Threat Intelligence Dashboard

August 2025 Report

Detailed threat intelligence for 3,762 phishing domains. Registrar abuse, drainer kits, targeted brands, and AI-generated expert assessment.

Platform totals · all detection dates

234,151Total Detected
110,097Offline
51.3%Offline rate · classified
97.6%VT Coverage
83,421Abuse Reports

All records in the platform database, independent of the month selected below. Statuses describe the latest stored observation, not confirmed takedown attribution. Snapshot: .

How these metrics are calculated

Offline rate = offline ÷ (offline + live): 110,097 ÷ 214,672. The remaining 19,479 records have other or unknown statuses and are excluded from this rate. VT coverage uses all 234,151 detections.

Overview

August 2025 · detection cohort

Only records first detected during this month (2025-08-01 00:00:00 to 2025-09-01 00:00:00, end exclusive). Status counts use the latest stored observation. Monthly offline share divides offline records by all detections in this cohort, including other or unknown statuses.

August 2025 Intelligence Report 442.9%
3,762
2,611
Offline
970
Reachable
69.4%
Offline rate
5710h
Avg Response
5.6
Avg VT Score
Daily threat detections — August 2025

In August 2025, PhishDestroy detected 3,762 phishing domains, a 442.9% increase from July. 2,611 of them (69.4%) were offline at last check, while 970 were still reachable at their last check. The most abused registrar was Web Commerce Communications Limited with 276 malicious domains, followed by NameSilo, LLC (253). Attackers targeted Unknown hardest, with Ethereum a close second.

Summary written from the data snapshot of Nov 8, 2026 03:40 UTC. Counts on the card are live and can differ slightly from this text.

  • Web Commerce Communications Limited alone accounts for 7.3% of the month's detections (276 domains) — concentration this high indicates systematic abuse, not random sign-ups.
  • Brand pressure is concentrated on Unknown and Ethereum — 606 lookalike domains between them.
  • The .com TLD leads with 1,739 malicious registrations, ahead of .life (165).
  • Dominant drainer kit: Angel Drainer (207 deployments detected).
  • Average infrastructure response time: 5710h — well beyond any reasonable takedown window.
Outlook
Heading into September 2025, expect continued pressure on Unknown users; registrations via Web Commerce Communications Limited remain the primary vector to watch, with Angel Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.

August 2025 Domains (3,762)

Sorted by VirusTotal detections. Click any domain for full security report.

