In February 2026, PhishDestroy detected <strong>18,204</strong> phishing domains, marking a <strong>103.8%</strong> increase from the previous month. The takedown rate was <strong>68.2%</strong>, with <strong>5,792</strong> domains still active. Notably, <strong>NICENIC INTERNATIONAL GROUP CO., LIMITED</strong> emerged as the top registrar with <strong>7,733</strong> abusive domains. Targeting shifted towards <strong>Facebook Pixel</strong> and <strong>generic crypto</strong> brands, indicating a pivot in attacker focus. The operational impact shows a need for improved registrar response times, averaging <strong>288.1</strong> hours, to enhance takedown efficiency.
- <strong>NICENIC INTERNATIONAL GROUP CO., LIMITED</strong> leads registrar abuse with <strong>7,733</strong> domains, requiring immediate attention.
- Targeting of <strong>Facebook Pixel</strong> surged to <strong>778</strong> domains, indicating a shift towards social media manipulation.
- <strong>.com</strong> remains the most weaponized TLD with <strong>6,425</strong> domains, followed by <strong>.xyz</strong> at <strong>1,309</strong>.
- The <strong>solana_drainer</strong> kit dominated with <strong>355</strong> instances, posing significant risk for cryptocurrency theft.
- Hosting infrastructure remains geographically dispersed, with no significant migration patterns observed.
- Registrar response times averaged <strong>288.1</strong> hours, highlighting a critical gap in takedown efficiency.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 8,746 |
| Cloudflare, Inc. | 6,423 |
| Tucows Domains Inc. | 1,922 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 1,484 |
| NameCheap, Inc. | 1,434 |
| Gname.com Pte. Ltd. | 1,389 |
| GoDaddy.com, LLC | 1,112 |
| Dynadot LLC | 1,006 |
Targeted Brands
| Brand | Domains |
|---|---|
| across | 1,558 |
| Crypto Casino / Gambling | 1,391 |
| coinbase | 1,121 |
| Ledger | 851 |
| ethereum | 765 |
| solana | 695 |
| Airdrop Scam | 662 |
| OKX | 521 |
Hosting Countries
Active Drainer Kits
February 2026 Domains (42,095)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.