Phishing sites impersonating Cosmos

PhishDestroy has recorded 53 phishing domains impersonating Cosmos since 2025-08-09, 4 of them in the last 30 days. The most used registrars are Dynadot and Cloudflare; the most common TLDs are .com and .dev. Open Cosmos only from its official app or a saved bookmark.

53
Domains, all time
4
Last 30 days
26
Online at last check
7
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 12026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 12026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 12026-09-10: 02026-09-11: 12026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 22026-10-14: 12026-10-15: 02026-10-16: 12026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Cosmos phishing domains detected per day: 8 from 2026-07-25 to 2026-10-22; peak 2.

How to tell a fake Cosmos site

Words most often added to the brand in reported domains: claim, download, ledger, imtoken, airdrop, wallet, update, planetaria, quiekeswp, zkml.

  • Type the address yourself or use a bookmark; phishing links for Cosmos arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Cosmos will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Cosmos phishing domains

The 50 most recently detected domains impersonating Cosmos
DomainFirst detectedStatus at last checkRegistrar
bjornscoloradohoney.shop2026-10-16OnlineDynadot
go-live-ledggr.framer.media2026-10-14OnlineCSC Corporate Domains
auroravivid.vip2026-10-13OnlineNameSilo
berrimaze.shop2026-10-13OnlineDynadot
imtokencom.top2026-09-11OfflineDynadot
aerosolesstudio.shop2026-09-09OnlineDynadot
update-installer.com2026-09-05OnlineTrustname.com
micros-arcade.pages.dev2026-08-16OnlineCloudflare Pages
cosmosdrop.pages.dev2026-06-15OnlineCloudflare
tron-link.net.cn2026-06-09Online浙江贰贰网络有限公司
dnstats.net2026-05-19OnlineTucows Domains
secure-web.sbs2026-05-13OnlineNameSilo
tronlink.xn--fiqs8s2026-05-07Taken down浙江贰贰网络有限公司
imtoken-android.org.cn2026-04-30Online成都西维数码科技有限公司
pub-f1e213d7f7cb4ce7ba1028767eebb8db.r2.dev2026-04-28Taken downCloudflare R2
provenanceblockchain.live2026-04-24OnlineWeb Commerce Communications dba WebNic.c
mmm-3mf.pages.dev2026-04-22OnlineCloudflare
airdroppernight.shop2026-04-11OfflineSpaceship
kiichain.live2026-04-04OnlineNICENIC
bitmartloginx.webflow.io2026-04-01OnlineWebflow
bitmartlogins.webflow.io2026-03-29OnlineWebflow
meerae-net.pages.dev2026-03-22OnlineCloudflare
tocken.im2026-02-26Offline—
claim-mito.org2026-02-26OfflinePublicDomainRegistry.com
ledger-live-download-ekl.pages.dev2026-02-26OfflineCloudflare
quasar-migration.com2026-02-26Offline—
globalmetromile-investment.com2026-02-26OfflineHOSTINGER operations
claims-solana.pages.dev2026-02-26OfflineCloudflare
web-keplr.com2026-02-26OnlineTrustname.com
claim.hyperslane.network2026-02-26Offline—
imtoken.bot2026-02-03OfflineDynadot
wallet-cosmostation.co2026-02-03OfflineTucows Domains
airdrop-kazonomics.com2026-02-03OnlineNiceNIC
tokno.im2026-01-24Taken downRedacted
imtoken.ng2026-01-21Taken downDYNADOT
io-en.click2026-01-19OfflineDynadot
io-en.support2026-01-19OfflineDynadot
ledger-download.co.com2026-01-07OfflineMoniker Online Services
download-ledger.us2026-01-07OfflineRegistrar.eu
nft.swisstronik.com2025-12-24Taken downGoDaddy.com
imtokm.app2025-11-29OfflineDynadot
claim-log.top2025-11-23UnknownNiceNIC
access-portals.top2025-11-20UnknownNiceNIC
service1connect.live2025-11-19Taken downCloudflare
update-rpc.top2025-11-09Offline耐思尼克国际集团有限公司
rpcs-updates.top2025-11-07OfflineERANET
lmtakon.com2025-10-24Taken downDynadot
atomic-wallet.fr2025-10-15OnlineRegistrar.eu
zkml-launchpad.com2025-09-16OfflinePublicDomainRegistry.com
airdrop-satlayer.site2025-09-16OfflineNameSilo

All 53 Cosmos reports

Where they are registered and hosted

Registrars

  1. Dynadot6
  2. Cloudflare6
  3. NameSilo3
  4. NiceNIC3
  5. Dynadot3
  6. GoDaddy.com2
  7. PublicDomainRegistry.com2
  8. Registrar.eu2

Top-level domains

  1. .com9
  2. .dev7
  3. .top5
  4. .shop4
  5. .live3
  6. .network2
  7. .im2
  8. .io2

Hosting networks

  1. CLOUDFLARENET, US17
  2. Cloudflare, Inc.16
  3. FASTLY, US2
  4. U1 DIGITAL SERVICES LTD2
  5. Host Sailor Ltd2
  6. CLOUDFLARENET - Cloudflare, Inc., US2
  7. Malakmadze Web LLC2
  8. Public Cloud Ltd.1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Cosmos; share of all PhishDestroy reports: 0.02%.