Editorial mirrorBrand mentions redacted to public IDs. Hover to inspect. Everything else is theatre.How it works
THE ENABLERS REGISTRYRegistrar accountability archive
Archive LiveRead-only public record · No ads · No tracking
Case file folder with redacted documents and confidential investigation report.
CASE / ANALYTICS

December 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

The Enablers Registry·Editorial mirror·/analytics/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Overview Jul 266,990 Jun 2632,829 May 267,196 Apr 2616,025 Mar 2620,579 Feb 2642,079 Jan 268,925 Dec 2511,769 Nov 2512,577 Oct 258,840 Sep 257,304 Aug 253,786 Jul 25700 Jun 253
December 2025 Intelligence Report 6.4%
11,769
8,740
Taken Down
3,029
Still Live
74.3%
Kill Rate
2464h
Avg Response
10.0
Avg VT Score

In December 2025, THE ENABLERS REGISTRY detected <strong>11,773</strong> possibly phishing domains, marking a <strong>6.4%</strong> decrease from the previous month. The takedown rate was <strong>76.3%</strong>, with <strong>8,978</strong> domains neutralized. Notably, <strong>Crypto Scam</strong> targeting remains prevalent with <strong>820</strong> domains, while <strong>[REDACTED]</strong> emerged as the top registrar for abuse cases. The operational impact shows effective takedown efforts, though the mean registrar response time of <strong>1452.7</strong> hours indicates room for improvement in response speed.

  • <strong>[REDACTED]</strong> leads registrar abuse with <strong>1268</strong> cases, necessitating focused intervention.
  • Crypto-related brands like <strong>NASDAQ:COIN</strong> and <strong>FinCEN MSB #31000023456789</strong> are primary targets, overshadowing traditional banking sectors.
  • The <strong>.com</strong> TLD remains the most weaponized with <strong>3816</strong> domains, followed by <strong>.app</strong> and <strong>.dev</strong>.
  • The <strong>Angel Drainer</strong> kit is the most used, posing significant threats to victims' wallets through direct fund extraction.
  • The US hosts the majority of possibly phishing infrastructure with <strong>8798</strong> domains, indicating a need for enhanced monitoring in this region.
  • Detection-to-takedown efficiency remains robust at <strong>76.3%</strong>, but the slow registrar response time highlights a critical gap.
Outlook
As we move into January 2026, defenders should anticipate continued targeting of crypto platforms, especially given the dominance of the <strong>Angel Drainer</strong> kit. Registrars like <strong>[REDACTED]</strong> and <strong>[REDACTED]</strong> require escalation to improve response times. Watch for potential shifts in TLD usage and geographic hosting patterns.
Full Data on GitHub Browse All Domains Live Threats

Top Registrars

RegistrarDomains
[REDACTED] 1,283
[REDACTED] 1,147
[REDACTED] 607
[REDACTED] 584
[REDACTED] d/b/a IANA #303 581
[REDACTED] 529
[REDACTED] 509
[REDACTED] 461

Targeted Brands

BrandDomains
NASDAQ:COIN 813
across 545
FinCEN MSB #31000023456789 421
Google 411
[REDACTED] 364
[REDACTED] 267
x.com 213
Ethereum 198

Top TLDs

.com3,815 .app991 .dev619 .io608 .xyz483 .ru453 .ai349 .org319

Hosting Countries

🇺🇸 US8,991 🇩🇪 DE647 🇸🇪 SE401 🇭🇰 HK390 🇳🇱 NL376 🇷🇺 RU97 🇫🇷 FR77 🇬🇧 GB75

Active Drainer Kits

Angel Drainer720 Wallet Connect Abuse403 Solana Drainer248 Inferno Drainer4 Ice Possibly phishing2

December 2025 Domains (11,769)

Sorted by VirusTotal detections. Click any domain for full security report.

