Threat Intelligence Dashboard

June 2026 Report

Detailed threat intelligence for 21,929 phishing domains. Registrar abuse, drainer kits, targeted brands, and AI-generated expert assessment.

Platform totals · all detection dates

234,151Total Detected
110,097Offline
51.3%Offline rate · classified
97.6%VT Coverage
83,421Abuse Reports

All records in the platform database, independent of the month selected below. Statuses describe the latest stored observation, not confirmed takedown attribution. Snapshot: .

How these metrics are calculated

Offline rate = offline ÷ (offline + live): 110,097 ÷ 214,672. The remaining 19,479 records have other or unknown statuses and are excluded from this rate. VT coverage uses all 234,151 detections.

Overview

June 2026 · detection cohort

Only records first detected during this month (2026-06-01 00:00:00 to 2026-07-01 00:00:00, end exclusive). Status counts use the latest stored observation. Monthly offline share divides offline records by all detections in this cohort, including other or unknown statuses.

June 2026 Intelligence Report 196.9%
21,929
8,945
Offline
11,438
Reachable
40.8%
Offline rate
713h
Avg Response
9.9
Avg VT Score
Daily threat detections — June 2026

In June 2026, PhishDestroy detected 21,929 phishing domains, a 196.9% increase from May. 8,944 of them (40.8%) were offline at last check, while 11,574 were still reachable at their last check. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 3,523 malicious domains, followed by Wix Studio (1,112). Attackers targeted Unknown hardest, with Trezor a close second.

Summary written from the data snapshot of Nov 8, 2026 03:40 UTC. Counts on the card are live and can differ slightly from this text.

  • NICENIC INTERNATIONAL GROUP CO., LIMITED alone accounts for 16.1% of the month's detections (3,523 domains) — concentration this high indicates systematic abuse, not random sign-ups.
  • Brand pressure is concentrated on Unknown and Trezor — 7,321 lookalike domains between them.
  • The .com TLD leads with 7,368 malicious registrations, ahead of .app (1,663).
  • Dominant drainer kit: Solana Drainer (93 deployments detected).
  • Average infrastructure response time: 713h — well beyond any reasonable takedown window.
Outlook
Heading into July 2026, expect continued pressure on Unknown users; registrations via NICENIC INTERNATIONAL GROUP CO., LIMITED remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.

June 2026 Domains (21,929)

Sorted by VirusTotal detections. Click any domain for full security report.

