Case file folder with redacted documents and confidential investigation report.

CASE / ANALYTICS

December 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

The Enablers Registry·Editorial mirror·/analytics/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Overview Jul 2612,763 Jun 2633,950 May 267,467 Apr 2616,157 Mar 2621,194 Feb 2642,079 Jan 268,925 Dec 2511,769 Nov 2512,577 Oct 258,840 Sep 257,304 Aug 253,786 Jul 25700 Jun 253

December 2025 Intelligence Report 6.4%

11,769

8,640

Taken Down

3,092

Still Live

73.4%

Kill Rate

2465h

Avg Response

10.0

Avg VT Score

In December 2025, THE ENABLERS REGISTRY detected 11,773 possibly phishing domains, marking a 6.4% decrease from the previous month. The takedown rate was 76.3%, with 8,978 domains neutralized. Notably, Crypto Scam targeting remains prevalent with 820 domains, while [REDACTED] emerged as the top registrar for abuse cases. The operational impact shows effective takedown efforts, though the mean registrar response time of 1452.7 hours indicates room for improvement in response speed.

[REDACTED] leads registrar abuse with 1268 cases, necessitating focused intervention.
Crypto-related brands like NASDAQ:COIN and FinCEN MSB #31000023456789 are primary targets, overshadowing traditional banking sectors.
The .com TLD remains the most weaponized with 3816 domains, followed by .app and .dev.
The Angel Drainer kit is the most used, posing significant threats to victims' wallets through direct fund extraction.
The US hosts the majority of possibly phishing infrastructure with 8798 domains, indicating a need for enhanced monitoring in this region.
Detection-to-takedown efficiency remains robust at 76.3%, but the slow registrar response time highlights a critical gap.

Outlook

As we move into January 2026, defenders should anticipate continued targeting of crypto platforms, especially given the dominance of the Angel Drainer kit. Registrars like [REDACTED] and [REDACTED] require escalation to improve response times. Watch for potential shifts in TLD usage and geographic hosting patterns.

Full Data on GitHub Browse All Domains Live Threats