Case file folder with redacted documents and confidential investigation report.

CASE / ANALYTICS

December 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

The Enablers Registry·Editorial mirror·/analytics/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Overview Jul 266,848 Jun 2632,829 May 267,196 Apr 2616,025 Mar 2620,579 Feb 2642,079 Jan 268,925 Dec 2511,769 Nov 2512,577 Oct 258,840 Sep 257,304 Aug 253,786 Jul 25700 Jun 253

December 2025 Intelligence Report 6.4%

11,769

8,738

Taken Down

3,031

Still Live

74.2%

Kill Rate

2464h

Avg Response

10.0

Avg VT Score

In December 2025, THE ENABLERS REGISTRY detected 11,773 possibly phishing domains, marking a 6.4% decrease from the previous month. The takedown rate was 76.3%, with 8,978 domains neutralized. Notably, Crypto Scam targeting remains prevalent with 820 domains, while [REDACTED] emerged as the top registrar for abuse cases. The operational impact shows effective takedown efforts, though the mean registrar response time of 1452.7 hours indicates room for improvement in response speed.

[REDACTED] leads registrar abuse with 1268 cases, necessitating focused intervention.
Crypto-related brands like NASDAQ:COIN and FinCEN MSB #31000023456789 are primary targets, overshadowing traditional banking sectors.
The .com TLD remains the most weaponized with 3816 domains, followed by .app and .dev.
The Angel Drainer kit is the most used, posing significant threats to victims' wallets through direct fund extraction.
The US hosts the majority of possibly phishing infrastructure with 8798 domains, indicating a need for enhanced monitoring in this region.
Detection-to-takedown efficiency remains robust at 76.3%, but the slow registrar response time highlights a critical gap.

Outlook

As we move into January 2026, defenders should anticipate continued targeting of crypto platforms, especially given the dominance of the Angel Drainer kit. Registrars like [REDACTED] and [REDACTED] require escalation to improve response times. Watch for potential shifts in TLD usage and geographic hosting patterns.

Full Data on GitHub Browse All Domains Live Threats

Top Registrars

Registrar	Domains
[REDACTED]	1,283
[REDACTED]	1,147
[REDACTED]	607
[REDACTED]	584
[REDACTED] d/b/a IANA #303	581
[REDACTED]	529
[REDACTED]	509
[REDACTED]	461

Targeted Brands

Brand	Domains
NASDAQ:COIN	813
across	545
FinCEN MSB #31000023456789	421
Google	411
[REDACTED]	364
[REDACTED]	267
x.com	213
Ethereum	198

Top TLDs

Hosting Countries

Active Drainer Kits

December 2025 Domains (11,769)

Sorted by VirusTotal detections. Click any domain for full security report.

bafybeibkbwhd66vsgqu5n6n36clzhocy66gowcq46isrci6kbeqee6vwue.ipfs.dweb.link

December 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

Top Registrars

Targeted Brands

Top TLDs

Hosting Countries

Active Drainer Kits

December 2025 Domains (11,769)

Detection Trends

Monthly Detected Domains

Kill Rate %

Explore More

Domain Hub

Live Threats

DestroyList on GitHub

About THE ENABLERS REGISTRY

Continue browsing the ledger