January 2026 Phishing Threat Report — PhishDestroy Analytics

January 2026 Intelligence Report 24%

8,919

4,777

Taken Down

3,209

Still Live

53.6%

Kill Rate

1906h

Avg Response

9.8

Avg VT Score

In January 2026, PhishDestroy detected 8,919 phishing domains, a 24% decrease from December. 4,657 of them (52.2%) have already been neutralized, while 3,459 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 1,316 malicious domains, followed by PDR Ltd. d/b/a PublicDomainRegistry.com (972). Attackers targeted genericcrypto hardest, with x.com a close second.

NiceNIC International Group Co., Limited alone accounts for 14.8% of the month's detections (1,316 domains) — concentration this high indicates systematic abuse, not random sign-ups.
Brand pressure is concentrated on genericcrypto and x.com — 1,429 lookalike domains between them.
The .com TLD leads with 3,244 malicious registrations, ahead of .cc (685).
Dominant drainer kit: Solana Drainer (254 deployments detected).
Average infrastructure response time: 1906h — well beyond any reasonable takedown window.

Outlook

Heading into February 2026, expect continued pressure on genericcrypto users; registrations via NiceNIC International Group Co., Limited remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.

Full Data on GitHub Browse All Domains Live Threats

Top Registrars

Registrar	Domains
NiceNIC International Group Co., Limited	1,316
PDR Ltd. d/b/a PublicDomainRegistry.com	972
Gname.com Pte. Ltd.	779
Dynadot LLC	453
Web Commerce Communications Limited	442
NameSilo, LLC	436
NameCheap, Inc.	436
GoDaddy.com, LLC	339