Cloudflare just dropped some eye-opening numbers showing that more than 5% of all emails flying around the world carry malicious intent.
Think your email is safe? Think again.
In their deep dive over the past year, Cloudflare found a crazy 5.6% of global email traffic was downright harmful. To put that in perspective, that’s one email in every 20 hitting inboxes everywhere.
Your completely free resource hub designed to boost your knowledge of cryptocurrencies
Things got even wilder in November, when the bad stuff spiked to nearly 10%, almost double the yearly average.
These aren’t just annoying spam; we’re talking emails designed to steal your credentials, data, or hard-earned cash, as detailed in Cloudflare’s 2025 year-in-review report.
This hits especially close to home for crypto fans. Phishing scams aimed at traders, investors, and big players in the space have gotten sneakier and more frequent lately.
Cloudflare Says Deceptive Links Lead the Pack in Email Attacks
Digging deeper, Cloudflare reports that over half, or 52%, of these malicious emails hid a tricky deceptive link, making it the top threat by far.
Coming in second was identity deception at 38%, up from last year, where crooks fake trusted senders using spoofed domains, look-alike sites, or clever display name swaps.
Cloudflare also spotlighted some shady domain trends. The worst offender? The “.christmas” top-level domain, with a staggering 92.7% of emails from it being malicious.
Hot on its heels were “.lol,” “.forum,” “.help,” “.best,” and “.click” all favorites for spammers and scammers.
It’s not just links; attachments are trouble too. Other security pros like Barracuda scanned hundreds of millions of emails and found a quarter were straight-up spam, with one in four HTML attachments turning out malicious. Even PDFs got in on it, with 12% of bad ones pushing Bitcoin scams.
Barracuda scanned hundreds of millions of emails: Via Barracuda
These revelations from Cloudflare are a wake-up call: beef up your defenses, double-check those senders, and certainly never click suspiciously.
