Phishing sites impersonating Slack

PhishDestroy has recorded 20 phishing domains impersonating Slack since 2025-09-12, 3 of them in the last 30 days. The most used registrars are Cloudflare and NiceNIC; the most common TLDs are .com and .top. Open Slack only from its official app or a saved bookmark.

20
Domains, all time
3
Last 30 days
13
Online at last check
10
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 12026-10-20: 12026-10-21: 02026-10-22: 1
Slack phishing domains detected per day: 3 from 2026-07-25 to 2026-10-22; peak 1.

How to tell a fake Slack site

Words most often added to the brand in reported domains: claim, rpc, drops, portal, spacexneurastocks, cloudinfolibrary, token, updates, update, proc.

  • Type the address yourself or use a bookmark; phishing links for Slack arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Slack does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Slack phishing domains

The 20 most recently detected domains impersonating Slack
DomainFirst detectedStatus at last checkRegistrar
status.com-polybet-q05.com2026-10-22OnlineNICENIC
richaxisholdings.com2026-10-20UnknownUltahost
corvegrepay.com2026-10-19OnlineNICENIC
waaako.net2026-02-08Taken downNameCheap
access-portal.top2026-02-08UnknownNiceNIC
dropsteams.top2026-01-30UnknownNiceNIC
redtron.info2026-01-24Taken downOnamae.com
reworkdapzz.top2026-01-02Taken down耐思尼克国际集团有限公司
drops-acess.top2025-12-23Online耐思尼克国际集团有限公司
yayforms.link2025-12-23Taken downNameCheap
elevenslauncher.com2025-12-21Taken downNameCheap
drop-portal.top2025-12-18OnlineNiceNIC
gateway.ipfs.io2025-12-14Taken downCSC Corporate Domains
drops-streams.top2025-12-12UnknownNiceNIC
claim-proc.pages.dev2025-12-01Taken downCloudflare
update-rpc.live2025-11-29Taken downCloudflare
rpc-updates.live2025-11-27Taken downCloudflare
claim-token.live2025-11-26OfflineCloudflare
cloudinfolibrary.com2025-11-19Taken downGoDaddy.com
spacexneurastocks.com2025-09-12OfflineNameSilo

All 20 Slack reports

Where they are registered and hosted

Registrars

  1. Cloudflare4
  2. NiceNIC4
  3. NameCheap3
  4. 耐思尼克国际集团有限公司2
  5. NICENIC2
  6. NameSilo1
  7. GoDaddy.com1
  8. CSC Corporate Domains1

Top-level domains

  1. .com6
  2. .top6
  3. .live3
  4. .dev1
  5. .io1
  6. .link1
  7. .info1
  8. .net1

Hosting networks

  1. CLOUDFLARENET, US11
  2. CLOUDFLARENET - Cloudflare, Inc., US4
  3. HOSTWINDS, US1
  4. FASTLY, US1
  5. Cloudflare, Inc.1
  6. Femo IT Solutions Limited1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Slack; share of all PhishDestroy reports: 0.01%.