August 2025 saw a dramatic surge in phishing domains with <strong>3,788</strong> detected, marking a <strong>441.1%</strong> increase from the previous month. The takedown rate stood at <strong>67.6%</strong>, indicating significant operational success, though the mean registrar response time remains critically high at <strong>4426.9</strong> hours. Notably, <strong>Kraken</strong> and <strong>Ledger</strong> were heavily targeted, reflecting a strategic focus on cryptocurrency brands. The prevalence of the <strong>Angel Drainer</strong> kit, implicated in <strong>220</strong> cases, underscores a persistent threat of wallet draining for victims.
- <strong>N/A</strong> remains the top abuse registrar with <strong>458</strong> domains, followed by <strong>NameSilo, LLC</strong> with <strong>224</strong> domains.
- Targeting of <strong>Kraken</strong> and <strong>Ledger</strong> suggests a continued emphasis on cryptocurrency rather than traditional banking.
- The <strong>.com</strong> TLD was the most weaponized with <strong>1,828</strong> instances, dwarfing other TLDs like <strong>.xyz</strong> and <strong>.life</strong>.
- The <strong>Angel Drainer</strong> kit led the pack, posing a significant risk of wallet draining for cryptocurrency users.
- The majority of phishing infrastructure is hosted in the <strong>US</strong> with <strong>2,524</strong> domains, indicating a concentration that defenders should prioritize.
- Despite a takedown rate of <strong>67.6%</strong>, the mean registrar response time of <strong>4426.9</strong> hours highlights a critical delay in mitigation efforts.
Top Registrars
| Registrar | Domains |
|---|---|
| Web Commerce Communications Limited | 277 |
| NameSilo, LLC | 246 |
| NiceNIC International Group Co., Limited | 204 |
| Dynadot LLC | 189 |
| NameCheap, Inc. | 183 |
| OwnRegistrar, Inc. | 168 |
| URL Solutions, Inc. | 159 |
| Cosmotown, Inc. | 151 |
Active Drainer Kits
August 2025 Domains (3,788)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.