Threat BriefingMarch 16, 2026

Weekly Threat Briefing: March 10–16, 2026

Record-breaking phishing kit takedowns, emergence of Telegram-based phishing-as-a-service, and DNSBL effectiveness study published.

Overview

A productive week for takedowns — 847 phishing domains were taken down within 24 hours of vspam.org abuse reports, a record for the platform. The DNSBL Effectiveness Study was published, showing 94.7% email blocking rate. Community submitted 8,731 reports.

Phishing-as-a-Service on Telegram

Three distinct phishing-as-a-service (PhaaS) operations were tracked distributing kits via Telegram marketplace channels. These services offer turnkey phishing infrastructure including hosting, domain registration, and credential exfiltration.

—'PhishForge' — targeting banking sites, $500/month, includes rotating proxy infrastructure

—'MailGhost' — email phishing kit with real-time victim notification, $300/month

—'BrandClone' — automated brand impersonation across 50+ templates, $200/month

—Combined infrastructure across 312 domains in 14 countries

—All indicators submitted and confirmed within 6 hours of discovery

Takedown Response Times

Working with hosting providers to improve takedown velocity produced strong results this week:

847847 domains taken down within 24 hours (previous record: 612)

—Average time-to-takedown: 6.3 hours (down from 11.2 hours last quarter)

—Hetzner, OVH, and DigitalOcean leading in response times (< 2 hours)

1212 providers now accepting XARF-formatted reports from vspam.org

Platform Metrics

Key metrics for the week:

8,7318,731 total reports submitted

6,8916,891 confirmed, 923 rejected, 917 pending

—Median confirmation time: 42 minutes

—DNSBL zone size: 34,178 active entries

Tagsphishing-kitstelegramtakedownsweekly-briefing

For automated IOC data from this briefing, check the threat feeds. Questions about our analysis? Contact research@vspam.org.