Phishing Analytics

So far in November 2026 (month in progress), PhishDestroy detected 3,238 phishing domains. 90 of them (2.8%) were offline at last check, while 2,968 were still reachable at their last check. The most abused registrar was Dynadot Inc with 548 malicious domains, followed by MarkMonitor Inc. (521). Attackers targeted signal hardest, with celer a close second.

In October 2026, PhishDestroy detected 19,515 phishing domains, a 31.2% increase from September. 1,772 of them (9.1%) were offline at last check, while 16,978 were still reachable at their last check. The most abused registrar was Dynadot Inc. with 5,002 malicious domains, followed by Dynadot Inc (2,307). Attackers targeted MetaMask hardest, with PayPal a close second.

In September 2026, PhishDestroy detected 14,869 phishing domains, a 15% decrease from August. 4,554 of them (30.6%) were offline at last check, while 9,850 were still reachable at their last check. The most abused registrar was Dynadot Inc with 1,196 malicious domains, followed by Dynadot Inc. (1,174). Attackers targeted Unknown hardest, with MetaMask a close second.

In August 2026, PhishDestroy detected 17,488 phishing domains, a 5% decrease from July. 7,135 of them (40.8%) were offline at last check, while 9,612 were still reachable at their last check. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 1,724 malicious domains, followed by Cloudflare Pages (1,054). Attackers targeted Unknown hardest, with MetaMask a close second.

In July 2026, PhishDestroy detected 18,418 phishing domains, a 16% decrease from June. 6,940 of them (37.7%) were offline at last check, while 10,519 were still reachable at their last check. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 2,275 malicious domains, followed by Fewmoretaps OU d/b/a Trustname.com (924). Attackers targeted Unknown hardest, with Google a close second.

In June 2026, PhishDestroy detected 21,929 phishing domains, a 196.9% increase from May. 8,944 of them (40.8%) were offline at last check, while 11,574 were still reachable at their last check. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 3,523 malicious domains, followed by Wix Studio (1,112). Attackers targeted Unknown hardest, with Trezor a close second.

In May 2026, PhishDestroy detected 7,387 phishing domains, a 55.7% decrease from April. 3,654 of them (49.5%) were offline at last check, while 3,276 were still reachable at their last check. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 711 malicious domains, followed by Cloudflare, Inc. (644). Attackers targeted Unknown hardest, with Ledger a close second.

In April 2026, PhishDestroy detected 16,688 phishing domains, a 20.3% decrease from March. 8,118 of them (48.6%) were offline at last check, while 7,504 were still reachable at their last check. The most abused registrar was Cloudflare, Inc. with 4,459 malicious domains, followed by Wix Studio (1,620). Attackers targeted Ledger hardest, with Trezor a close second.

In March 2026, PhishDestroy detected 20,935 phishing domains, a 47.6% decrease from February. 10,428 of them (49.8%) were offline at last check, while 7,016 were still reachable at their last check. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 4,867 malicious domains, followed by CloudFlare, Inc. (4,337). Attackers targeted Unknown hardest, with Ledger a close second.

In February 2026, PhishDestroy detected 39,927 phishing domains, a 348.9% increase from January. 24,388 of them (61.1%) were offline at last check, while 10,575 were still reachable at their last check. The most abused registrar was NiceNIC International Group Co., Limited with 8,814 malicious domains, followed by Cloudflare, Inc. (6,190). Attackers targeted Unknown hardest, with Coinbase a close second.

In January 2026, PhishDestroy detected 8,894 phishing domains, a 23.6% decrease from December. 5,664 of them (63.7%) were offline at last check, while 2,380 were still reachable at their last check. The most abused registrar was NiceNIC International Group Co., Limited with 1,320 malicious domains, followed by PDR Ltd. d/b/a PublicDomainRegistry.com (974). Attackers targeted Unknown hardest, with Binance a close second.

In December 2025, PhishDestroy detected 11,646 phishing domains, a 6.7% decrease from November. 6,666 of them (57.2%) were offline at last check, while 4,155 were still reachable at their last check. The most abused registrar was NiceNIC International Group Co., Limited with 1,284 malicious domains, followed by Cloudflare, Inc. (1,145). Attackers targeted Unknown hardest, with coinbase a close second.

In November 2025, PhishDestroy detected 12,482 phishing domains, a 42% increase from October. 8,338 of them (66.8%) were offline at last check, while 3,223 were still reachable at their last check. The most abused registrar was Dynadot LLC with 2,109 malicious domains, followed by Cloudflare, Inc. (1,498). Attackers targeted Google hardest, with Unknown a close second.

In October 2025, PhishDestroy detected 8,793 phishing domains, a 21.2% increase from September. 5,110 of them (58.1%) were offline at last check, while 2,577 were still reachable at their last check. The most abused registrar was NiceNIC International Group Co., Limited with 1,206 malicious domains, followed by Cloudflare, Inc. (827). Attackers targeted Unknown hardest, with Google a close second.

In September 2025, PhishDestroy detected 7,253 phishing domains, a 92.8% increase from August. 4,962 of them (68.4%) were offline at last check, while 1,584 were still reachable at their last check. The most abused registrar was NiceNIC International Group Co., Limited with 779 malicious domains, followed by Web Commerce Communications Limited (677). Attackers targeted Unknown hardest, with SushiSwap a close second.

In August 2025, PhishDestroy detected 3,762 phishing domains, a 442.9% increase from July. 2,611 of them (69.4%) were offline at last check, while 970 were still reachable at their last check. The most abused registrar was Web Commerce Communications Limited with 276 malicious domains, followed by NameSilo, LLC (253). Attackers targeted Unknown hardest, with Ethereum a close second.

In July 2025, PhishDestroy detected 693 phishing domains, a 23000% increase from June. 540 of them (77.9%) were offline at last check, while 114 were still reachable at their last check. The most abused registrar was Web Commerce Communications Limited with 84 malicious domains, followed by NameSilo, LLC (78). Attackers targeted Unknown hardest, with ethereum a close second.

In June 2025, PhishDestroy detected 3 phishing domains. 3 of them (100%) were offline at last check. The most abused registrar was NameSilo, LLC with 1 malicious domains, followed by Web Commerce Communications Ltd. (1). Attackers targeted chainlink hardest, with amazon a close second.