Screenshot of [REDACTED]
[REDACTED]
17 VTLiveAngel Drainer
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of simple-swap.to
simple-swap.to
17 VTTaken Down
Screenshot of simpleswap-app.to
simpleswap-app.to
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTLive
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of smallbear-electronics.booksvala.in
smallbear-electronics.booksvala.in
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTLive
Screenshot of soiflare.fi-v2.to
soiflare.fi-v2.to
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTLive
Screenshot of srturl.link
srturl.link
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTLive
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of stakingrewards.hot
stakingrewards.hot
17 VTTaken Down
Screenshot of stakingrewards.now
stakingrewards.now
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTLive
Screenshot of [REDACTED]
[REDACTED]
17 VTLive
[REDACTED]
17 VTTaken Down
Screenshot of sxt.airdropsalert.sbs
sxt.airdropsalert.sbs
17 VTTaken DownAngel Drainer
Screenshot of [REDACTED]
[REDACTED]
17 VTTaken DownAngel Drainer
Screenshot of t-mobile.dftgyt.icu
t-mobile.dftgyt.icu
17 VTTaken Down
Screenshot of t-mobile.fwdwdt.bond
t-mobile.fwdwdt.bond
17 VTTaken Down
Screenshot of t-mobile.fwdwdu.bond
t-mobile.fwdwdu.bond
17 VTTaken Down
Screenshot of t-mobile.fwdwdy.bond
t-mobile.fwdwdy.bond
17 VTTaken Down
Screenshot of t-mobile.gnlve.icu
t-mobile.gnlve.icu
17 VTTaken Down
Screenshot of t-mobile.hlnio.icu
t-mobile.hlnio.icu
17 VTTaken Down
Screenshot of t-mobile.jgtiy.icu
t-mobile.jgtiy.icu
17 VTTaken Down
Screenshot of t-mobile.joytx.icu
t-mobile.joytx.icu
17 VTTaken Down
Screenshot of t-mobile.kxvya.icu
t-mobile.kxvya.icu
17 VTTaken Down
Screenshot of t-mobile.lkbhgd.icu
t-mobile.lkbhgd.icu
17 VTTaken Down
Screenshot of t-mobile.marfo.icu
t-mobile.marfo.icu
17 VTTaken Down
Screenshot of t-mobile.nvdtw.icu
t-mobile.nvdtw.icu
17 VTTaken Down
Screenshot of t-mobile.owgnp.icu
t-mobile.owgnp.icu
17 VTTaken Down
Screenshot of t-mobile.sbxvi.icu
t-mobile.sbxvi.icu
17 VTTaken Down
Screenshot of t-mobile.scbhv.icu
t-mobile.scbhv.icu
17 VTTaken Down
Screenshot of t-mobile.szjbf.icu
t-mobile.szjbf.icu
17 VTTaken Down
Screenshot of t-mobile.tfrgh.icu
t-mobile.tfrgh.icu
17 VTTaken Down
Screenshot of t-mobile.tjqef.icu
t-mobile.tjqef.icu
17 VTTaken Down
Screenshot of t-mobile.vicwr.icu
t-mobile.vicwr.icu
17 VTTaken Down
Screenshot of t-mobile.vkbgc.icu
t-mobile.vkbgc.icu
17 VTTaken Down
Screenshot of t-mobile.yajie.icu
t-mobile.yajie.icu
17 VTTaken Down
Screenshot of t-mobile.zhfaj.icu
t-mobile.zhfaj.icu
17 VTTaken Down
Screenshot of t-mobile.zlgdh.icu
t-mobile.zlgdh.icu
17 VTTaken Down
Screenshot of teaminvitemeeting.im
teaminvitemeeting.im
17 VTTaken Down
Screenshot of [REDACTED]
[REDACTED]
17 VTLive
« Prev ... 26 27 28 29 30 31 32 ... Next »

Detection Trends

Monthly domain volume, kill rate, and live threats over time.

Monthly Detected Domains

Kill Rate %

Explore More

Related intelligence pages and data feeds.

Domain Hub

179,808+ domains with security reports

Live Threats

51,227 possibly phishing sites still online

DestroyList on GitHub

Open-source daily possibly phishing domain feeds

About THE ENABLERS REGISTRY

Independent anti-phishing threat intelligence

Continue browsing the ledger

This page is the editorial mirror. Brand names are redacted to public IANA / business identifiers. Use the index to navigate other case files.

Open registrar ledger → All briefings