Case file folder with redacted documents and confidential investigation report.

CASE / ANALYTICS

August 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

The Enablers Registry·Editorial mirror·/analytics/

Public record copy. Brand names withheld, public accreditation numbers preserved. If the body below says “we”, that means the original publisher, not this mirror. TER only preserves, redacts, and re-contextualizes.

Overview Jul 267,114 Jun 2632,829 May 267,196 Apr 2616,025 Mar 2620,579 Feb 2642,079 Jan 268,925 Dec 2511,769 Nov 2512,577 Oct 258,840 Sep 257,304 Aug 253,786 Jul 25700 Jun 253

August 2025 Intelligence Report 440.9%

3,786

2,816

Taken Down

970

Still Live

74.4%

Kill Rate

5577h

Avg Response

4.7

Avg VT Score

August 2025 saw a dramatic surge in possibly phishing domains with 3,788 detected, marking a 441.1% increase from the previous month. The takedown rate stood at 67.6%, indicating significant operational success, though the mean registrar response time remains critically high at 4426.9 hours. Notably, FinCEN MSB #31000023456789 and [REDACTED] were heavily targeted, reflecting a strategic focus on cryptocurrency brands. The prevalence of the Angel Drainer kit, implicated in 220 cases, underscores a persistent threat of wallet draining for victims.

N/A remains the top abuse registrar with 458 domains, followed by [REDACTED] with 224 domains.
Targeting of FinCEN MSB #31000023456789 and [REDACTED] suggests a continued emphasis on cryptocurrency rather than traditional banking.
The .com TLD was the most weaponized with 1,828 instances, dwarfing other TLDs like .xyz and .life.
The Angel Drainer kit led the pack, posing a significant risk of wallet draining for cryptocurrency users.
The majority of possibly phishing infrastructure is hosted in the US with 2,524 domains, indicating a concentration that defenders should prioritize.
Despite a takedown rate of 67.6%, the mean registrar response time of 4426.9 hours highlights a critical delay in mitigation efforts.

Outlook

Looking ahead to September 2025, defenders should anticipate continued targeting of cryptocurrency brands, with potential shifts towards new TLDs as attackers diversify. Registrars like N/A and [REDACTED] require escalated monitoring due to their high abuse concentrations. Vigilance against the Angel Drainer kit remains crucial to protect users from wallet draining threats.

Full Data on GitHub Browse All Domains Live Threats

Top Registrars

Registrar	Domains
[REDACTED]	277
[REDACTED]	253
[REDACTED]	204
[REDACTED]	189
[REDACTED]	183
[REDACTED]	168
[REDACTED]	159
[REDACTED]	151

Targeted Brands

Brand	Domains
across	449
Google	184
FinCEN MSB #31000023456789	167
Ethereum	150
[REDACTED]	139
LEI:5493004F7TI6QBM4WX72	126
base	75
[REDACTED]	67

Top TLDs

Hosting Countries

Active Drainer Kits

August 2025 Domains (3,786)

Sorted by VirusTotal detections. Click any domain for full security report.

August 2025 Phishing Threat Report — THE ENABLERS REGISTRY Analytics

Top Registrars

Targeted Brands

Top TLDs

Hosting Countries

Active Drainer Kits

August 2025 Domains (3,786)

Detection Trends

Monthly Detected Domains

Kill Rate %

Explore More

Domain Hub

Live Threats

DestroyList on GitHub

About THE ENABLERS REGISTRY

Continue browsing the ledger