Case file folder with redacted documents and confidential investigation report.

CASE / ANALYTICS

October 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

The Enablers Registry·Editorial mirror·/analytics/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Overview Jul 267,112 Jun 2632,829 May 267,196 Apr 2616,025 Mar 2620,579 Feb 2642,079 Jan 268,925 Dec 2511,769 Nov 2512,577 Oct 258,840 Sep 257,304 Aug 253,786 Jul 25700 Jun 253

October 2025 Intelligence Report 21%

8,840

7,578

Taken Down

1,262

Still Live

85.7%

Kill Rate

4005h

Avg Response

8.6

Avg VT Score

In October 2025, THE ENABLERS REGISTRY detected 8,841 possibly phishing domains, marking a 21.0% increase from the previous month. Notably, [REDACTED] emerged as the top abuse registrar with 1,206 domains, indicating a potential shift in attacker preferences for domain registration. The targeting of Generic Crypto brands remains prevalent, with 669 domains detected, while Angel Drainer kits were the most used, affecting victims through wallet drains. Despite an 85.7% takedown rate, the mean registrar response time of 2803.0 hours highlights a critical gap in rapid domain deactivation.

[REDACTED] leads registrar abuse with 1,206 domains, necessitating immediate escalation.
Crypto-related brands, especially Generic Crypto, are heavily targeted with 669 domains, overshadowing banking and social sectors.
The .com TLD remains the most weaponized with 3,256 domains, followed by .xyz and .app.
Angel Drainer kits dominate with 1,122 instances, posing significant risks of wallet drain for victims.
US-based hosting is overwhelmingly preferred, with 6,383 domains, indicating a need for increased collaboration with US-based providers.
The mean registrar response time of 2803.0 hours suggests inefficiencies in detection-to-takedown processes.

Outlook

In November, expect continued targeting of crypto sectors, with potential increases in .xyz and .app TLD abuse. Defenders should prioritize monitoring [REDACTED] and escalate registrar response times to improve takedown efficiency.

Full Data on GitHub Browse All Domains Live Threats

Top Registrars

Registrar	Domains
[REDACTED]	1,206
[REDACTED]	828
[REDACTED]	784
[REDACTED]	696
[REDACTED]	419
[REDACTED]	394
[REDACTED]	335
[REDACTED] d/b/a IANA #303	318

Targeted Brands

Brand	Domains
Google	608
across	577
NASDAQ:COIN	383
LEI:5493004F7TI6QBM4WX72	267
solana	237
Ethereum	227
Facebook	184
[REDACTED]	173

Top TLDs

Hosting Countries

Active Drainer Kits

October 2025 Domains (8,840)

Sorted by VirusTotal detections. Click any domain for full security report.

October 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

Top Registrars

Targeted Brands

Top TLDs

Hosting Countries

Active Drainer Kits

October 2025 Domains (8,840)

Detection Trends

Monthly Detected Domains

Kill Rate %

Explore More

Domain Hub

Live Threats

DestroyList on GitHub

About THE ENABLERS REGISTRY

Continue browsing the ledger