Overview
Mar 269,496
Feb 2618,204
Jan 268,931
Dec 2511,773
Nov 2512,579
Oct 258,841
Sep 257,307
Aug 253,788
Jul 25700
Jun 254
February 2026 Intelligence Report
103.8%
18,204
17,721
Taken Down
483
Still Live
97.3%
Kill Rate
452h
Avg Response
6.7
Avg VT Score
In February 2026, PhishDestroy detected 18,204 phishing domains, marking a 103.8% increase from the previous month. The takedown rate was 68.2%, with 5,792 domains still active. Notably, NICENIC INTERNATIONAL GROUP CO., LIMITED emerged as the top registrar with 7,733 abusive domains. Targeting shifted towards Facebook Pixel and generic crypto brands, indicating a pivot in attacker focus. The operational impact shows a need for improved registrar response times, averaging 288.1 hours, to enhance takedown efficiency.
- NICENIC INTERNATIONAL GROUP CO., LIMITED leads registrar abuse with 7,733 domains, requiring immediate attention.
- Targeting of Facebook Pixel surged to 778 domains, indicating a shift towards social media manipulation.
- .com remains the most weaponized TLD with 6,425 domains, followed by .xyz at 1,309.
- The solana_drainer kit dominated with 355 instances, posing significant risk for cryptocurrency theft.
- Hosting infrastructure remains geographically dispersed, with no significant migration patterns observed.
- Registrar response times averaged 288.1 hours, highlighting a critical gap in takedown efficiency.
Outlook
Expect continued focus on social media and cryptocurrency brands in March 2026, with potential increases in Facebook Pixel and crypto-related phishing. Defenders should prioritize monitoring NICENIC INTERNATIONAL GROUP CO., LIMITED and improving takedown response times. Registrars like PDR Ltd. and Cloudflare, Inc. need escalation to enhance their abuse handling processes.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 7,734 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 867 |
| NameCheap, Inc. | 839 |
| Cloudflare, Inc. | 799 |
| Global Domain Group LLC | 762 |
| GoDaddy.com, LLC | 720 |
| Gname.com Pte. Ltd. | 637 |
| Dynadot LLC | 579 |
Active Drainer Kits
February 2026 Domains (18,204)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.