Threat Intelligence Dashboard

July 2026 Report

Detailed threat intelligence for 18,418 phishing domains. Registrar abuse, drainer kits, targeted brands, and AI-generated expert assessment.

Platform totals · all detection dates

234,151Total Detected
110,097Offline
51.3%Offline rate · classified
97.6%VT Coverage
83,421Abuse Reports

All records in the platform database, independent of the month selected below. Statuses describe the latest stored observation, not confirmed takedown attribution. Snapshot: .

How these metrics are calculated

Offline rate = offline ÷ (offline + live): 110,097 ÷ 214,672. The remaining 19,479 records have other or unknown statuses and are excluded from this rate. VT coverage uses all 234,151 detections.

Overview

July 2026 · detection cohort

Only records first detected during this month (2026-07-01 00:00:00 to 2026-08-01 00:00:00, end exclusive). Status counts use the latest stored observation. Monthly offline share divides offline records by all detections in this cohort, including other or unknown statuses.

July 2026 Intelligence Report 16%
18,418
6,940
Offline
10,426
Reachable
37.7%
Offline rate
630h
Avg Response
9.9
Avg VT Score
Daily threat detections — July 2026

In July 2026, PhishDestroy detected 18,418 phishing domains, a 16% decrease from June. 6,940 of them (37.7%) were offline at last check, while 10,519 were still reachable at their last check. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 2,275 malicious domains, followed by Fewmoretaps OU d/b/a Trustname.com (924). Attackers targeted Unknown hardest, with Google a close second.

Summary written from the data snapshot of Nov 8, 2026 03:40 UTC. Counts on the card are live and can differ slightly from this text.

  • NICENIC INTERNATIONAL GROUP CO., LIMITED alone accounts for 12.4% of the month's detections (2,275 domains) — concentration this high indicates systematic abuse, not random sign-ups.
  • Brand pressure is concentrated on Unknown and Google — 6,854 lookalike domains between them.
  • The .com TLD leads with 7,408 malicious registrations, ahead of .app (1,417).
  • Dominant drainer kit: Solana Drainer (31 deployments detected).
  • Average infrastructure response time: 630h — well beyond any reasonable takedown window.
Outlook
Heading into August 2026, expect continued pressure on Unknown users; registrations via NICENIC INTERNATIONAL GROUP CO., LIMITED remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.

July 2026 Domains (18,418)

Sorted by VirusTotal detections. Click any domain for full security report.

