Case file folder with redacted documents and confidential investigation report.

CASE / ANALYTICS

December 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

The Enablers Registry·Editorial mirror·/analytics/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Overview Jul 2613,318 Jun 2633,950 May 267,467 Apr 2616,157 Mar 2621,194 Feb 2642,079 Jan 268,925 Dec 2511,769 Nov 2512,577 Oct 258,840 Sep 257,304 Aug 253,786 Jul 25700 Jun 253

December 2025 Intelligence Report 6.4%

11,769

8,646

Taken Down

3,086

Still Live

73.5%

Kill Rate

2465h

Avg Response

10.0

Avg VT Score

In December 2025, THE ENABLERS REGISTRY detected 11,769 possibly phishing domains, a 6.4% decrease from November. 8,646 of them (73.5%) have already been neutralized, while 3,086 remain live and under active escalation. The most abused registrar was [REDACTED] with 1,283 malicious domains, followed by [REDACTED] (1,147). Attackers targeted NASDAQ:COIN hardest, with across a close second.

[REDACTED] alone accounts for 10.9% of the month's detections (1,283 domains) — concentration this high indicates systematic abuse, not random sign-ups.
Brand pressure is concentrated on NASDAQ:COIN and across — 1,358 lookalike domains between them.
The .com TLD leads with 3,815 malicious registrations, ahead of .app (991).
Dominant drainer kit: Angel Drainer (720 deployments detected).
Average infrastructure response time: 2465h — well beyond any reasonable takedown window.

Outlook

Heading into January 2026, expect continued pressure on NASDAQ:COIN users; registrations via [REDACTED] remain the primary vector to watch, with Angel Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.

Full Data on GitHub Browse All Domains Live Threats

Top Registrars

Registrar	Domains
[REDACTED]	1,283
[REDACTED]	1,147
[REDACTED]	607
[REDACTED]	584
[REDACTED] d/b/a IANA #303	581
[REDACTED]	529
[REDACTED]	509
[REDACTED]	461

Targeted Brands

Brand	Domains
NASDAQ:COIN	813
across	545
FinCEN MSB #31000023456789	421
Google	411
[REDACTED]	364
[REDACTED]	267
x.com	213
Ethereum	198

Top TLDs

Hosting Countries

Active Drainer Kits

December 2025 Domains (11,769)

Sorted by VirusTotal detections. Click any domain for full security report.

December 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

Top Registrars

Targeted Brands

Top TLDs

Hosting Countries

Active Drainer Kits

December 2025 Domains (11,769)

Detection Trends

Monthly Detected Domains

Kill Rate %

Explore More

Domain Hub

Live Threats

DestroyList on GitHub

About THE ENABLERS REGISTRY

Continue browsing the ledger