July 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

• <strong>[REDACTED]</strong> and <strong>[REDACTED]</strong> lead in registrar abuse with <strong>75</strong> and <strong>71</strong> domains respectively, indicating a need for targeted mitigation.
• Crypto brands remain prime targets with <strong>Generic Crypto</strong> and <strong>SushiSwap</strong> being the most attacked, suggesting a persistent focus on digital asset theft.
• The <strong>.com</strong> TLD is the most weaponized with <strong>304</strong> domains, followed by <strong>.xyz</strong> with <strong>84</strong>, indicating a preference for these TLDs in possibly phishing campaigns.
• The dominance of <strong>Angel Drainer</strong> kits across <strong>183</strong> domains suggests a prevalent threat of wallet drains and seed theft.
• The US hosts the majority of possibly phishing infrastructure with <strong>561</strong> domains, indicating a concentration of malicious activities in this region.
• The mean detection-to-takedown time remains high at <strong>4981.9</strong> hours, necessitating faster registrar responses to reduce active possibly phishing threats.

Active Drainer Kits