious websites are and how to distinguish a safe site from a fraudulent one. A new category in Kaspersky solutions: we're sharing global statistics on untrusted site detection.