Phishing sites impersonating Wordpress

PhishDestroy has recorded 455 phishing domains impersonating Wordpress since 2024-03-25, 24 of them in the last 30 days. The most used registrars are HOSTINGER operations and NICENIC; the most common TLDs are .com and .ru. Open Wordpress only from its official app or a saved bookmark.

455
Domains, all time
24
Last 30 days
215
Online at last check
60
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 12026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 12026-08-02: 12026-08-03: 12026-08-04: 02026-08-05: 02026-08-06: 12026-08-07: 02026-08-08: 22026-08-09: 02026-08-10: 02026-08-11: 12026-08-12: 12026-08-13: 02026-08-14: 12026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 22026-08-23: 02026-08-24: 122026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 32026-09-01: 02026-09-02: 02026-09-03: 22026-09-04: 12026-09-05: 32026-09-06: 12026-09-07: 22026-09-08: 22026-09-09: 12026-09-10: 12026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 22026-09-19: 12026-09-20: 12026-09-21: 12026-09-22: 12026-09-23: 22026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 22026-10-08: 02026-10-09: 12026-10-10: 42026-10-11: 72026-10-12: 12026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 12026-10-20: 42026-10-21: 02026-10-22: 2
Wordpress phishing domains detected per day: 70 from 2026-07-25 to 2026-10-22; peak 12.

How to tell a fake Wordpress site

Words most often added to the brand in reported domains: wpenginepowered, wpdevcloud, kulnde, dkev, cloudaccess, jdevcloud, myftpupload, zoom, mybluehost, wallet.

  • Type the address yourself or use a bookmark; phishing links for Wordpress arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Wordpress does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Wordpress phishing domains

The 50 most recently detected domains impersonating Wordpress
DomainFirst detectedStatus at last checkRegistrar
apuestasconlicencia.net2026-10-22OnlineNICENIC
aynenoyle.com2026-10-22OnlineSpaceship
africantraditionalhealing.co.za2026-10-20Online1-Grid
stawki-bet-ua.cz2026-10-20OnlineREG-ASCIO
adatuna.com.tr2026-10-20OnlineÇizgi Telekomünikasyon A.Ş
88vvcom.club2026-10-20OnlineNAMECHEAP
nl-trueluck.net2026-10-19OnlineNICENIC
alturalgo.ai2026-10-12OnlineNameCheap
bursaguzelevdeneve.com2026-10-11OnlineAtak Domain
cdm.life2026-10-11OnlineGoDaddy.com
casadealdeaaraceli.com2026-10-11Online10DENCEHISPAHARD, S.L
chenrenxu.com2026-10-11OnlineDNSPod
dicaconsultores.com2026-10-11OfflineArsys Internet, S.L. dba NICLINE.COM
dato.co.at2026-10-11OnlineRegistryGate ( https://nic.at/registrar/
lonner.name2026-10-11OnlineKey-Systems
getsoft.site2026-10-10OnlinePublicDomainRegistry.com
cysyonetim.com2026-10-10OnlineNics Telekomunikasyon A.S
driventodaypodcast.com2026-10-10OnlineDynadot
242annonces.com2026-10-10OnlineHOSTINGER operations
walletupdate.us2026-10-09OfflineDYNADOT
shiny-wilds-online.net2026-10-07OnlineNICENIC
ally-spin.club2026-10-07OnlineNICENIC
salomas.cv2026-09-23Onlineola.cv
wemajai.pro2026-09-23OnlineNameCheap
brand-x.co.jp2026-09-22Online—
xopytya.pro2026-09-21OnlineNameCheap
alisfortes.com2026-09-20OnlineNameSilo
wuzyree.com2026-09-19OfflineNAMECHEAP
podlahyruzicka.live2026-09-18OnlineDynadot
tokyosanno.com2026-09-18OnlineJapan Registry Services
dikojoi.pro2026-09-10OnlineNameCheap
ayaztiryaki.com2026-09-09OnlineODTU Gelistirme Vakfi Bilgi Teknolojiler
callmechat-live.com2026-09-08OnlineRegister SPA
courier4sameday.com2026-09-08OnlineNameCheap
faxuzeu.com2026-09-07OnlineNAMECHEAP
easycactus.co.uk2026-09-07OfflineNamecheap, t/a Spaceship
onlinepharmaustralia.com2026-09-06OnlineGoDaddy.com
communitydesign.co.jp2026-09-05Online—
get-refunds.top2026-09-05OfflineSpaceship
timbrasil5g.com.br2026-09-05Offline—
chekbot.online2026-09-04OfflineLigne Web Services dba LWS
bluegrassmarketinggroup.com2026-09-03OnlineKey-Systems
berocae.com2026-09-03OnlineNameCheap
jokabet-es.website2026-08-31OnlineNICENIC
nexusdarkweburl.com2026-08-31OnlineDynadot
atacadaorubao.com.br2026-08-31OnlineHSTDOMAINS
superdigitalheroes.net2026-08-24OnlineLWS dba Ligne Web Services
davincisgold-casino.online2026-08-24OnlineNICENIC
ninecasino-italia.site2026-08-24OnlineNICENIC
woospin.website2026-08-24OnlineNICENIC

All 455 Wordpress reports

Where they are registered and hosted

Registrars

  1. HOSTINGER operations129
  2. NICENIC23
  3. NameCheap19
  4. TW-Cloud (ASN: 9123)17
  5. TIMEWEB-RU14
  6. Name SRS14
  7. Spaceship12
  8. PublicDomainRegistry.com11

Top-level domains

  1. .com229
  2. .ru31
  3. .net18
  4. .online12
  5. .host11
  6. .site10
  7. .website9
  8. .pro7

Hosting networks

  1. Hostinger International Limited96
  2. AS-HOSTINGER Hostinger International Limited, CY62
  3. Cloudflare, Inc.34
  4. TimeWeb-AS JSC "TIMEWEB", RU31
  5. CLOUDFLARENET, US14
  6. BALLOU-AS Hostek AB, SE14
  7. CLOUDFLARESPECTRUM Cloudflare London, LLC, US13
  8. CLOUDACCESS-NETWORK, US12

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Wordpress; share of all PhishDestroy reports: 0.20%.