Phishing sites impersonating Wormhole

PhishDestroy has recorded 23 phishing domains impersonating Wormhole since 2025-10-02, 1 of them in the last 30 days. The most used registrars are Cloudflare and NiceNIC; the most common TLDs are .dev and .com. Open Wormhole only from its official app or a saved bookmark.

23
Domains, all time
1
Last 30 days
9
Online at last check
4
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 12026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 12026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Wormhole phishing domains detected per day: 2 from 2026-07-25 to 2026-10-22; peak 1.

How to tell a fake Wormhole site

Words most often added to the brand in reported domains: hyperspace, ghost, portelebredge, academy, bridge, meta, wwormhole, mywormihole, wormholesol, mkdocs.

  • Type the address yourself or use a bookmark; phishing links for Wormhole arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Wormhole does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Wormhole phishing domains

The 23 most recently detected domains impersonating Wormhole
DomainFirst detectedStatus at last checkRegistrar
wormhole-swap.com2026-09-29OnlineInternet Domain Service BS
wormhole.xlu.li2026-09-20Offline—
wormhole3-official-website.pages.dev2026-04-12Taken downCloudflare
portalwormhole.pages.dev2026-04-06OfflineCloudflare
w-coin-price.pages.dev2026-04-03OnlineCloudflare
portals-wormhole.xyz2026-03-30OnlineDynadot
users-wormhole.xyz2026-03-23OnlineDynadot
isv-global.org2026-03-21OfflineSpaceship
wormholemainnet-server.online2026-03-02OfflineAtak Domain Bilgi Teknolojileri A.Ş
wormhole-docs.pages.dev2026-02-26OnlineCloudflare
wormh0leairdrop.live2026-02-26Offline—
wormhole-ui.pages.dev2026-02-26OfflineCloudflare
wormhole-mkdocs-ilariae-llms-script.pages.dev2026-02-26OfflineCloudflare
313b2f9e.wormhole-5sz.pages.dev2026-02-26Taken downCloudflare
wormholesol.pages.dev2026-02-26OfflineCloudflare
mywormihole.media2026-02-22OfflineNiceNIC
meta-wwormhole.com2026-02-10UnknownNiceNIC
wormhole-bridge.carrd.co2026-01-02Taken downMarkMonitor
vv-wormhole.com2025-12-18OfflinePorkbun
wormhole-academy-wormhole.vercel.app2025-12-14OnlineVercel
portelebredge.org2025-11-16OfflineNameSilo
wormhole.ghost.io2025-10-10Taken downSKYCA-3 (ASN: 54113)
wormhole.hyperspace.work2025-10-02OnlineCloudflare

All 23 Wormhole reports

Where they are registered and hosted

Registrars

  1. Cloudflare9
  2. NiceNIC2
  3. Dynadot2
  4. SKYCA-3 (ASN: 54113)1
  5. NameSilo1
  6. Vercel1
  7. Porkbun1
  8. MarkMonitor1

Top-level domains

  1. .dev8
  2. .com3
  3. .org2
  4. .xyz2
  5. .work1
  6. .io1
  7. .app1
  8. .co1

Hosting networks

  1. CLOUDFLARENET, US9
  2. Cloudflare, Inc.8
  3. AMAZON-02, US2
  4. CLOUDFLARENET - Cloudflare, Inc., US2
  5. OVH SAS1
  6. IONOS SE1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Wormhole; share of all PhishDestroy reports: 0.01%.