In October 2025, PhishDestroy detected <strong>8,841</strong> phishing domains, marking a <strong>21.0%</strong> increase from the previous month. Notably, <strong>NICENIC INTERNATIONAL GROUP CO., LIMITED</strong> emerged as the top abuse registrar with <strong>1,206</strong> domains, indicating a potential shift in attacker preferences for domain registration. The targeting of <strong>Generic Crypto</strong> brands remains prevalent, with <strong>669</strong> domains detected, while <strong>Angel Drainer</strong> kits were the most used, affecting victims through wallet drains. Despite an <strong>85.7%</strong> takedown rate, the mean registrar response time of <strong>2803.0</strong> hours highlights a critical gap in rapid domain deactivation.
- <strong>NICENIC INTERNATIONAL GROUP CO., LIMITED</strong> leads registrar abuse with <strong>1,206</strong> domains, necessitating immediate escalation.
- Crypto-related brands, especially <strong>Generic Crypto</strong>, are heavily targeted with <strong>669</strong> domains, overshadowing banking and social sectors.
- The <strong>.com</strong> TLD remains the most weaponized with <strong>3,256</strong> domains, followed by <strong>.xyz</strong> and <strong>.app</strong>.
- <strong>Angel Drainer</strong> kits dominate with <strong>1,122</strong> instances, posing significant risks of wallet drain for victims.
- US-based hosting is overwhelmingly preferred, with <strong>6,383</strong> domains, indicating a need for increased collaboration with US-based providers.
- The mean registrar response time of <strong>2803.0</strong> hours suggests inefficiencies in detection-to-takedown processes.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 1,206 |
| Cloudflare, Inc. | 828 |
| Dynadot LLC | 784 |
| Web Commerce Communications Limited | 696 |
| NameSilo, LLC | 419 |
| Gname.com Pte. Ltd. | 394 |
| NameCheap, Inc. | 335 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 318 |
Active Drainer Kits
October 2025 Domains (8,841)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.