Malwarebytes maps each scam category to the channel that delivers it

The pairing is the part with operational consequences. Job lures land where work mail lands. Romance fraud shows up where meeting strangers is normal, and tech support fraud arrives down a phone line ^[2]. Those sit behind different controls, and only one of them is a mail gateway.

The hourly numbers are steeper than the percentage reads. Malwarebytes puts the scam text peak at 12:00 pm ET, about 874 percent above the 1:00 am ET trough ^[5]. Add the baseline back and divide: (100 + 874) / 100, so noon carries roughly 9.7 times the volume of the quietest hour ^[11]. That points to deliberate scheduling behind the bursts.

Provenance matters here more than the individual percentages. Everything comes from one vendor's view of its own install base over a 91-day window ^[12]. The brand ranking, with Google abused at least twice as often as Amazon, comes from user reports rather than product telemetry ^[8]. The 500,000 phishing sites blocked per day is the company's own figure ^[4]; taken at face value across the window, that is about 45.5 million sites ^[13]. No second data set in the material corroborates any of it.

Outcomes are missing from this data set entirely. Every reported metric is a delivery count or a share of impersonations ^[14]. So the specialization Malwarebytes describes ^[10] is a statement about where scams arrive, not about which arrivals convert or what they cost. A program funded against losses cannot rank its channels from this.

It can still see that the targets are unevenly distributed. Generic awareness content spends the same minute on the same generic warning for a recruiter working an inbox and a help desk taking inbound calls, while the telemetry says the lure reaching each of them travels a different route ^[2]. The web is still the widest doorway, ahead of email and SMS ^[3], and that is the one channel where a blocklist does most of the work without a human in the loop.

The fastest-moving segment reported sits furthest from anything a security team owns. Roblox impersonation activity rose 15 percent and Steam 19 percent between mid-June and mid-July, with Discord and Minecraft also among the most impersonated gaming platforms ^[9]. Those are household accounts. So is most of the surface where MrBeast's likeness, present in about 30 percent of impersonation scams in this data ^[7], does its work.