Overview
Jun 263,054
May 267,023
Apr 2615,635
Mar 2618,817
Feb 2642,096
Jan 268,930
Dec 2511,773
Nov 2512,578
Oct 258,841
Sep 257,306
Aug 253,788
Jul 25700
Jun 253
December 2025 Intelligence Report
6.4%
11,773
7,766
Taken Down
3,244
Still Live
66%
Kill Rate
2451h
Avg Response
10.1
Avg VT Score
In December 2025, PhishDestroy detected 11,773 phishing domains, marking a 6.4% decrease from the previous month. The takedown rate was 76.3%, with 8,978 domains neutralized. Notably, Crypto Scam targeting remains prevalent with 820 domains, while NICENIC INTERNATIONAL GROUP CO., LIMITED emerged as the top registrar for abuse cases. The operational impact shows effective takedown efforts, though the mean registrar response time of 1452.7 hours indicates room for improvement in response speed.
- NICENIC INTERNATIONAL GROUP CO., LIMITED leads registrar abuse with 1268 cases, necessitating focused intervention.
- Crypto-related brands like Coinbase and Kraken are primary targets, overshadowing traditional banking sectors.
- The .com TLD remains the most weaponized with 3816 domains, followed by .app and .dev.
- The Angel Drainer kit is the most used, posing significant threats to victims' wallets through direct fund extraction.
- The US hosts the majority of phishing infrastructure with 8798 domains, indicating a need for enhanced monitoring in this region.
- Detection-to-takedown efficiency remains robust at 76.3%, but the slow registrar response time highlights a critical gap.
Outlook
As we move into January 2026, defenders should anticipate continued targeting of crypto platforms, especially given the dominance of the Angel Drainer kit. Registrars like NICENIC INTERNATIONAL GROUP CO., LIMITED and Cloudflare, Inc. require escalation to improve response times. Watch for potential shifts in TLD usage and geographic hosting patterns.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 1,284 |
| Cloudflare, Inc. | 1,148 |
| Dynadot LLC | 607 |
| CSC Corporate Domains, Inc. | 584 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 581 |
| Gname.com Pte. Ltd. | 529 |
| GoDaddy.com, LLC | 509 |
| NameCheap, Inc. | 461 |
Active Drainer Kits
December 2025 Domains (11,773)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.