In March 2026, PhishDestroy detected <strong>6,635</strong> phishing domains, marking a <strong>63.6%</strong> decrease from the previous month. Despite this reduction, <strong>3,124</strong> domains remain active, highlighting a takedown rate of only <strong>52.6%</strong>. Attackers continue to focus on cryptocurrency platforms, with <strong>Coinbase</strong> and <strong>Exodus</strong> being the top targets. The operational impact is significant, as the takedown rate remains below the desired threshold, indicating a need for improved response times from registrars, particularly <strong>NICENIC INTERNATIONAL GROUP CO., LIMITED</strong> and <strong>Cloudflare, Inc.</strong>.
- <strong>NICENIC INTERNATIONAL GROUP CO., LIMITED</strong> is the top abused registrar with <strong>1,334</strong> domains, necessitating immediate escalation.
- Cryptocurrency platforms, especially <strong>Coinbase</strong> and <strong>Exodus</strong>, are under sustained attack, with <strong>86</strong> and <strong>72</strong> domains respectively.
- The <strong>.com</strong> TLD remains the most weaponized with <strong>2,369</strong> domains, followed by <strong>.dev</strong> and <strong>.app</strong>.
- The <strong>Solana Drainer</strong> kit is prevalent, used in <strong>105</strong> instances, posing a significant threat of wallet drains for victims.
- Peak detection days were <strong>March 2nd</strong> and <strong>March 5th</strong>, indicating concentrated phishing campaigns.
- Mean registrar response time is <strong>47.3 hours</strong>, suggesting room for improvement in takedown efficiency.
Top Registrars
| Registrar | Domains |
|---|---|
| CloudFlare, Inc. | 4,008 |
| NICENIC INTERNATIONAL GROUP CO., LIMITED | 3,476 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 863 |
| Dynadot LLC | 670 |
| GoDaddy.com, LLC | 668 |
| Gname.com Pte. Ltd. | 666 |
| NameSilo, LLC | 575 |
| Ultahost, Inc. | 483 |
Hosting Countries
Active Drainer Kits
March 2026 Domains (18,814)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.