Overview
Aug 2614,359
Jul 2618,442
Jun 2622,726
May 267,404
Apr 2616,729
Mar 2620,981
Feb 2640,384
Jan 268,919
Dec 2511,740
Nov 2512,562
Oct 258,835
Sep 257,297
Aug 253,782
Jul 25700
Jun 253
April 2026 Intelligence Report
20.3%
16,729
8,387
Taken Down
7,253
Still Live
50.1%
Kill Rate
739h
Avg Response
8.3
Avg VT Score
In April 2026, PhishDestroy detected 16,729 phishing domains, a 20.3% decrease from March. 8,338 of them (49.8%) have already been neutralized, while 7,366 remain live and under active escalation. The most abused registrar was Cloudflare, Inc. with 4,467 malicious domains, followed by Wix Studio (1,620). Attackers targeted Ledger hardest, with genericcrypto a close second.
- Cloudflare, Inc. alone accounts for 26.7% of the month's detections (4,467 domains) — concentration this high indicates systematic abuse, not random sign-ups.
- Brand pressure is concentrated on Ledger and genericcrypto — 3,474 lookalike domains between them.
- The .com TLD leads with 6,102 malicious registrations, ahead of .dev (4,386).
- Dominant drainer kit: Solana Drainer (122 deployments detected).
- Average infrastructure response time: 739h — well beyond any reasonable takedown window.
Outlook
Heading into May 2026, expect continued pressure on Ledger users; registrations via Cloudflare, Inc. remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.
Top Registrars
| Registrar | Domains |
|---|---|
| Cloudflare, Inc. | 4,467 |
| Wix Studio | 1,620 |
| NICENIC INTERNATIONAL GROUP CO., LIMITED | 1,333 |
| Fewmoretaps OU d/b/a Trustname.com | 1,308 |
| GitHub, Inc. | 606 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 465 |
| Dynadot Inc | 429 |
| NameSilo, LLC | 403 |
Hosting Countries
Active Drainer Kits
April 2026 Domains (16,729)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.