Phishing sites impersonating Signal

PhishDestroy has recorded 136 phishing domains impersonating Signal since 2025-08-12, 40 of them in the last 30 days. The most used registrars are Dynadot and NiceNIC; the most common TLDs are .com and .net. Open Signal only from its official app or a saved bookmark.

136
Domains, all time
40
Last 30 days
92
Online at last check
17
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 42026-08-05: 02026-08-06: 22026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 12026-08-11: 02026-08-12: 02026-08-13: 22026-08-14: 12026-08-15: 02026-08-16: 12026-08-17: 12026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 12026-08-25: 12026-08-26: 02026-08-27: 12026-08-28: 02026-08-29: 12026-08-30: 02026-08-31: 32026-09-01: 12026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 22026-09-06: 12026-09-07: 22026-09-08: 02026-09-09: 22026-09-10: 02026-09-11: 12026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 12026-09-23: 02026-09-24: 12026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 12026-10-08: 02026-10-09: 22026-10-10: 12026-10-11: 12026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 12026-10-17: 12026-10-18: 02026-10-19: 42026-10-20: 152026-10-21: 72026-10-22: 6
Signal phishing domains detected per day: 69 from 2026-07-25 to 2026-10-22; peak 15.

How to tell a fake Signal site

Words most often added to the brand in reported domains: moonbirds, jailed, ellonxia, alphatrack, builltt, vote, jaileddotfun, jailedotfun, bridge, duplicate.

  • Type the address yourself or use a bookmark; phishing links for Signal arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Signal does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Signal phishing domains

The 50 most recently detected domains impersonating Signal
DomainFirst detectedStatus at last checkRegistrar
autotradenexus.net2026-10-22OnlineDynadot
auronixpro.net2026-10-22OnlineDynadot
autovestiqo.de2026-10-22Online—
aurefondaise.com2026-10-22OnlineDynadot
aurorarendivo.net2026-10-22OnlineDynadot
auraxcore92.org2026-10-22OnlineDynadot
apexwave.org2026-10-21OnlineDynadot
apexcapitalstrade.com2026-10-21OnlineDynadot
easymorsecode.com2026-10-21OnlineGransy, s.r.o
anycredit.net2026-10-21OnlineDynadot
anresources.net2026-10-21OnlineDynadot
amselquarz.com2026-10-21OnlineDynadot
ampleeparature.com2026-10-21OnlineDynadot
altapayvale.com2026-10-20OnlineDynadot
tempswg.sbs2026-10-20OnlineNICENIC
africapitalai.net2026-10-20OnlineDynadot
aivextrade.net2026-10-20OnlineDynadot
aiprojectinvest.net2026-10-20OnlineDynadot
aiprofitengine.org2026-10-20OnlineDynadot
ailukaiacademy.net2026-10-20OnlineDynadot
aiincomeenginepro.com2026-10-20OnlineDynadot
aiavenuetrade.com2026-10-20OnlineDynadot
aftynepaxai.com2026-10-20OfflineDynadot
afrilegacyai.com2026-10-20OnlineDynadot
aethertradetrade.com2026-10-20OnlineDynadot
adriatradeai.net2026-10-20OnlineDynadot
adani-one.com2026-10-20OnlineDynadot
acerwansa.com2026-10-20OnlineDynadot
4xblue.net2026-10-19OnlineDYNADOT
1kdailyprofit.net2026-10-19OnlineDYNADOT
24autotrade.org2026-10-19OnlineDYNADOT
io-bridge.io2026-10-19OnlineMegazone , dba HOSTING.KR
blockshoptextileshome.shop2026-10-17OnlineDynadot
blackdeckershop.shop2026-10-16OnlineDynadot
battlbox.shop2026-10-11OnlineDynadot
fixedfloat-eu.org2026-10-10OnlineRegistrar.eu
xtradegrok-36-ai.org2026-10-09OnlineDynadot
xonuruzirule.com2026-10-09OnlineDynadot
localfiberinternet.com2026-10-07OnlineGoDaddy.com
sc-capitals.com2026-09-24OnlinePublicDomainRegistry.com
tlcrestholdings.com2026-09-22OfflineCosmotown
teslaxcapital.veliroz.us2026-09-11OfflineDynadot
aethlabs.shop2026-09-09OnlineDynadot
trumpnatorprime.projectlunarx.com2026-09-09OnlineIONOS SE
ferveurplacoire.net2026-09-07OnlineDynadot
flourishing-vacherin-21c5e5.netlify.app2026-09-07OnlineNetlify
platform-x.trade2026-09-06OnlineCloudflare
olelife009.top2026-09-05UnknownNICENIC
vantageorigins.com2026-09-05OfflineCosmotown
plan-b-net-zero.com2026-09-01OnlineDynadot

All 136 Signal reports

Where they are registered and hosted

Registrars

  1. Dynadot32
  2. NiceNIC15
  3. Cloudflare6
  4. HOSTINGER operations6
  5. NICENIC6
  6. NameCheap5
  7. PublicDomainRegistry.com5
  8. Trustname.com5

Top-level domains

  1. .com55
  2. .net15
  3. .org9
  4. .app8
  5. .live5
  6. .cc5
  7. .shop4
  8. .io3

Hosting networks

  1. Cloudflare, Inc.33
  2. Omegatech LTD23
  3. CLOUDFLARENET, US12
  4. AS-COLOCROSSING, US9
  5. CLOUDFLARENET - Cloudflare, Inc., US4
  6. Amazon.com, Inc.4
  7. Malakmadze Web LLC4
  8. OMEGATECH-AS Omegatech LTD, SC4

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Signal; share of all PhishDestroy reports: 0.06%.