Overview
May 262,806
Apr 2615,640
Mar 2618,819
Feb 2642,100
Jan 268,930
Dec 2511,773
Nov 2512,579
Oct 258,841
Sep 257,307
Aug 253,788
Jul 25700
Jun 254
November 2025 Intelligence Report
42.3%
12,579
8,329
Taken Down
3,835
Still Live
66.2%
Kill Rate
2741h
Avg Response
9.3
Avg VT Score
In November 2025, PhishDestroy detected 12,580 phishing domains, marking a 42.3% increase from the previous month. The takedown rate was 85.4%, with 1,842 domains still active. Notably, Crypto Scam targeting surged with 990 domains, reflecting a shift towards cryptocurrency-related phishing. The mean registrar response time remains a concern at 2189.3 hours, indicating potential delays in domain takedowns.
- DYNADOT LLC leads registrar abuse with 1,583 domains, followed by Cloudflare, Inc. and NICENIC INTERNATIONAL GROUP CO., LIMITED.
- Crypto-related brands like Coinbase (422) and Kraken (350) are primary targets, overshadowing traditional sectors.
- The .com TLD remains the most weaponized with 3,945 domains, while .io and .xyz also see significant usage.
- Angel Drainer is the most prevalent kit with 842 instances, posing risks of wallet draining and seed theft.
- The US hosts the majority of phishing infrastructure with 9,485 domains, but Germany and Sweden are emerging hotspots.
- Registrar response inefficiency persists, with a mean time of 2189.3 hours, necessitating faster action.
Outlook
Expect continued growth in crypto-targeted phishing, particularly against platforms like Coinbase and Kraken. Registrars such as DYNADOT LLC and Cloudflare, Inc. require heightened scrutiny and faster response times. Watch for increased adoption of drainer kits like Angel Drainer, which could exacerbate financial losses for victims.
Top Registrars
| Registrar | Domains |
|---|---|
| Dynadot LLC | 2,119 |
| Cloudflare, Inc. | 1,508 |
| NiceNIC International Group Co., Limited | 1,086 |
| Web Commerce Communications Limited | 862 |
| MarkMonitor, Inc. | 579 |
| Dominet (HK) Limited | 448 |
| NameCheap, Inc. | 446 |
| Gname.com Pte. Ltd. | 437 |
Hosting Countries
Active Drainer Kits
November 2025 Domains (12,579)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.