Holiday phishing domains and scam channels: what teams need to act on

TL;DR: Holiday-themed phishing activity is starting earlier and spreading across inboxes, social platforms, search ads and messaging apps, with 1,728 suspicious or malicious domains identified between 15 September and 10 November 2025 and stronger concentration around Halloween and Black Friday, according to Bfore. Seasonal trust and urgency remain the core exploitation pattern, and defensive controls now need to move upstream to registration monitoring and rapid takedown.

Editorial analysis by NHI Mgmt Group, based on content published by Bfore: “2025 Retail Holiday Threat Report: Scams and Impersonation Attacks Targeting Retailers”.

By the numbers:

• PreCrime Labs identified 1,728 domains suspicious and malicious in nature between 15 September and 10 November 2025.
• NameSilo accounts for 334 registrations.
• About 7.9% of the domains analysed were identified as domain-generation-algorithm based.

Key questions

Q: How should retail security teams prepare for seasonal phishing spikes?

A: Retail teams should increase monitoring, user awareness, and escalation coverage before the seasonal peak arrives, not after the first wave of attacks.

Q: Why do seasonal phishing campaigns convert so well at checkout?

A: They exploit existing buying intent.

Q: What are the signs that holiday fraud infrastructure is being built early?

A: Watch for clusters of newly registered domains with seasonal keywords, unusual TLDs, repeated naming patterns and rapid expansion across ads or social channels.

Practitioner guidance

• Pre-register seasonal brand domains Reserve likely combinations of your brand, discount terms and seasonal events before attackers do, including sale, Black Friday, Christmas and festival variants.
• Monitor new registrations for campaign patterns Track sudden spikes in keyword-heavy domains, unusual TLDs and registrar clustering so suspicious infrastructure can be triaged before peak shopping traffic arrives.
• Extend takedown coverage to ad and social channels Review paid placements, social posts, coupon communities and messaging groups as part of the same abuse workflow, because holiday scams often move across all four.

Bottom line: Holiday scams are not only persistent, they are moving earlier in the retail calendar and spreading through multiple distribution channels.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →