Overview
Aug 2614,743
Jul 2618,443
Jun 2622,726
May 267,404
Apr 2616,729
Mar 2620,981
Feb 2640,384
Jan 268,919
Dec 2511,740
Nov 2512,562
Oct 258,835
Sep 257,297
Aug 253,782
Jul 25700
Jun 253
June 2026 Intelligence Report
206.9%
22,726
8,638
Taken Down
12,848
Still Live
38%
Kill Rate
400h
Avg Response
10.3
Avg VT Score
In June 2026, PhishDestroy detected 22,726 phishing domains, a 206.9% increase from May. 8,098 of them (35.6%) have already been neutralized, while 13,670 remain live and under active escalation. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 3,580 malicious domains, followed by Wix Studio (1,112). Attackers targeted Trezor hardest, with Google a close second.
- NICENIC INTERNATIONAL GROUP CO., LIMITED alone accounts for 15.8% of the month's detections (3,580 domains) — concentration this high indicates systematic abuse, not random sign-ups.
- Brand pressure is concentrated on Trezor and Google — 1,449 lookalike domains between them.
- The .com TLD leads with 7,652 malicious registrations, ahead of .app (1,675).
- Dominant drainer kit: Solana Drainer (93 deployments detected).
- Average infrastructure response time: 400h — well beyond any reasonable takedown window.
Outlook
Heading into July 2026, expect continued pressure on Trezor users; registrations via NICENIC INTERNATIONAL GROUP CO., LIMITED remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.
Top Registrars
| Registrar | Domains |
|---|---|
| NICENIC INTERNATIONAL GROUP CO., LIMITED | 3,580 |
| Wix Studio | 1,112 |
| Fewmoretaps OU d/b/a Trustname.com | 1,063 |
| Cloudflare, Inc. | 948 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 858 |
| Gname.com Pte. Ltd. | 826 |
| Dynadot Inc | 754 |
| Cloudflare Pages | 747 |
Targeted Brands
| Brand | Domains |
|---|---|
| Trezor | 846 |
| 603 | |
| Ledger | 572 |
| genericcrypto | 453 |
| MetaMask | 450 |
| cryptoscam | 379 |
| Cloudflare | 339 |
| Moonshot | 290 |
Hosting Countries
Active Drainer Kits
June 2026 Domains (22,726)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.