November 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

• <strong>[REDACTED]</strong> leads registrar abuse with <strong>1,583</strong> domains, followed by <strong>[REDACTED]</strong> and <strong>[REDACTED]</strong>.
• Crypto-related brands like <strong>NASDAQ:COIN</strong> (<strong>422</strong>) and <strong>FinCEN MSB #31000023456789</strong> (<strong>350</strong>) are primary targets, overshadowing traditional sectors.
• The <strong>.com</strong> TLD remains the most weaponized with <strong>3,945</strong> domains, while <strong>.io</strong> and <strong>.xyz</strong> also see significant usage.
• <strong>Angel Drainer</strong> is the most prevalent kit with <strong>842</strong> instances, posing risks of wallet draining and seed theft.
• The US hosts the majority of possibly phishing infrastructure with <strong>9,485</strong> domains, but Germany and Sweden are emerging hotspots.
• Registrar response inefficiency persists, with a mean time of <strong>2189.3</strong> hours, necessitating faster action.

Active Drainer Kits