Screenshot of marketbuffalo.click
marketbuffalo.click
26 VTOffline
Screenshot of aicopmtrade.click
aicopmtrade.click
25 VTOffline
Screenshot of drk-whatsapp.hk.cn
drk-whatsapp.hk.cn
25 VTOffline
Screenshot of fraud-claims-esl-org.sbs
fraud-claims-esl-org.sbs
25 VTOffline
Screenshot of hcxr-42552.wasmer.app
hcxr-42552.wasmer.app
25 VTOffline
Screenshot of paypal.authia-rule.xyz
paypal.authia-rule.xyz
25 VTOffline
Screenshot of photo-26654.cfd
photo-26654.cfd
25 VTOffline
Screenshot of secure-page-editor--schoolfeesinabu.replit.app
secure-page-editor--schoolfeesinabu.replit.app
25 VTLive
Screenshot of t-mobile.ndilcz.top
t-mobile.ndilcz.top
25 VTOffline
Screenshot of t-mobile.rmlcws.top
t-mobile.rmlcws.top
25 VTOffline
Screenshot of temu.xyscsz.vip
temu.xyscsz.vip
25 VTOffline
Screenshot of aujhmv.com
aujhmv.com
24 VTOffline
Screenshot of datacompliancereview.com
datacompliancereview.com
24 VTOffline
Screenshot of diesnt-p.com
diesnt-p.com
24 VTOffline
Screenshot of fraud-claims-esl.xyz
fraud-claims-esl.xyz
24 VTOffline
Screenshot of gastric-rose-hwpw4awz.edgeone.dev
gastric-rose-hwpw4awz.edgeone.dev
24 VTLive
instagram-reset-password.vercel.app
24 VTOffline
Screenshot of mediasync.cv
mediasync.cv
24 VTOffline
Screenshot of mergec.mntbell.com
mergec.mntbell.com
24 VTOffline
netflix-clone-by-mayur.vercel.app
24 VTOffline
Screenshot of netflix-clone-five-iota.vercel.app
netflix-clone-five-iota.vercel.app
24 VTOffline
Screenshot of netflix-clone-taupe-two.vercel.app
netflix-clone-taupe-two.vercel.app
24 VTOffline
Screenshot of nvidiadriver.net
nvidiadriver.net
24 VTLive
Screenshot of paylink-paypal.com
paylink-paypal.com
24 VTOffline
Screenshot of payme-paypal.com
payme-paypal.com
24 VTOffline
Screenshot of policycompliancereview.com
policycompliancereview.com
24 VTOffline
Screenshot of t-mobile.eblgrq.top
t-mobile.eblgrq.top
24 VTOffline
Screenshot of t-mobile.gaiqbf.top
t-mobile.gaiqbf.top
24 VTOffline
Screenshot of t-mobile.gyftxi.top
t-mobile.gyftxi.top
24 VTOffline
Screenshot of t-mobile.hpwnqk.top
t-mobile.hpwnqk.top
24 VTOffline
Screenshot of t-mobile.oktdfz.top
t-mobile.oktdfz.top
24 VTOffline
Screenshot of t-mobile.pkwnyz.top
t-mobile.pkwnyz.top
24 VTOffline
Screenshot of vgsgu2.top
vgsgu2.top
24 VTOffline
Screenshot of 17206.xyz
17206.xyz
23 VTOffline
Screenshot of att-resetaccount.netlify.app
att-resetaccount.netlify.app
23 VTLive
Screenshot of auspost.customerserviceqd.com
auspost.customerserviceqd.com
23 VTOffline
auspost.customerserviceqh.com
23 VTOffline
authsusngwd0c34748dhbdr673hndy73if5revssharepoint.cscllccmo.com
23 VTOffline
Screenshot of bitcompliancereview.com
bitcompliancereview.com
23 VTOffline
Screenshot of bokbll.shop
bokbll.shop
23 VTOffline
Screenshot of caring-kangaroo-307519.framer.app
caring-kangaroo-307519.framer.app
23 VTOffline
Screenshot of cathoaixarles.fr
cathoaixarles.fr
23 VTOffline
Screenshot of cs4money.com
cs4money.com
23 VT
Screenshot of cwrtwright.com
cwrtwright.com
23 VTLive
Screenshot of dienst-k.com
dienst-k.com
23 VTOffline
Screenshot of extra-cyan-zfxl6ma9.edgeone.app
extra-cyan-zfxl6ma9.edgeone.app
23 VTLive
facebook-login-clone-nine.vercel.app
23 VTOffline
Screenshot of fortap.top
fortap.top
23 VTOffline
Screenshot of hyperliquid-solana.xyz
hyperliquid-solana.xyz
23 VTLiveSolana Drainer
Screenshot of many-tables-304491.framer.app
many-tables-304491.framer.app
23 VTOffline
Screenshot of meta-meta.xyz
meta-meta.xyz
23 VT
Screenshot of metamaskverifyweb3.com
metamaskverifyweb3.com
23 VTLive
Screenshot of netflix-gpt-fawn.vercel.app
netflix-gpt-fawn.vercel.app
23 VTOfflineWallet Connect Abuse
Screenshot of netflix-red-nine.vercel.app
netflix-red-nine.vercel.app
23 VTOffline
productionmaza.cfd
23 VTOffline
Screenshot of reative-sua-assinatura.fun
reative-sua-assinatura.fun
23 VTOffline
Screenshot of register.invoice-partner.info
register.invoice-partner.info
23 VTOffline
Screenshot of secure-page-builder--sabusnana.replit.app
secure-page-builder--sabusnana.replit.app
23 VTLive
Screenshot of secure-static-site--maddykennard.replit.app
secure-static-site--maddykennard.replit.app
23 VTLive
Screenshot of security-indexer--adamlee160686.replit.app
security-indexer--adamlee160686.replit.app
23 VTLive
1 2 3 4 ... Next »

Detection Trends

Monthly domain volume, offline rate, and live threats over time.

Monthly Detected Domains

Offline rate %

Data table: detected domains and offline rate per month
MonthDetected domainsOffline rate
Jun 253100%
Jul 2569377.9%
Aug 253,76269.4%
Sep 257,25368.4%
Oct 258,79358.1%
Nov 2512,48266.8%
Dec 2511,64657.2%
Jan 268,89463.7%
Feb 2639,92761.1%
Mar 2620,93549.8%
Apr 2616,68848.6%
May 267,38749.5%
Jun 2621,92940.8%
Jul 2618,41837.7%
Aug 2617,48840.8%
Sep 2614,86930.6%
Oct 2619,5159.1%
Nov 263,2642.8%

Explore More

Related intelligence pages and data feeds.