Phishing sites impersonating Ethereum

PhishDestroy has recorded 3,761 phishing domains impersonating Ethereum since 2024-03-19, 135 of them in the last 30 days. The most used registrars are NiceNIC and Cloudflare; the most common TLDs are .com and .dev. The official Ethereum domain is ethereum.org: any other site asking for your login or wallet is not Ethereum.

3,761
Domains, all time
135
Last 30 days
1,461
Online at last check
602
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 362026-07-28: 52026-07-29: 32026-07-30: 72026-07-31: 102026-08-01: 52026-08-02: 22026-08-03: 72026-08-04: 52026-08-05: 42026-08-06: 62026-08-07: 122026-08-08: 52026-08-09: 192026-08-10: 252026-08-11: 32026-08-12: 82026-08-13: 32026-08-14: 52026-08-15: 12026-08-16: 32026-08-17: 12026-08-18: 132026-08-19: 12026-08-20: 62026-08-21: 22026-08-22: 32026-08-23: 62026-08-24: 32026-08-25: 32026-08-26: 22026-08-27: 22026-08-28: 72026-08-29: 32026-08-30: 22026-08-31: 72026-09-01: 02026-09-02: 22026-09-03: 12026-09-04: 12026-09-05: 152026-09-06: 52026-09-07: 82026-09-08: 52026-09-09: 82026-09-10: 22026-09-11: 92026-09-12: 42026-09-13: 42026-09-14: 52026-09-15: 32026-09-16: 02026-09-17: 52026-09-18: 22026-09-19: 42026-09-20: 32026-09-21: 42026-09-22: 22026-09-23: 22026-09-24: 12026-09-25: 12026-09-26: 12026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 12026-10-02: 02026-10-03: 32026-10-04: 32026-10-05: 12026-10-06: 22026-10-07: 222026-10-08: 12026-10-09: 52026-10-10: 22026-10-11: 32026-10-12: 22026-10-13: 142026-10-14: 72026-10-15: 42026-10-16: 62026-10-17: 32026-10-18: 32026-10-19: 132026-10-20: 152026-10-21: 82026-10-22: 11
Ethereum phishing domains detected per day: 461 from 2026-07-25 to 2026-10-22; peak 36.

How to tell a fake Ethereum site

Official domain: ethereum.org.

Words most often added to the brand in reported domains: eth, wallet, gro, claim, typedream, ledger, mixer, duplicate, disabled, casino.

  • Type the address yourself or use a bookmark; phishing links for Ethereum arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Ethereum will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Ethereum phishing domains

The 50 most recently detected domains impersonating Ethereum
DomainFirst detectedStatus at last checkRegistrar
paxgoldstaking.com2026-10-22OnlineOnamae.com
nvdacstaking.com2026-10-22OnlineOnamae.com
ondostaking.com2026-10-22OnlineOnamae.com
kyberswap.cam2026-10-22OnlineDynadot
rainbet-casino.com.ro2026-10-22OnlineNetim
ethlaunch.fun2026-10-22OnlineNICENIC
aurex-trade-ai-poland.sbs2026-10-22OnlineDynadot
aunveldr0k-netherlands.com2026-10-22OnlineDynadot
aunveldr0k-italy.com2026-10-22OnlineDynadot
aunveldr0k-denmark.com2026-10-22OnlineDynadot
ispanyakonsoloslugu.org2026-10-22OfflineURL Solutions
findfundes.icu2026-10-21OnlineEranet
andes-rendivo-italy.com2026-10-21OnlineDynadot
andes-rendivo-france.com2026-10-21OnlineDynadot
sopohn.run2026-10-21OnlineNICENIC
abracdaabramoney.com2026-10-21OnlineNICENIC
aeov.run2026-10-21OnlineNICENIC
aeroupgrade.net2026-10-21OnlineEranet
clickdapp.pro2026-10-21OfflineNameCheap
cakewallets.at2026-10-20OfflineHosting concepts / Registrar.eu ( https:
albioncapitholm-uk.com2026-10-20OnlineDynadot
arexueth.com2026-10-20OnlineSpaceship
pay-bytrust.com2026-10-20OfflineNICENIC
mixersdirectory.com2026-10-20OnlineNICENIC
aiproiplex.org2026-10-20OnlineInternet Domain Service BS
bridge-pulsechains.com2026-10-20OnlineNICENIC
xstockvault.top2026-10-20OnlineNICENIC
admirals-markets.com2026-10-20OnlineNICENIC
wilsinvestment.com2026-10-20OnlineCosmotown
aeroupgrade.pro2026-10-20OnlineEranet
adrianova.pro2026-10-20OnlineDynadot
pulsecoinlist.net2026-10-20OnlineTUCOWS.COM
accrumentor-ai.com2026-10-20OnlineDynadot
abcstudyguide.com2026-10-20OnlineURL Solutions
pulseswap.net2026-10-19OnlineTUCOWS.COM
moonpay-shop.com2026-10-19OnlineENOM
assuredfinanceltd.com2026-10-19OnlineWeb Commerce Communications dba WebNic.c
cryptonchain.online2026-10-19OnlineCosmotown
assurancewealthfx.live2026-10-19OnlineSav.com
slotshubgreece.com2026-10-19OnlineNICENIC
celobit.com2026-10-19OnlineNICENIC
appxvaultxstock.live2026-10-19OnlineNICENIC
adm-international24.com2026-10-19UnknownNICENIC
tokemim-cdn73-hk73.club2026-10-19OnlineDYNADOT
dexgeto.com2026-10-19OnlineEranet
imtokeniee.com2026-10-19OfflineOnamae.com
intokken.com2026-10-19OnlineOnamae.com
upto.exchange2026-10-18OnlineNameCheap
bitstoks.com2026-10-18OnlineCNOBIN INFORMATION TECHNOLOGY
libertycrestfin.com2026-10-18OnlineCosmotown

All 3,761 Ethereum reports

Where they are registered and hosted

Registrars

  1. NiceNIC452
  2. Cloudflare440
  3. NICENIC202
  4. Web Commerce Communications189
  5. NameSilo155
  6. NameCheap133
  7. PublicDomainRegistry.com120
  8. Gname.com92

Top-level domains

  1. .com1,462
  2. .dev339
  3. .io210
  4. .org203
  5. .app198
  6. .net162
  7. .xyz162
  8. .top108

Hosting networks

  1. CLOUDFLARENET, US1,044
  2. Cloudflare, Inc.818
  3. CLOUDFLARENET - Cloudflare, Inc., US308
  4. OVH OVH SAS, FR211
  5. AS-COLOCROSSING, US121
  6. Amazon.com, Inc.103
  7. AMAZON-02, US95
  8. FASTLY, US57

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Ethereum; share of all PhishDestroy reports: 1.67%.