Overview
Aug 269,411
Jul 2618,430
Jun 2622,732
May 267,405
Apr 2616,732
Mar 2620,981
Feb 2640,388
Jan 268,919
Dec 2511,740
Nov 2512,563
Oct 258,835
Sep 257,297
Aug 253,782
Jul 25700
Jun 253
December 2025 Intelligence Report
6.6%
11,740
6,050
Taken Down
4,929
Still Live
51.5%
Kill Rate
2468h
Avg Response
10.1
Avg VT Score
In December 2025, PhishDestroy detected 11,740 phishing domains, a 6.6% decrease from November. 6,077 of them (51.8%) have already been neutralized, while 4,875 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 1,283 malicious domains, followed by Cloudflare, Inc. (1,145). Attackers targeted coinbase hardest, with genericcrypto a close second.
- NiceNIC International Group Co., Limited alone accounts for 10.9% of the month's detections (1,283 domains) — concentration this high indicates systematic abuse, not random sign-ups.
- Brand pressure is concentrated on coinbase and genericcrypto — 1,595 lookalike domains between them.
- The .com TLD leads with 3,808 malicious registrations, ahead of .app (990).
- Dominant drainer kit: Angel Drainer (720 deployments detected).
- Average infrastructure response time: 2468h — well beyond any reasonable takedown window.
Outlook
Heading into January 2026, expect continued pressure on coinbase users; registrations via NiceNIC International Group Co., Limited remain the primary vector to watch, with Angel Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 1,283 |
| Cloudflare, Inc. | 1,145 |
| Dynadot LLC | 607 |
| CSC Corporate Domains, Inc. | 584 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 580 |
| Gname.com Pte. Ltd. | 527 |
| GoDaddy.com, LLC | 503 |
| Tucows Domains Inc. | 456 |
Active Drainer Kits
December 2025 Domains (11,740)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.