Overview
Sep 269
Aug 2616,643
Jul 2618,436
Jun 2622,723
May 267,401
Apr 2616,729
Mar 2620,980
Feb 2640,383
Jan 268,919
Dec 2511,740
Nov 2512,562
Oct 258,833
Sep 257,295
Aug 253,781
Jul 25700
Jun 253
February 2026 Intelligence Report
352.8%
40,383
21,018
Taken Down
14,067
Still Live
52%
Kill Rate
1275h
Avg Response
8.0
Avg VT Score
In February 2026, PhishDestroy detected 40,383 phishing domains, a 352.8% increase from January. 20,456 of them (50.7%) have already been neutralized, while 15,683 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 8,735 malicious domains, followed by Cloudflare, Inc. (6,193). Attackers targeted genericcloudflare hardest, with across a close second.
- NiceNIC International Group Co., Limited alone accounts for 21.6% of the month's detections (8,735 domains) — concentration this high indicates systematic abuse, not random sign-ups.
- Brand pressure is concentrated on genericcloudflare and across — 4,194 lookalike domains between them.
- The .com TLD leads with 12,756 malicious registrations, ahead of .dev (5,878).
- Dominant drainer kit: Solana Drainer (637 deployments detected).
- Average infrastructure response time: 1275h — well beyond any reasonable takedown window.
Outlook
Heading into March 2026, expect continued pressure on genericcloudflare users; registrations via NiceNIC International Group Co., Limited remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 8,735 |
| Cloudflare, Inc. | 6,193 |
| Tucows Domains Inc. | 1,836 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 1,477 |
| NameCheap, Inc. | 1,422 |
| Gname.com Pte. Ltd. | 1,372 |
| GoDaddy.com, LLC | 1,105 |
| Dynadot LLC | 996 |
Targeted Brands
| Brand | Domains |
|---|---|
| genericcloudflare | 2,212 |
| across | 1,982 |
| genericcrypto | 1,899 |
| coinbase | 1,202 |
| Ethereum | 900 |
| Ledger | 860 |
| solana | 696 |
| binance | 634 |
Hosting Countries
Active Drainer Kits
February 2026 Domains (40,383)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.