Weekly Threat Briefing: March 10–16, 2026
Record-breaking phishing kit takedowns, emergence of Telegram-based phishing-as-a-service, and DNSBL effectiveness study published.
Overview
A productive week for takedowns — 847 phishing domains were taken down within 24 hours of vspam.org abuse reports, a record for the platform. The DNSBL Effectiveness Study was published, showing 94.7% email blocking rate. Community submitted 8,731 reports.
Phishing-as-a-Service on Telegram
Three distinct phishing-as-a-service (PhaaS) operations were tracked distributing kits via Telegram marketplace channels. These services offer turnkey phishing infrastructure including hosting, domain registration, and credential exfiltration.
- 'PhishForge' — targeting banking sites, $500/month, includes rotating proxy infrastructure
- 'MailGhost' — email phishing kit with real-time victim notification, $300/month
- 'BrandClone' — automated brand impersonation across 50+ templates, $200/month
- Combined infrastructure across 312 domains in 14 countries
- All indicators submitted and confirmed within 6 hours of discovery
Takedown Response Times
Working with hosting providers to improve takedown velocity produced strong results this week:
- 847 domains taken down within 24 hours (previous record: 612)
- Average time-to-takedown: 6.3 hours (down from 11.2 hours last quarter)
- Hetzner, OVH, and DigitalOcean leading in response times (< 2 hours)
- 12 providers now accepting XARF-formatted reports from vspam.org
Platform Metrics
Key metrics for the week:
- 8,731 total reports submitted
- 6,891 confirmed, 923 rejected, 917 pending
- Median confirmation time: 42 minutes
- DNSBL zone size: 34,178 active entries
For automated IOC data from this briefing, check the threat feeds. Questions about our analysis? Contact research@vspam.org.