Screenshot of merkantalolol.asia
merkantalolol.asia
27 VTLive
Screenshot of abrmot.pro
abrmot.pro
26 VTLive
idverification-code.beer
26 VTLive
Screenshot of mekasa.pro
mekasa.pro
26 VTLive
Screenshot of r6l352kjzvgku.mocha.app
r6l352kjzvgku.mocha.app
26 VTOffline
Screenshot of allegro.102988g8g8g.pl
allegro.102988g8g8g.pl
25 VTLive
authorization-code.info
25 VTLive
Screenshot of kaloed.pro
kaloed.pro
25 VTOffline
authorization-id-code.info
24 VTOffline
Screenshot of global-accelerationr3que5f-dpojca32e2u6.edgeone.dev
global-accelerationr3que5f-dpojca32e2u6.edgeone.dev
24 VTLive
Screenshot of mail.cosmxx.rumahsakit.de
mail.cosmxx.rumahsakit.de
24 VTOffline
Screenshot of palchknosp.com
palchknosp.com
24 VTOffline
Screenshot of phemayameltahub.site
phemayameltahub.site
24 VTOffline
Screenshot of portal-liv-e-ap-p-ledger.typedream.app
portal-liv-e-ap-p-ledger.typedream.app
24 VTOffline
Screenshot of ruteforing.speed.bioignites.org
ruteforing.speed.bioignites.org
24 VTOffline
Screenshot of secure-static-page--aldvid.replit.app
secure-static-page--aldvid.replit.app
24 VTLive
Screenshot of separate-apricot-hbdffwuz.edgeone.dev
separate-apricot-hbdffwuz.edgeone.dev
24 VTLive
Screenshot of yourmailaccount.edgeone.dev
yourmailaccount.edgeone.dev
24 VTLive
Screenshot of 5391009619.dojiner.at
5391009619.dojiner.at
23 VTOffline
Screenshot of 649715-coinbase.com
649715-coinbase.com
23 VTLive
Screenshot of 9y2awj2l.wsamoeesth.wefronetma4ms.ink
9y2awj2l.wsamoeesth.wefronetma4ms.ink
23 VTOffline
Screenshot of amazon-ae-relay.apps.prov.cx
amazon-ae-relay.apps.prov.cx
23 VTLive
Screenshot of atendimento.netempresa-bia.app
atendimento.netempresa-bia.app
23 VTOffline
Screenshot of crosshair-x.com
crosshair-x.com
23 VTLive
Screenshot of docusign.ostiumterms.com
docusign.ostiumterms.com
23 VTOffline
Screenshot of facebookloginpage1.blogspot.com
facebookloginpage1.blogspot.com
23 VTLive
Screenshot of gouvn.me
gouvn.me
23 VTLive
Screenshot of iokjhg-dppo92ix1vbb.edgeone.dev
iokjhg-dppo92ix1vbb.edgeone.dev
23 VTLive
Screenshot of mailupdate.edgeone.dev
mailupdate.edgeone.dev
23 VTLive
Screenshot of metamask-download.com
metamask-download.com
23 VTLive
Screenshot of oeruexta.com
oeruexta.com
23 VTOffline
Screenshot of pago-online.sbs
pago-online.sbs
23 VTOffline
prime-video.app
23 VTOffline
Screenshot of productionmaza.bond
productionmaza.bond
23 VTOffline
psychological-jade-hbaygccq.edgeone.dev
23 VTLive
Screenshot of secure-index-edit--mlcrawford.replit.app
secure-index-edit--mlcrawford.replit.app
23 VTLive
Screenshot of secure-page-builder--nidala77.replit.app
secure-page-builder--nidala77.replit.app
23 VTLive
Screenshot of secure-page-builder--scsantiques.replit.app
secure-page-builder--scsantiques.replit.app
23 VTLive
Screenshot of spotify-accounts-login.callora.cz
spotify-accounts-login.callora.cz
23 VTLive
Screenshot of stats-coinbase.com
stats-coinbase.com
23 VTOffline
Screenshot of verificar-netflix-suscription.com
verificar-netflix-suscription.com
23 VTOffline
Screenshot of wsamoeesth.wefronetma4ms.ink
wsamoeesth.wefronetma4ms.ink
23 VTOffline
Screenshot of xn--registre-societes-franaise-dkc.fr
xn--registre-societes-franaise-dkc.fr
23 VTOffline
009090334mn.vercel.app
22 VTOffline
a01l1-a01lw3bma1l.wasmer.app
22 VTLive
Screenshot of admirable-sunburst-809404.netlify.app
admirable-sunburst-809404.netlify.app
22 VTOffline
Screenshot of arvax.xyz
arvax.xyz
22 VTLive
Screenshot of authorization-code.beer
authorization-code.beer
22 VTLive
Screenshot of authorization-press-enter.info
authorization-press-enter.info
22 VTLive
Screenshot of awsforensicl3ns-west1apprunner-dprd03feve9j.edgeone.dev
awsforensicl3ns-west1apprunner-dprd03feve9j.edgeone.dev
22 VTLive
Screenshot of balafohoaxee.com
balafohoaxee.com
22 VTLive
Screenshot of begin-ledger-support.typedream.app
begin-ledger-support.typedream.app
22 VTOffline
Screenshot of brakerhotdog.com
brakerhotdog.com
22 VTLive
Screenshot of bve-jkivf.wasmer.app
bve-jkivf.wasmer.app
22 VTOffline
Screenshot of chat-whatsapp-dpq6287j4fei.edgeone.dev
chat-whatsapp-dpq6287j4fei.edgeone.dev
22 VTLive
Screenshot of cosmxx.rumahsakit.de
cosmxx.rumahsakit.de
22 VTOffline
Screenshot of crystaldiskmark.cc
crystaldiskmark.cc
22 VTOffline
Screenshot of crystaldiskmark.io
crystaldiskmark.io
22 VTOffline
Screenshot of cupolatricol.duckdns.org
cupolatricol.duckdns.org
22 VTLive
Screenshot of docs--login--ledger-live-desktop-io.typedream.app
docs--login--ledger-live-desktop-io.typedream.app
22 VTOffline
1 2 3 4 ... Next »

Detection Trends

Monthly domain volume, offline rate, and live threats over time.

Monthly Detected Domains

Offline rate %

Data table: detected domains and offline rate per month
MonthDetected domainsOffline rate
Jun 253100%
Jul 2569377.9%
Aug 253,76269.4%
Sep 257,25368.4%
Oct 258,79358.1%
Nov 2512,48266.8%
Dec 2511,64657.2%
Jan 268,89463.7%
Feb 2639,92761.1%
Mar 2620,93549.8%
Apr 2616,68848.6%
May 267,38749.5%
Jun 2621,92940.8%
Jul 2618,41837.7%
Aug 2617,48840.8%
Sep 2614,86930.6%
Oct 2619,5159.1%
Nov 263,2642.8%

Explore More

Related intelligence pages and data feeds.