Screenshot of duplicate-disabled-2983.invalid
duplicate-disabled-2983.invalid
21 VTOffline
Screenshot of etherealux-ledger-tech.com
etherealux-ledger-tech.com
20 VTOffline
Screenshot of fixedfloat.ac
fixedfloat.ac
20 VT
Screenshot of login-faxplus-outlook.com
login-faxplus-outlook.com
20 VTLive
Screenshot of metamask88.com
metamask88.com
20 VTLive
Screenshot of robiox.com.ua
robiox.com.ua
20 VTOffline
steamcomunity.aiq.ru
20 VTOffline
Screenshot of wolke-ledgerix-soft.com
wolke-ledgerix-soft.com
20 VTOffline
Screenshot of chainretificator.com
chainretificator.com
19 VTOfflineWallet Connect Abuse
Screenshot of ledgerlive-assets.com
ledgerlive-assets.com
19 VTOffline
Screenshot of steamcommunitylog.chez.com
steamcommunitylog.chez.com
19 VTLive
Screenshot of uniswap-staging.org
uniswap-staging.org
19 VTLive
Screenshot of www-telegram.ing
www-telegram.ing
19 VTOffline
Screenshot of 158940-coinbase.com
158940-coinbase.com
18 VT
Screenshot of axiom-trade-platform.com
axiom-trade-platform.com
18 VTOffline
Screenshot of createvault-coinbase.com
createvault-coinbase.com
18 VT
Screenshot of duplicate-disabled-2989.invalid
duplicate-disabled-2989.invalid
18 VTOffline
Screenshot of gravitonprofitsoftware.com
gravitonprofitsoftware.com
18 VTOffline
Screenshot of luzia-coinex.ru
luzia-coinex.ru
18 VTOffline
Screenshot of mettamsukkloggoin.webflow.io
mettamsukkloggoin.webflow.io
18 VTOffline
Screenshot of muse-apple.netlify.app
muse-apple.netlify.app
18 VTLive
Screenshot of pub-8c1c14c3b0d64d0099312bb4670f2e23.r2.dev
pub-8c1c14c3b0d64d0099312bb4670f2e23.r2.dev
18 VTLive
Screenshot of pub-d69c77ba755745888f5f3bae287f77ec.r2.dev
pub-d69c77ba755745888f5f3bae287f77ec.r2.dev
18 VTLive
Screenshot of qr-apps-l.ink
qr-apps-l.ink
18 VTOffline
Screenshot of steamcomunnity.cc
steamcomunnity.cc
18 VT
Screenshot of walletverifyauth.com
walletverifyauth.com
18 VTOffline
Screenshot of amparadapp.live
amparadapp.live
17 VTOffline
Screenshot of apptrustwallet.com
apptrustwallet.com
17 VTOffline
Screenshot of axiomtrading-platform.com
axiomtrading-platform.com
17 VTLive
Screenshot of bananagun-io.com
bananagun-io.com
17 VTAngel Drainer
Screenshot of bitcoin-buyer-solution.com
bitcoin-buyer-solution.com
17 VTLive
Screenshot of cryptoasset-recovery.com
cryptoasset-recovery.com
17 VTOffline
Screenshot of duplicate-disabled-1274.invalid
duplicate-disabled-1274.invalid
17 VTOffline
Screenshot of eth-mixers.to
eth-mixers.to
17 VTOffline
Screenshot of fndedtrdplus.com
fndedtrdplus.com
17 VTOffline
Screenshot of kucoinpors.com
kucoinpors.com
17 VTOffline
Screenshot of ledger-live-secure.com
ledger-live-secure.com
17 VTOffline
Screenshot of ledgerprovisionlive.com
ledgerprovisionlive.com
17 VTOffline
Screenshot of ledgeruserprotectlive.com
ledgeruserprotectlive.com
17 VTOffline
Screenshot of ledgerusersupportlive.com
ledgerusersupportlive.com
17 VT
Screenshot of mtamsaklohgin.webflow.io
mtamsaklohgin.webflow.io
17 VTOffline
Screenshot of netflix-gpt-609e2.firebaseapp.com
netflix-gpt-609e2.firebaseapp.com
17 VTLive
Screenshot of netflixgpt-98554.web.app
netflixgpt-98554.web.app
17 VTLive
Screenshot of pub-35312b95baf4482f8dd1d6c35e6943a1.r2.dev
pub-35312b95baf4482f8dd1d6c35e6943a1.r2.dev
17 VTLive
Screenshot of pub-a77375725cbe4ebebbbb725baa062262.r2.dev
pub-a77375725cbe4ebebbbb725baa062262.r2.dev
17 VTLive
Screenshot of repair-coinbase.com
repair-coinbase.com
17 VTOffline
Screenshot of roblox.com.bo
roblox.com.bo
17 VTLive
Screenshot of swap.swissdlt.ch
swap.swissdlt.ch
17 VTLive
Screenshot of telegramdpc.com
telegramdpc.com
17 VTOffline
Screenshot of telegrameam.com
telegrameam.com
17 VTLive
Screenshot of telegrameem.com
telegrameem.com
17 VTLive
Screenshot of telegrameim.com
telegrameim.com
17 VTLive
Screenshot of telegramoom.com
telegramoom.com
17 VTOffline
Screenshot of tetheraudit-bot.com
tetheraudit-bot.com
17 VTOffline
Screenshot of tronssan.github.io
tronssan.github.io
17 VTLive
Screenshot of trustaxisbnk.com
trustaxisbnk.com
17 VTLive
Screenshot of uniswap30.vip
uniswap30.vip
17 VTOfflineWallet Connect Abuse
Screenshot of usdt-qrcode-generator.com
usdt-qrcode-generator.com
17 VTOffline
Screenshot of usdtmixer.to
usdtmixer.to
17 VTLive
Screenshot of 762359-coinbase.com
762359-coinbase.com
16 VT
1 2 3 4 ... Next »

Detection Trends

Monthly domain volume, offline rate, and live threats over time.

Monthly Detected Domains

Offline rate %

Data table: detected domains and offline rate per month
MonthDetected domainsOffline rate
Jun 253100%
Jul 2569377.9%
Aug 253,76269.4%
Sep 257,25368.4%
Oct 258,79358.1%
Nov 2512,48266.8%
Dec 2511,64657.2%
Jan 268,89463.7%
Feb 2639,92761.1%
Mar 2620,93549.8%
Apr 2616,68848.6%
May 267,38749.5%
Jun 2621,92940.8%
Jul 2618,41837.7%
Aug 2617,48840.8%
Sep 2614,86930.6%
Oct 2619,5159.1%
Nov 263,2642.8%

Explore More

Related intelligence pages and data feeds.