Overview
May 264,263
Apr 2615,638
Mar 2618,818
Feb 2642,098
Jan 268,930
Dec 2511,773
Nov 2512,579
Oct 258,841
Sep 257,307
Aug 253,788
Jul 25700
Jun 254
February 2026 Intelligence Report
371.4%
42,098
35,795
Taken Down
4,068
Still Live
85%
Kill Rate
822h
Avg Response
7.3
Avg VT Score
In February 2026, PhishDestroy detected 18,204 phishing domains, marking a 103.8% increase from the previous month. The takedown rate was 68.2%, with 5,792 domains still active. Notably, NICENIC INTERNATIONAL GROUP CO., LIMITED emerged as the top registrar with 7,733 abusive domains. Targeting shifted towards Facebook Pixel and generic crypto brands, indicating a pivot in attacker focus. The operational impact shows a need for improved registrar response times, averaging 288.1 hours, to enhance takedown efficiency.
- NICENIC INTERNATIONAL GROUP CO., LIMITED leads registrar abuse with 7,733 domains, requiring immediate attention.
- Targeting of Facebook Pixel surged to 778 domains, indicating a shift towards social media manipulation.
- .com remains the most weaponized TLD with 6,425 domains, followed by .xyz at 1,309.
- The solana_drainer kit dominated with 355 instances, posing significant risk for cryptocurrency theft.
- Hosting infrastructure remains geographically dispersed, with no significant migration patterns observed.
- Registrar response times averaged 288.1 hours, highlighting a critical gap in takedown efficiency.
Outlook
Expect continued focus on social media and cryptocurrency brands in March 2026, with potential increases in Facebook Pixel and crypto-related phishing. Defenders should prioritize monitoring NICENIC INTERNATIONAL GROUP CO., LIMITED and improving takedown response times. Registrars like PDR Ltd. and Cloudflare, Inc. need escalation to enhance their abuse handling processes.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 8,745 |
| Cloudflare, Inc. | 6,423 |
| Tucows Domains Inc. | 1,918 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 1,484 |
| NameCheap, Inc. | 1,429 |
| Gname.com Pte. Ltd. | 1,379 |
| GoDaddy.com, LLC | 1,112 |
| Dynadot LLC | 1,005 |
Targeted Brands
| Brand | Domains |
|---|---|
| across | 1,558 |
| Crypto Casino / Gambling | 1,391 |
| Coinbase | 1,121 |
| Ledger | 851 |
| ethereum | 765 |
| Solana | 695 |
| Airdrop Scam | 662 |
| OKX | 521 |
Hosting Countries
Active Drainer Kits
February 2026 Domains (42,098)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.