Threat Intelligence Dashboard

July 2025 Report

Detailed threat intelligence for 693 phishing domains. Registrar abuse, drainer kits, targeted brands, and AI-generated expert assessment.

Platform totals · all detection dates

234,151Total Detected
110,097Offline
51.3%Offline rate · classified
97.6%VT Coverage
83,421Abuse Reports

All records in the platform database, independent of the month selected below. Statuses describe the latest stored observation, not confirmed takedown attribution. Snapshot: .

How these metrics are calculated

Offline rate = offline ÷ (offline + live): 110,097 ÷ 214,672. The remaining 19,479 records have other or unknown statuses and are excluded from this rate. VT coverage uses all 234,151 detections.

Overview

July 2025 · detection cohort

Only records first detected during this month (2025-07-01 00:00:00 to 2025-08-01 00:00:00, end exclusive). Status counts use the latest stored observation. Monthly offline share divides offline records by all detections in this cohort, including other or unknown statuses.

July 2025 Intelligence Report 23000%
693
540
Offline
114
Reachable
77.9%
Offline rate
6484h
Avg Response
5.4
Avg VT Score
Daily threat detections — July 2025

In July 2025, PhishDestroy detected 693 phishing domains, a 23000% increase from June. 540 of them (77.9%) were offline at last check, while 114 were still reachable at their last check. The most abused registrar was Web Commerce Communications Limited with 84 malicious domains, followed by NameSilo, LLC (78). Attackers targeted Unknown hardest, with ethereum a close second.

Summary written from the data snapshot of Nov 8, 2026 03:40 UTC. Counts on the card are live and can differ slightly from this text.

  • Web Commerce Communications Limited alone accounts for 12.1% of the month's detections (84 domains) — concentration this high indicates systematic abuse, not random sign-ups.
  • Brand pressure is concentrated on Unknown and ethereum — 124 lookalike domains between them.
  • The .com TLD leads with 302 malicious registrations, ahead of .xyz (84).
  • Dominant drainer kit: Angel Drainer (176 deployments detected).
  • Average infrastructure response time: 6484h — well beyond any reasonable takedown window.
Outlook
Heading into August 2025, expect continued pressure on Unknown users; registrations via Web Commerce Communications Limited remain the primary vector to watch, with Angel Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.

July 2025 Domains (693)

Sorted by VirusTotal detections. Click any domain for full security report.

