Overview
Aug 2613,813
Jul 2618,442
Jun 2622,731
May 267,405
Apr 2616,730
Mar 2620,981
Feb 2640,385
Jan 268,919
Dec 2511,740
Nov 2512,563
Oct 258,835
Sep 257,297
Aug 253,782
Jul 25700
Jun 253
August 2026 Intelligence Report
25.1%
13,813
1,940
Taken Down
11,415
Still Live
14%
Kill Rate
53h
Avg Response
8.6
Avg VT Score
So far in August 2026 (month in progress), PhishDestroy detected 13,335 phishing domains. 1,773 of them (13.3%) have already been neutralized, while 11,164 remain live and under active escalation. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 1,194 malicious domains, followed by Cloudflare Pages (787). Attackers targeted MetaMask hardest, with across a close second.
- NICENIC INTERNATIONAL GROUP CO., LIMITED alone accounts for 9% of the month's detections (1,194 domains) — concentration this high indicates systematic abuse, not random sign-ups.
- Brand pressure is concentrated on MetaMask and across — 1,231 lookalike domains between them.
- The .com TLD leads with 4,794 malicious registrations, ahead of .app (1,900).
- Dominant drainer kit: Solana Drainer (69 deployments detected).
- Average infrastructure response time: 52h.
Outlook
Heading into September 2026, expect continued pressure on MetaMask users; registrations via NICENIC INTERNATIONAL GROUP CO., LIMITED remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.
Top Registrars
| Registrar | Domains |
|---|---|
| NICENIC INTERNATIONAL GROUP CO., LIMITED | 1,326 |
| Cloudflare Pages | 788 |
| Fewmoretaps OU d/b/a Trustname.com | 707 |
| Vercel | 704 |
| Netlify | 688 |
| GoDaddy.com, LLC | 624 |
| Dynadot Inc | 564 |
| NameSilo, LLC | 421 |
Hosting Countries
Active Drainer Kits
August 2026 Domains (13,813)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.