Case file folder with redacted documents and confidential investigation report.

CASE / ANALYTICS

March 2026 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

The Enablers Registry·Editorial mirror·/analytics/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Overview Jul 266,848 Jun 2632,829 May 267,196 Apr 2616,025 Mar 2620,579 Feb 2642,079 Jan 268,925 Dec 2511,769 Nov 2512,577 Oct 258,840 Sep 257,304 Aug 253,786 Jul 25700 Jun 253

March 2026 Intelligence Report 51.1%

20,579

13,955

Taken Down

6,624

Still Live

67.8%

Kill Rate

677h

Avg Response

7.4

Avg VT Score

In March 2026, THE ENABLERS REGISTRY detected 6,635 possibly phishing domains, marking a 63.6% decrease from the previous month. Despite this reduction, 3,124 domains remain active, highlighting a takedown rate of only 52.6%. Attackers continue to focus on cryptocurrency platforms, with NASDAQ:COIN and [REDACTED] being the top targets. The operational impact is significant, as the takedown rate remains below the desired threshold, indicating a need for improved response times from registrars, particularly [REDACTED] and [REDACTED].

[REDACTED] is the top abused registrar with 1,334 domains, necessitating immediate escalation.
Cryptocurrency platforms, especially NASDAQ:COIN and [REDACTED], are under sustained attack, with 86 and 72 domains respectively.
The .com TLD remains the most weaponized with 2,369 domains, followed by .dev and .app.
The Solana Drainer kit is prevalent, used in 105 instances, posing a significant threat of wallet drains for victims.
Peak detection days were March 2nd and March 5th, indicating concentrated possibly phishing campaigns.
Mean registrar response time is 47.3 hours, suggesting room for improvement in takedown efficiency.

Outlook

Looking ahead to April 2026, defenders should remain vigilant against cryptocurrency-targeted possibly phishing, particularly involving Solana Drainer kits. Registrars like [REDACTED] and [REDACTED] require continued monitoring and pressure to enhance their response times. Expect potential shifts in TLD usage as attackers adapt to increased scrutiny.

Full Data on GitHub Browse All Domains Live Threats

Top Registrars

Registrar	Domains
[REDACTED]	4,830
[REDACTED]	4,010
[REDACTED] d/b/a IANA #303	878
[REDACTED]	690
[REDACTED]	684
[REDACTED]	666
[REDACTED]	601
[REDACTED]	494

Targeted Brands

Brand	Domains
[REDACTED]	1,439
FinCEN MSB #31000023456789	467
[REDACTED]	375
Solana	349
Google	279
NASDAQ:COIN	261
[REDACTED]	230
across	226

Top TLDs

Hosting Countries

Active Drainer Kits

March 2026 Domains (20,579)

Sorted by VirusTotal detections. Click any domain for full security report.

March 2026 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

Top Registrars

Targeted Brands

Top TLDs

Hosting Countries

Active Drainer Kits

March 2026 Domains (20,579)

Detection Trends

Monthly Detected Domains

Kill Rate %

Explore More

Domain Hub

Live Threats

DestroyList on GitHub

About THE ENABLERS REGISTRY

Continue browsing the ledger