# Phishing sites impersonating Cosmos

PhishDestroy has recorded 53 phishing domains impersonating Cosmos since 2025-08-09, 4 of them in the last 30 days. The most used registrars are Dynadot and Cloudflare; the most common TLDs are .com and .dev. Open Cosmos only from its official app or a saved bookmark.

53Domains, all time

4Last 30 days

26Online at last check

7Confirmed takedowns

## New domains in the last 90 days

Cosmos phishing domains detected per day: 8 from 2026-07-25 to 2026-10-22; peak 2.

## How to tell a fake Cosmos site

Words most often added to the brand in reported domains: claim, download, ledger, imtoken, airdrop, wallet, update, planetaria, quiekeswp, zkml.
- Type the address yourself or use a bookmark; phishing links for Cosmos arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Cosmos will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Cosmos phishing domains

The 50 most recently detected domains impersonating Cosmos
Domain | First detected | Status at last check | Registrar | 
[bjornscoloradohoney.shop](https://phishdestroy.io/domain/bjornscoloradohoney.shop/) | 2026-10-16 | Online | Dynadot | 
[go-live-ledggr.framer.media](https://phishdestroy.io/domain/go-live-ledggr.framer.media/) | 2026-10-14 | Online | CSC Corporate Domains | 
[auroravivid.vip](https://phishdestroy.io/domain/auroravivid.vip/) | 2026-10-13 | Online | NameSilo | 
[berrimaze.shop](https://phishdestroy.io/domain/berrimaze.shop/) | 2026-10-13 | Online | Dynadot | 
[imtokencom.top](https://phishdestroy.io/domain/imtokencom.top/) | 2026-09-11 | Offline | Dynadot | 
[aerosolesstudio.shop](https://phishdestroy.io/domain/aerosolesstudio.shop/) | 2026-09-09 | Online | Dynadot | 
[update-installer.com](https://phishdestroy.io/domain/update-installer.com/) | 2026-09-05 | Online | Trustname.com | 
[micros-arcade.pages.dev](https://phishdestroy.io/domain/micros-arcade.pages.dev/) | 2026-08-16 | Online | Cloudflare Pages | 
[cosmosdrop.pages.dev](https://phishdestroy.io/domain/cosmosdrop.pages.dev/) | 2026-06-15 | Online | Cloudflare | 
[tron-link.net.cn](https://phishdestroy.io/domain/tron-link.net.cn/) | 2026-06-09 | Online | 浙江贰贰网络有限公司 | 
[dnstats.net](https://phishdestroy.io/domain/dnstats.net/) | 2026-05-19 | Online | Tucows Domains | 
[secure-web.sbs](https://phishdestroy.io/domain/secure-web.sbs/) | 2026-05-13 | Online | NameSilo | 
[tronlink.xn--fiqs8s](https://phishdestroy.io/domain/tronlink.xn--fiqs8s/) | 2026-05-07 | Taken down | 浙江贰贰网络有限公司 | 
[imtoken-android.org.cn](https://phishdestroy.io/domain/imtoken-android.org.cn/) | 2026-04-30 | Online | 成都西维数码科技有限公司 | 
[pub-f1e213d7f7cb4ce7ba1028767eebb8db.r2.dev](https://phishdestroy.io/domain/pub-f1e213d7f7cb4ce7ba1028767eebb8db.r2.dev/) | 2026-04-28 | Taken down | Cloudflare R2 | 
[provenanceblockchain.live](https://phishdestroy.io/domain/provenanceblockchain.live/) | 2026-04-24 | Online | Web Commerce Communications dba WebNic.c | 
[mmm-3mf.pages.dev](https://phishdestroy.io/domain/mmm-3mf.pages.dev/) | 2026-04-22 | Online | Cloudflare | 
[airdroppernight.shop](https://phishdestroy.io/domain/airdroppernight.shop/) | 2026-04-11 | Offline | Spaceship | 
[kiichain.live](https://phishdestroy.io/domain/kiichain.live/) | 2026-04-04 | Online | NICENIC | 
[bitmartloginx.webflow.io](https://phishdestroy.io/domain/bitmartloginx.webflow.io/) | 2026-04-01 | Online | Webflow | 
[bitmartlogins.webflow.io](https://phishdestroy.io/domain/bitmartlogins.webflow.io/) | 2026-03-29 | Online | Webflow | 
[meerae-net.pages.dev](https://phishdestroy.io/domain/meerae-net.pages.dev/) | 2026-03-22 | Online | Cloudflare | 
[tocken.im](https://phishdestroy.io/domain/tocken.im/) | 2026-02-26 | Offline | — | 
[claim-mito.org](https://phishdestroy.io/domain/claim-mito.org/) | 2026-02-26 | Offline | PublicDomainRegistry.com | 
[ledger-live-download-ekl.pages.dev](https://phishdestroy.io/domain/ledger-live-download-ekl.pages.dev/) | 2026-02-26 | Offline | Cloudflare | 
[quasar-migration.com](https://phishdestroy.io/domain/quasar-migration.com/) | 2026-02-26 | Offline | — | 
[globalmetromile-investment.com](https://phishdestroy.io/domain/globalmetromile-investment.com/) | 2026-02-26 | Offline | HOSTINGER operations | 
[claims-solana.pages.dev](https://phishdestroy.io/domain/claims-solana.pages.dev/) | 2026-02-26 | Offline | Cloudflare | 
[web-keplr.com](https://phishdestroy.io/domain/web-keplr.com/) | 2026-02-26 | Online | Trustname.com | 
[claim.hyperslane.network](https://phishdestroy.io/domain/claim.hyperslane.network/) | 2026-02-26 | Offline | — | 
[imtoken.bot](https://phishdestroy.io/domain/imtoken.bot/) | 2026-02-03 | Offline | Dynadot | 
[wallet-cosmostation.co](https://phishdestroy.io/domain/wallet-cosmostation.co/) | 2026-02-03 | Offline | Tucows Domains | 
[airdrop-kazonomics.com](https://phishdestroy.io/domain/airdrop-kazonomics.com/) | 2026-02-03 | Online | NiceNIC | 
[tokno.im](https://phishdestroy.io/domain/tokno.im/) | 2026-01-24 | Taken down | Redacted | 
[imtoken.ng](https://phishdestroy.io/domain/imtoken.ng/) | 2026-01-21 | Taken down | DYNADOT | 
[io-en.click](https://phishdestroy.io/domain/io-en.click/) | 2026-01-19 | Offline | Dynadot | 
[io-en.support](https://phishdestroy.io/domain/io-en.support/) | 2026-01-19 | Offline | Dynadot | 
[ledger-download.co.com](https://phishdestroy.io/domain/ledger-download.co.com/) | 2026-01-07 | Offline | Moniker Online Services | 
[download-ledger.us](https://phishdestroy.io/domain/download-ledger.us/) | 2026-01-07 | Offline | Registrar.eu | 
[nft.swisstronik.com](https://phishdestroy.io/domain/nft.swisstronik.com/) | 2025-12-24 | Taken down | GoDaddy.com | 
[imtokm.app](https://phishdestroy.io/domain/imtokm.app/) | 2025-11-29 | Offline | Dynadot | 
[claim-log.top](https://phishdestroy.io/domain/claim-log.top/) | 2025-11-23 | Unknown | NiceNIC | 
[access-portals.top](https://phishdestroy.io/domain/access-portals.top/) | 2025-11-20 | Unknown | NiceNIC | 
[service1connect.live](https://phishdestroy.io/domain/service1connect.live/) | 2025-11-19 | Taken down | Cloudflare | 
[update-rpc.top](https://phishdestroy.io/domain/update-rpc.top/) | 2025-11-09 | Offline | 耐思尼克国际集团有限公司 | 
[rpcs-updates.top](https://phishdestroy.io/domain/rpcs-updates.top/) | 2025-11-07 | Offline | ERANET | 
[lmtakon.com](https://phishdestroy.io/domain/lmtakon.com/) | 2025-10-24 | Taken down | Dynadot | 
[atomic-wallet.fr](https://phishdestroy.io/domain/atomic-wallet.fr/) | 2025-10-15 | Online | Registrar.eu | 
[zkml-launchpad.com](https://phishdestroy.io/domain/zkml-launchpad.com/) | 2025-09-16 | Offline | PublicDomainRegistry.com | 
[airdrop-satlayer.site](https://phishdestroy.io/domain/airdrop-satlayer.site/) | 2025-09-16 | Offline | NameSilo | 

