Platform totals · all detection dates
All records in the platform database, independent of the month selected below. Statuses describe the latest stored observation, not confirmed takedown attribution. Snapshot: .
How these metrics are calculated
Offline rate = offline ÷ (offline + live): 110,097 ÷ 214,672. The remaining 19,479 records have other or unknown statuses and are excluded from this rate. VT coverage uses all 234,151 detections.
September 2026 · detection cohort
Only records first detected during this month (2026-09-01 00:00:00 to 2026-10-01 00:00:00, end exclusive). Status counts use the latest stored observation. Monthly offline share divides offline records by all detections in this cohort, including other or unknown statuses.
In September 2026, PhishDestroy detected 14,869 phishing domains, a 15% decrease from August. 4,554 of them (30.6%) were offline at last check, while 9,850 were still reachable at their last check. The most abused registrar was Dynadot Inc with 1,196 malicious domains, followed by Dynadot Inc. (1,174). Attackers targeted Unknown hardest, with MetaMask a close second.
Summary written from the data snapshot of Nov 8, 2026 03:40 UTC. Counts on the card are live and can differ slightly from this text.
- Dynadot Inc alone accounts for 8% of the month's detections (1,196 domains) — concentration this high indicates systematic abuse, not random sign-ups.
- Brand pressure is concentrated on Unknown and MetaMask — 4,275 lookalike domains between them.
- The .com TLD leads with 5,180 malicious registrations, ahead of .shop (1,712).
- Dominant drainer kit: Solana Drainer (49 deployments detected).
- Average infrastructure response time: 275h — well beyond any reasonable takedown window.
Top Registrars
| Registrar | Domains |
|---|---|
| Dynadot Inc | 1,196 |
| Dynadot Inc. | 1,174 |
| NICENIC INTERNATIONAL GROUP CO., LIMITED | 1,045 |
| Spaceship, Inc. | 554 |
| Global Domain Group LLC | 544 |
| Cloudflare Pages | 542 |
| NAMECHEAP INC | 502 |
| GoDaddy.com, LLC | 422 |
Targeted Brands
| Brand | Domains |
|---|---|
| Unknown | 3,229 |
| MetaMask | 1,046 |
| 844 | |
| Ledger | 428 |
| Cloudflare | 237 |
| ethereum | 223 |
| Investment Scam | 212 |
| PayPal | 209 |
Hosting Countries
Active Drainer Kits
September 2026 Domains (14,869)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, offline rate, and live threats over time.
Monthly Detected Domains
Offline rate %
Data table: detected domains and offline rate per month
| Month | Detected domains | Offline rate |
|---|---|---|
| Jun 25 | 3 | 100% |
| Jul 25 | 693 | 77.9% |
| Aug 25 | 3,762 | 69.4% |
| Sep 25 | 7,253 | 68.4% |
| Oct 25 | 8,793 | 58.1% |
| Nov 25 | 12,482 | 66.8% |
| Dec 25 | 11,646 | 57.2% |
| Jan 26 | 8,894 | 63.7% |
| Feb 26 | 39,927 | 61.1% |
| Mar 26 | 20,935 | 49.8% |
| Apr 26 | 16,688 | 48.6% |
| May 26 | 7,387 | 49.5% |
| Jun 26 | 21,929 | 40.8% |
| Jul 26 | 18,418 | 37.7% |
| Aug 26 | 17,488 | 40.8% |
| Sep 26 | 14,869 | 30.6% |
| Oct 26 | 19,515 | 9.1% |
| Nov 26 | 3,264 | 2.8% |
Explore More
Related intelligence pages and data feeds.