Case file folder with redacted documents and confidential investigation report.

CASE / ANALYTICS

January 2026 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

The Enablers Registry·Editorial mirror·/analytics/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Overview Jul 266,990 Jun 2632,829 May 267,196 Apr 2616,025 Mar 2620,579 Feb 2642,079 Jan 268,925 Dec 2511,769 Nov 2512,577 Oct 258,840 Sep 257,304 Aug 253,786 Jul 25700 Jun 253

January 2026 Intelligence Report 24.2%

8,925

7,030

Taken Down

1,895

Still Live

78.8%

Kill Rate

1904h

Avg Response

9.7

Avg VT Score

The most significant finding for January 2026 is a 24.1% decrease in detected possibly phishing domains compared to the previous month, totaling 8,932 domains. Despite this reduction, 1,823 domains remain active, indicating a need for improved takedown strategies. The takedown rate stands at 79.6%, showing effectiveness but also highlighting a gap in response times, with a mean registrar response time of 782.6 hours. Notably, there is a shift towards targeting crypto-related brands, with Crypto Scam domains leading at 792 detections, suggesting a change in attacker focus and potential vulnerabilities in the crypto sector.

[REDACTED] remains the top abused registrar with 1,300 domains, indicating a persistent issue with registrar oversight.
Crypto-related brands are increasingly targeted, with Crypto Scam and NASDAQ:COIN among the top, suggesting attackers are exploiting the volatile crypto market.
The .com TLD continues to be the most weaponized, accounting for 3,249 domains, reflecting its broad usage and trust.
The solana_drainer kit is the most prevalent, with 213 instances, posing significant risks of wallet drains and seed theft for victims.
The US remains the primary hosting geography with 2,024 domains, but notable activity is seen in HK and DE, indicating a geographic shift.
Registrar response times remain high at 782.6 hours, necessitating faster action to reduce active possibly phishing threats.

Outlook

Expect continued focus on crypto-related possibly phishing, with potential increases in domain registrations targeting this sector. Defenders should monitor [REDACTED] and [REDACTED] for escalated abuse activity. Watch for new drainer kit variants as attackers refine their methods to exploit cryptocurrency vulnerabilities.

Full Data on GitHub Browse All Domains Live Threats

Top Registrars

Registrar	Domains
[REDACTED]	1,316
[REDACTED] d/b/a IANA #303	972
[REDACTED]	780
[REDACTED]	453
[REDACTED]	442
[REDACTED]	437
[REDACTED]	436
[REDACTED]	341

Targeted Brands

Brand	Domains
x.com	516
argent	452
across	377
LEI:5493004F7TI6QBM4WX72	280
Google	258
base	257
NASDAQ:COIN	183
foundation	145

Top TLDs

Hosting Countries

Active Drainer Kits

January 2026 Domains (8,925)

Sorted by VirusTotal detections. Click any domain for full security report.

January 2026 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

Top Registrars

Targeted Brands

Top TLDs

Hosting Countries

Active Drainer Kits

January 2026 Domains (8,925)

Detection Trends

Monthly Detected Domains

Kill Rate %

Explore More

Domain Hub

Live Threats

DestroyList on GitHub

About THE ENABLERS REGISTRY

Continue browsing the ledger