Phishing Analytics

So far in August 2026 (month in progress), PhishDestroy detected 14,246 phishing domains. 1,845 of them (13%) have already been neutralized, while 11,967 remain live and under active escalation. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 1,355 malicious domains, followed by Cloudflare Pages (790). Attackers targeted MetaMask hardest, with Cloudflare a close second.

In July 2026, PhishDestroy detected 18,442 phishing domains, a 18.9% decrease from June. 5,016 of them (27.2%) have already been neutralized, while 12,769 remain live and under active escalation. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 2,258 malicious domains, followed by Fewmoretaps OU d/b/a Trustname.com (922). Attackers targeted Google hardest, with Ledger a close second.

In June 2026, PhishDestroy detected 22,726 phishing domains, a 206.9% increase from May. 8,083 of them (35.6%) have already been neutralized, while 13,693 remain live and under active escalation. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 3,580 malicious domains, followed by Wix Studio (1,112). Attackers targeted Trezor hardest, with Google a close second.

In May 2026, PhishDestroy detected 7,404 phishing domains, a 55.7% decrease from April. 3,458 of them (46.7%) have already been neutralized, while 3,527 remain live and under active escalation. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 711 malicious domains, followed by Cloudflare, Inc. (646). Attackers targeted Ledger hardest, with genericcrypto a close second.

In April 2026, PhishDestroy detected 16,729 phishing domains, a 20.3% decrease from March. 8,338 of them (49.8%) have already been neutralized, while 7,366 remain live and under active escalation. The most abused registrar was Cloudflare, Inc. with 4,467 malicious domains, followed by Wix Studio (1,620). Attackers targeted Ledger hardest, with genericcrypto a close second.

In March 2026, PhishDestroy detected 20,981 phishing domains, a 48% decrease from February. 8,650 of them (41.2%) have already been neutralized, while 8,954 remain live and under active escalation. The most abused registrar was NICENIC INTERNATIONAL GROUP CO., LIMITED with 4,861 malicious domains, followed by CloudFlare, Inc. (4,342). Attackers targeted Ledger hardest, with across a close second.

In February 2026, PhishDestroy detected 40,384 phishing domains, a 352.8% increase from January. 20,522 of them (50.8%) have already been neutralized, while 15,658 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 8,735 malicious domains, followed by Cloudflare, Inc. (6,193). Attackers targeted genericcloudflare hardest, with across a close second.

In January 2026, PhishDestroy detected 8,919 phishing domains, a 24% decrease from December. 4,642 of them (52%) have already been neutralized, while 3,466 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 1,316 malicious domains, followed by PDR Ltd. d/b/a PublicDomainRegistry.com (972). Attackers targeted genericcrypto hardest, with x.com a close second.

In December 2025, PhishDestroy detected 11,740 phishing domains, a 6.5% decrease from November. 6,048 of them (51.5%) have already been neutralized, while 4,907 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 1,283 malicious domains, followed by Cloudflare, Inc. (1,145). Attackers targeted coinbase hardest, with genericcrypto a close second.

In November 2025, PhishDestroy detected 12,562 phishing domains, a 42.2% increase from October. 8,056 of them (64.1%) have already been neutralized, while 3,613 remain live and under active escalation. The most abused registrar was Dynadot LLC with 2,118 malicious domains, followed by Cloudflare, Inc. (1,504). Attackers targeted Google hardest, with genericcrypto a close second.

In October 2025, PhishDestroy detected 8,835 phishing domains, a 21.1% increase from September. 5,299 of them (60%) have already been neutralized, while 2,441 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 1,206 malicious domains, followed by Cloudflare, Inc. (827). Attackers targeted Google hardest, with across a close second.

In September 2025, PhishDestroy detected 7,297 phishing domains, a 92.9% increase from August. 4,459 of them (61.1%) have already been neutralized, while 2,185 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 774 malicious domains, followed by Web Commerce Communications Limited (677). Attackers targeted across hardest, with SushiSwap a close second.

In August 2025, PhishDestroy detected 3,782 phishing domains, a 440.3% increase from July. 2,170 of them (57.4%) have already been neutralized, while 1,458 remain live and under active escalation. The most abused registrar was Web Commerce Communications Limited with 277 malicious domains, followed by NameSilo, LLC (254). Attackers targeted across hardest, with Google a close second.

In July 2025, PhishDestroy detected 700 phishing domains, a 23233.3% increase from June. 466 of them (66.6%) have already been neutralized, while 192 remain live and under active escalation. The most abused registrar was Web Commerce Communications Limited with 85 malicious domains, followed by NameSilo, LLC (78). Attackers targeted across hardest, with Ethereum a close second.

In June 2025, PhishDestroy detected 3 phishing domains. 3 of them (100%) have already been neutralized. The most abused registrar was NameSilo, LLC with 1 malicious domains, followed by Web Commerce Communications Ltd. (1). Attackers targeted chainlink hardest, with amazon a close second.