Overview
May 261,978
Apr 2615,640
Mar 2618,821
Feb 2642,102
Jan 268,930
Dec 2511,773
Nov 2512,579
Oct 258,841
Sep 257,307
Aug 253,788
Jul 25700
Jun 254
July 2025 Intelligence Report
17400%
700
297
Taken Down
385
Still Live
42.4%
Kill Rate
5625h
Avg Response
4.3
Avg VT Score
In July 2025, PhishDestroy detected 700 phishing domains, marking a 17400.0% increase from the previous month, with a takedown rate of 85.1%. Notably, Angel Drainer kits were identified on 183 domains, posing significant risks of wallet drains and seed theft. The mean registrar response time was a concerning 4981.9 hours, highlighting gaps in takedown efficiency. Despite the high volume, our operational impact remains strong with a substantial number of domains taken offline, though registrar responsiveness needs improvement.
- NameSilo, LLC and PDR Ltd. lead in registrar abuse with 75 and 71 domains respectively, indicating a need for targeted mitigation.
- Crypto brands remain prime targets with Generic Crypto and SushiSwap being the most attacked, suggesting a persistent focus on digital asset theft.
- The .com TLD is the most weaponized with 304 domains, followed by .xyz with 84, indicating a preference for these TLDs in phishing campaigns.
- The dominance of Angel Drainer kits across 183 domains suggests a prevalent threat of wallet drains and seed theft.
- The US hosts the majority of phishing infrastructure with 561 domains, indicating a concentration of malicious activities in this region.
- The mean detection-to-takedown time remains high at 4981.9 hours, necessitating faster registrar responses to reduce active phishing threats.
Outlook
Given the surge in phishing domains and the focus on crypto brands, defenders should prioritize monitoring for Angel Drainer kits and .com TLDs. Registrars like NameSilo, LLC and PDR Ltd. require escalation to enhance response times. Expect continued targeting of crypto sectors, necessitating heightened vigilance and rapid takedown actions.
Top Registrars
Active Drainer Kits
July 2025 Domains (700)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.