The most significant finding for January 2026 is a 24.1% decrease in detected phishing domains compared to the previous month, totaling 8,932 domains. Despite this reduction, 1,823 domains remain active, indicating a need for improved takedown strategies. The takedown rate stands at 79.6%, showing effectiveness but also highlighting a gap in response times, with a mean registrar response time of 782.6 hours. Notably, there is a shift towards targeting crypto-related brands, with Crypto Scam domains leading at 792 detections, suggesting a change in attacker focus and potential vulnerabilities in the crypto sector.
- NICENIC INTERNATIONAL GROUP CO., LIMITED remains the top abused registrar with 1,300 domains, indicating a persistent issue with registrar oversight.
- Crypto-related brands are increasingly targeted, with Crypto Scam and Coinbase among the top, suggesting attackers are exploiting the volatile crypto market.
- The .com TLD continues to be the most weaponized, accounting for 3,249 domains, reflecting its broad usage and trust.
- The solana_drainer kit is the most prevalent, with 213 instances, posing significant risks of wallet drains and seed theft for victims.
- The US remains the primary hosting geography with 2,024 domains, but notable activity is seen in HK and DE, indicating a geographic shift.
- Registrar response times remain high at 782.6 hours, necessitating faster action to reduce active phishing threats.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 1,303 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 954 |
| Gname.com Pte. Ltd. | 782 |
| Dynadot LLC | 453 |
| Web Commerce Communications Limited | 443 |
| NameCheap, Inc. | 429 |
| NameSilo, LLC | 427 |
| GoDaddy.com, LLC | 339 |
Active Drainer Kits
January 2026 Domains (8,931)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.