# Phishing sites impersonating Ethereum PhishDestroy has recorded 3,761 phishing domains impersonating Ethereum since 2024-03-19, 135 of them in the last 30 days. The most used registrars are NiceNIC and Cloudflare; the most common TLDs are .com and .dev. The official Ethereum domain is ethereum.org: any other site asking for your login or wallet is not Ethereum. 3,761Domains, all time 135Last 30 days 1,461Online at last check 602Confirmed takedowns ## New domains in the last 90 days Ethereum phishing domains detected per day: 461 from 2026-07-25 to 2026-10-22; peak 36. ## How to tell a fake Ethereum site Official domain: ethereum.org. Words most often added to the brand in reported domains: eth, wallet, gro, claim, typedream, ledger, mixer, duplicate, disabled, casino. - Type the address yourself or use a bookmark; phishing links for Ethereum arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Ethereum will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Ethereum phishing domains The 50 most recently detected domains impersonating Ethereum Domain | First detected | Status at last check | Registrar | [paxgoldstaking.com](https://phishdestroy.io/domain/paxgoldstaking.com/) | 2026-10-22 | Online | Onamae.com | [nvdacstaking.com](https://phishdestroy.io/domain/nvdacstaking.com/) | 2026-10-22 | Online | Onamae.com | [ondostaking.com](https://phishdestroy.io/domain/ondostaking.com/) | 2026-10-22 | Online | Onamae.com | [kyberswap.cam](https://phishdestroy.io/domain/kyberswap.cam/) | 2026-10-22 | Online | Dynadot | [rainbet-casino.com.ro](https://phishdestroy.io/domain/rainbet-casino.com.ro/) | 2026-10-22 | Online | Netim | [ethlaunch.fun](https://phishdestroy.io/domain/ethlaunch.fun/) | 2026-10-22 | Online | NICENIC | [aurex-trade-ai-poland.sbs](https://phishdestroy.io/domain/aurex-trade-ai-poland.sbs/) | 2026-10-22 | Online | Dynadot | [aunveldr0k-netherlands.com](https://phishdestroy.io/domain/aunveldr0k-netherlands.com/) | 2026-10-22 | Online | Dynadot | [aunveldr0k-italy.com](https://phishdestroy.io/domain/aunveldr0k-italy.com/) | 2026-10-22 | Online | Dynadot | [aunveldr0k-denmark.com](https://phishdestroy.io/domain/aunveldr0k-denmark.com/) | 2026-10-22 | Online | Dynadot | [ispanyakonsoloslugu.org](https://phishdestroy.io/domain/ispanyakonsoloslugu.org/) | 2026-10-22 | Offline | URL Solutions | [findfundes.icu](https://phishdestroy.io/domain/findfundes.icu/) | 2026-10-21 | Online | Eranet | [andes-rendivo-italy.com](https://phishdestroy.io/domain/andes-rendivo-italy.com/) | 2026-10-21 | Online | Dynadot | [andes-rendivo-france.com](https://phishdestroy.io/domain/andes-rendivo-france.com/) | 2026-10-21 | Online | Dynadot | [sopohn.run](https://phishdestroy.io/domain/sopohn.run/) | 2026-10-21 | Online | NICENIC | [abracdaabramoney.com](https://phishdestroy.io/domain/abracdaabramoney.com/) | 2026-10-21 | Online | NICENIC | [aeov.run](https://phishdestroy.io/domain/aeov.run/) | 2026-10-21 | Online | NICENIC | [aeroupgrade.net](https://phishdestroy.io/domain/aeroupgrade.net/) | 2026-10-21 | Online | Eranet | [clickdapp.pro](https://phishdestroy.io/domain/clickdapp.pro/) | 2026-10-21 | Offline | NameCheap | [cakewallets.at](https://phishdestroy.io/domain/cakewallets.at/) | 2026-10-20 | Offline | Hosting concepts / Registrar.eu ( https: | [albioncapitholm-uk.com](https://phishdestroy.io/domain/albioncapitholm-uk.com/) | 2026-10-20 | Online | Dynadot | [arexueth.com](https://phishdestroy.io/domain/arexueth.com/) | 2026-10-20 | Online | Spaceship | [pay-bytrust.com](https://phishdestroy.io/domain/pay-bytrust.com/) | 2026-10-20 | Offline | NICENIC | [mixersdirectory.com](https://phishdestroy.io/domain/mixersdirectory.com/) | 2026-10-20 | Online | NICENIC | [aiproiplex.org](https://phishdestroy.io/domain/aiproiplex.org/) | 2026-10-20 | Online | Internet Domain Service BS | [bridge-pulsechains.com](https://phishdestroy.io/domain/bridge-pulsechains.com/) | 2026-10-20 | Online | NICENIC | [xstockvault.top](https://phishdestroy.io/domain/xstockvault.top/) | 2026-10-20 | Online | NICENIC | [admirals-markets.com](https://phishdestroy.io/domain/admirals-markets.com/) | 2026-10-20 | Online | NICENIC | [wilsinvestment.com](https://phishdestroy.io/domain/wilsinvestment.com/) | 2026-10-20 | Online | Cosmotown | [aeroupgrade.pro](https://phishdestroy.io/domain/aeroupgrade.pro/) | 2026-10-20 | Online | Eranet | [adrianova.pro](https://phishdestroy.io/domain/adrianova.pro/) | 2026-10-20 | Online | Dynadot | [pulsecoinlist.net](https://phishdestroy.io/domain/pulsecoinlist.net/) | 2026-10-20 | Online | TUCOWS.COM | [accrumentor-ai.com](https://phishdestroy.io/domain/accrumentor-ai.com/) | 2026-10-20 | Online | Dynadot | [abcstudyguide.com](https://phishdestroy.io/domain/abcstudyguide.com/) | 2026-10-20 | Online | URL Solutions | [pulseswap.net](https://phishdestroy.io/domain/pulseswap.net/) | 2026-10-19 | Online | TUCOWS.COM | [moonpay-shop.com](https://phishdestroy.io/domain/moonpay-shop.com/) | 2026-10-19 | Online | ENOM | [assuredfinanceltd.com](https://phishdestroy.io/domain/assuredfinanceltd.com/) | 2026-10-19 | Online | Web Commerce Communications dba WebNic.c | [cryptonchain.online](https://phishdestroy.io/domain/cryptonchain.online/) | 2026-10-19 | Online | Cosmotown | [assurancewealthfx.live](https://phishdestroy.io/domain/assurancewealthfx.live/) | 2026-10-19 | Online | Sav.com | [slotshubgreece.com](https://phishdestroy.io/domain/slotshubgreece.com/) | 2026-10-19 | Online | NICENIC | [celobit.com](https://phishdestroy.io/domain/celobit.com/) | 2026-10-19 | Online | NICENIC | [appxvaultxstock.live](https://phishdestroy.io/domain/appxvaultxstock.live/) | 2026-10-19 | Online | NICENIC | [adm-international24.com](https://phishdestroy.io/domain/adm-international24.com/) | 2026-10-19 | Unknown | NICENIC | [tokemim-cdn73-hk73.club](https://phishdestroy.io/domain/tokemim-cdn73-hk73.club/) | 2026-10-19 | Online | DYNADOT | [dexgeto.com](https://phishdestroy.io/domain/dexgeto.com/) | 2026-10-19 | Online | Eranet | [imtokeniee.com](https://phishdestroy.io/domain/imtokeniee.com/) | 2026-10-19 | Offline | Onamae.com | [intokken.com](https://phishdestroy.io/domain/intokken.com/) | 2026-10-19 | Online | Onamae.com | [upto.exchange](https://phishdestroy.io/domain/upto.exchange/) | 2026-10-18 | Online | NameCheap | [bitstoks.com](https://phishdestroy.io/domain/bitstoks.com/) | 2026-10-18 | Online | CNOBIN INFORMATION TECHNOLOGY | [libertycrestfin.com](https://phishdestroy.io/domain/libertycrestfin.com/) | 2026-10-18 | Online | Cosmotown | [All 3,761 Ethereum reports](https://phishdestroy.io/domain/?brand=Ethereum) ## Where they are registered and hosted ### Registrars - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)452 - Cloudflare440 - [NICENIC](https://phishdestroy.io/registrar/nicenic/)202 - [Web Commerce Communications](https://phishdestroy.io/registrar/webnic/)189 - [NameSilo](https://phishdestroy.io/registrar/namesilo/)155 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)133 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)120 - [Gname.com](https://phishdestroy.io/registrar/name-com/)92 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)1,462 - [.dev](https://phishdestroy.io/tld/dev/)339 - [.io](https://phishdestroy.io/tld/io/)210 - [.org](https://phishdestroy.io/tld/org/)203 - [.app](https://phishdestroy.io/tld/app/)198 - [.net](https://phishdestroy.io/tld/net/)162 - [.xyz](https://phishdestroy.io/tld/xyz/)162 - [.top](https://phishdestroy.io/tld/top/)108 ### Hosting networks - CLOUDFLARENET, US1,044 - Cloudflare, Inc.818 - CLOUDFLARENET - Cloudflare, Inc., US308 - OVH OVH SAS, FR211 - AS-COLOCROSSING, US121 - Amazon.com, Inc.103 - AMAZON-02, US95 - FASTLY, US57 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/) - [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Ethereum; share of all PhishDestroy reports: 1.67%. Canonical: https://phishdestroy.io/brand/ethereum/