Screenshot of pubgzh-cn.top
pubgzh-cn.top
18 VTOffline
Screenshot of https-keepkey.com
https-keepkey.com
17 VTOffline
Screenshot of 9823712-coinbase.com
9823712-coinbase.com
16 VT
Screenshot of case-of-skins.com
case-of-skins.com
16 VTOffline
Screenshot of connectwallapp.com
connectwallapp.com
16 VTOffline
Screenshot of cryptowideweb.com
cryptowideweb.com
16 VTOfflineAngel Drainer
Screenshot of ff-exchange.art
ff-exchange.art
16 VTOffline
Screenshot of ff-info-online.com
ff-info-online.com
16 VTOffline
Screenshot of flr-portal.org
flr-portal.org
16 VTOffline
Screenshot of high-ada.com
high-ada.com
16 VTLive
Screenshot of https-dotus.com
https-dotus.com
16 VTOffline
Screenshot of nodeapp-serverlaunch.com
nodeapp-serverlaunch.com
16 VTOfflineWallet Connect Abuse
Screenshot of p2pwithpi.com
p2pwithpi.com
16 VTOffline
Screenshot of pancakeswapsfi.org
pancakeswapsfi.org
16 VTOfflineSolana Drainer
Screenshot of airdrop-debridge.live
airdrop-debridge.live
15 VTOffline
Screenshot of bitpiemi.com
bitpiemi.com
15 VTLive
Screenshot of bitpieon.com
bitpieon.com
15 VTLive
Screenshot of blockdawgclaim.live
blockdawgclaim.live
15 VTAngel Drainer
Screenshot of coinbase003.xyz
coinbase003.xyz
15 VTOffline
Screenshot of collab-shard-land.com
collab-shard-land.com
15 VTOffline
Screenshot of foundation-ethereum.com
foundation-ethereum.com
15 VT
Screenshot of okxedex.com
okxedex.com
15 VT
Screenshot of pagesvalidation.com
pagesvalidation.com
15 VTOffline
Screenshot of aletheacapro.com
aletheacapro.com
14 VTOffline
Screenshot of assetspacifics.ltd
assetspacifics.ltd
14 VTOffline
Screenshot of block-fi-disbursement-processor.com
block-fi-disbursement-processor.com
14 VTOfflineAngel Drainer
Screenshot of centricsolana-migrate.com
centricsolana-migrate.com
14 VTOfflineAngel Drainer
Screenshot of check-aml.net
check-aml.net
14 VTLiveWallet Connect Abuse
Screenshot of cssats.com
cssats.com
14 VTInferno Drainer
Screenshot of dappradarco.com
dappradarco.com
14 VTOffline
Screenshot of fenolex.com
fenolex.com
14 VTOffline
Screenshot of imtokenu.com
imtokenu.com
14 VTLive
Screenshot of inter-pinetprofile.com
inter-pinetprofile.com
14 VTOffline
Screenshot of nftminter.xyz
nftminter.xyz
14 VTOffline
Screenshot of okx-listings.com
okx-listings.com
14 VTLive
Screenshot of p2pmainnetapp.com
p2pmainnetapp.com
14 VTOffline
Screenshot of p2ppayment-livetrade.com
p2ppayment-livetrade.com
14 VTOffline
perfectminingfx.com
14 VTOffline
Screenshot of pi-marketpayment.com
pi-marketpayment.com
14 VTOffline
Screenshot of pi-xchange.com
pi-xchange.com
14 VTOffline
Screenshot of pii-con.com
pii-con.com
14 VTOffline
Screenshot of 30eth.com
30eth.com
13 VTLiveAngel Drainer
Screenshot of abhienergetic.com
abhienergetic.com
13 VTOffline
Screenshot of bithpie.com
bithpie.com
13 VTLive
Screenshot of boomcapital-investments.com
boomcapital-investments.com
13 VTOffline
Screenshot of coinassetinvest.com
coinassetinvest.com
13 VTLive
crest-cridetunion.com
13 VTOffline
Screenshot of cryptoaml.bot
cryptoaml.bot
13 VTLiveWallet Connect Abuse
Screenshot of datadapp-manualdex.xyz
datadapp-manualdex.xyz
13 VTOfflineAngel Drainer
Screenshot of decentrastake.com
decentrastake.com
13 VTOffline
Screenshot of grt-sushi.cfd
grt-sushi.cfd
13 VTOfflineAngel Drainer
Screenshot of guardawebwallet.com
guardawebwallet.com
13 VTOffline
Screenshot of hyperliquidbuy.org
hyperliquidbuy.org
13 VTOfflineAngel Drainer
Screenshot of neto-launch.com
neto-launch.com
13 VTOffline
Screenshot of noderectificationvip.com
noderectificationvip.com
13 VTOffline
Screenshot of p2p-relocke.com
p2p-relocke.com
13 VTOffline
pepe-sushi.xyz
13 VTOfflineAngel Drainer
Screenshot of pepecoiin.pro
pepecoiin.pro
13 VTOffline
Screenshot of qfsworldgloballedger.org
qfsworldgloballedger.org
13 VTLive
Screenshot of airdrop-saharaai.live
airdrop-saharaai.live
12 VTOffline
1 2 3 4 ... Next »

Detection Trends

Monthly domain volume, offline rate, and live threats over time.

Monthly Detected Domains

Offline rate %

Data table: detected domains and offline rate per month
MonthDetected domainsOffline rate
Jun 253100%
Jul 2569377.9%
Aug 253,76269.4%
Sep 257,25368.4%
Oct 258,79358.1%
Nov 2512,48266.8%
Dec 2511,64657.2%
Jan 268,89463.7%
Feb 2639,92761.1%
Mar 2620,93549.8%
Apr 2616,68848.6%
May 267,38749.5%
Jun 2621,92940.8%
Jul 2618,41837.7%
Aug 2617,48840.8%
Sep 2614,86930.6%
Oct 2619,5159.1%
Nov 263,2642.8%

Explore More

Related intelligence pages and data feeds.