Overview
Aug 269,290
Jul 2618,430
Jun 2622,732
May 267,405
Apr 2616,732
Mar 2620,981
Feb 2640,388
Jan 268,919
Dec 2511,740
Nov 2512,563
Oct 258,835
Sep 257,297
Aug 253,782
Jul 25700
Jun 253
May 2026 Intelligence Report
55.7%
7,405
3,549
Taken Down
3,424
Still Live
47.9%
Kill Rate
349h
Avg Response
10.0
Avg VT Score
In May 2026, PhishDestroy detected 7,405 phishing domains, a 55.7% decrease from April. 3,456 of them (46.7%) have already been neutralized, while 3,534 remain live and under active escalation. The most abused registrar was GoDaddy.com, LLC with 942 malicious domains, followed by NICENIC INTERNATIONAL GROUP CO., LIMITED (711). Attackers targeted Ledger hardest, with genericcrypto a close second.
- GoDaddy.com, LLC alone accounts for 12.7% of the month's detections (942 domains) — concentration this high indicates systematic abuse, not random sign-ups.
- Brand pressure is concentrated on Ledger and genericcrypto — 822 lookalike domains between them.
- The .com TLD leads with 2,702 malicious registrations, ahead of .dev (598).
- Dominant drainer kit: Solana Drainer (30 deployments detected).
- Average infrastructure response time: 349h — well beyond any reasonable takedown window.
Outlook
Heading into June 2026, expect continued pressure on Ledger users; registrations via GoDaddy.com, LLC remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.
Top Registrars
| Registrar | Domains |
|---|---|
| GoDaddy.com, LLC | 942 |
| NICENIC INTERNATIONAL GROUP CO., LIMITED | 711 |
| Cloudflare, Inc. | 646 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 406 |
| Global Domain Group LLC | 313 |
| NameSilo, LLC | 254 |
| GitHub, Inc. | 240 |
| Dynadot Inc | 226 |
Targeted Brands
| Brand | Domains |
|---|---|
| Ledger | 467 |
| genericcrypto | 355 |
| 200 | |
| MetaMask | 182 |
| Trezor | 162 |
| microsoft | 123 |
| 122 | |
| Trust Wallet | 116 |
Hosting Countries
Active Drainer Kits
May 2026 Domains (7,405)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.