In September 2025, PhishDestroy detected <strong>7,307</strong> phishing domains, marking a <strong>92.9%</strong> increase from the previous month, with a significant surge in activity on September 20th. The operational impact was notable with a takedown rate of <strong>82.2%</strong>, although the mean registrar response time remained high at <strong>3,828.5</strong> hours. Attackers continued to focus on the crypto sector, with <strong>Generic Crypto</strong> and <strong>SushiSwap</strong> as top targets, indicating a shift in targeting tactics. The dominance of the <strong>Angel Drainer</strong> kit suggests a persistent threat of wallet draining and seed theft for victims.
- <strong>N/A</strong> leads in registrar abuse with <strong>819</strong> domains, followed closely by <strong>NICENIC INTERNATIONAL GROUP CO., LIMITED</strong> with <strong>721</strong> domains.
- Crypto brands like <strong>Generic Crypto</strong> and <strong>SushiSwap</strong> were heavily targeted, overshadowing traditional sectors like banking.
- The <strong>.com</strong> TLD remains the most weaponized with <strong>2,561</strong> domains, while <strong>.xyz</strong> and <strong>.live</strong> show growing abuse.
- The <strong>Angel Drainer</strong> kit was used in <strong>1,120</strong> incidents, indicating a focus on wallet draining and seed theft.
- The US hosts the majority of phishing infrastructure with <strong>5,931</strong> domains, but there is notable activity in <strong>Germany</strong> and <strong>Netherlands</strong>.
- Detection-to-takedown efficiency remains challenged with a mean response time of <strong>3,828.5</strong> hours, necessitating faster registrar actions.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 774 |
| Web Commerce Communications Limited | 677 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 595 |
| Dynadot LLC | 549 |
| NameSilo, LLC | 512 |
| OwnRegistrar, Inc. | 365 |
| NameCheap, Inc. | 362 |
| Cloudflare, Inc. | 325 |
Active Drainer Kits
September 2025 Domains (7,306)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.