[All 53 Cosmos reports](https://phishdestroy.io/domain/?brand=Cosmos)

## Where they are registered and hosted

### Registrars

- [Dynadot](https://phishdestroy.io/registrar/dynadot/)6
- Cloudflare6
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)3
- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)3
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)3
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)2
- [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)2
- [Registrar.eu](https://phishdestroy.io/registrar/registrar-eu/)2

### Top-level domains

- [.com](https://phishdestroy.io/tld/com/)9
- [.dev](https://phishdestroy.io/tld/dev/)7
- [.top](https://phishdestroy.io/tld/top/)5
- [.shop](https://phishdestroy.io/tld/shop/)4
- [.live](https://phishdestroy.io/tld/live/)3
- [.network](https://phishdestroy.io/tld/network/)2
- [.im](https://phishdestroy.io/tld/im/)2
- [.io](https://phishdestroy.io/tld/io/)2

### Hosting networks

- CLOUDFLARENET, US17
- Cloudflare, Inc.16
- FASTLY, US2
- U1 DIGITAL SERVICES LTD2
- Host Sailor Ltd2
- CLOUDFLARENET - Cloudflare, Inc., US2
- Malakmadze Web LLC2
- Public Cloud Ltd.1

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/)
- [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Cosmos; share of all PhishDestroy reports: 0.02%.

Canonical: https://phishdestroy.io/brand/cosmos/