# Phishing sites impersonating Wormhole PhishDestroy has recorded 23 phishing domains impersonating Wormhole since 2025-10-02, 1 of them in the last 30 days. The most used registrars are Cloudflare and NiceNIC; the most common TLDs are .dev and .com. Open Wormhole only from its official app or a saved bookmark. 23Domains, all time 1Last 30 days 9Online at last check 4Confirmed takedowns ## New domains in the last 90 days Wormhole phishing domains detected per day: 2 from 2026-07-25 to 2026-10-22; peak 1. ## How to tell a fake Wormhole site Words most often added to the brand in reported domains: hyperspace, ghost, portelebredge, academy, bridge, meta, wwormhole, mywormihole, wormholesol, mkdocs. - Type the address yourself or use a bookmark; phishing links for Wormhole arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Wormhole does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Wormhole phishing domains The 23 most recently detected domains impersonating Wormhole Domain | First detected | Status at last check | Registrar | [wormhole-swap.com](https://phishdestroy.io/domain/wormhole-swap.com/) | 2026-09-29 | Online | Internet Domain Service BS | [wormhole.xlu.li](https://phishdestroy.io/domain/wormhole.xlu.li/) | 2026-09-20 | Offline | — | [wormhole3-official-website.pages.dev](https://phishdestroy.io/domain/wormhole3-official-website.pages.dev/) | 2026-04-12 | Taken down | Cloudflare | [portalwormhole.pages.dev](https://phishdestroy.io/domain/portalwormhole.pages.dev/) | 2026-04-06 | Offline | Cloudflare | [w-coin-price.pages.dev](https://phishdestroy.io/domain/w-coin-price.pages.dev/) | 2026-04-03 | Online | Cloudflare | [portals-wormhole.xyz](https://phishdestroy.io/domain/portals-wormhole.xyz/) | 2026-03-30 | Online | Dynadot | [users-wormhole.xyz](https://phishdestroy.io/domain/users-wormhole.xyz/) | 2026-03-23 | Online | Dynadot | [isv-global.org](https://phishdestroy.io/domain/isv-global.org/) | 2026-03-21 | Offline | Spaceship | [wormholemainnet-server.online](https://phishdestroy.io/domain/wormholemainnet-server.online/) | 2026-03-02 | Offline | Atak Domain Bilgi Teknolojileri A.Ş | [wormhole-docs.pages.dev](https://phishdestroy.io/domain/wormhole-docs.pages.dev/) | 2026-02-26 | Online | Cloudflare | [wormh0leairdrop.live](https://phishdestroy.io/domain/wormh0leairdrop.live/) | 2026-02-26 | Offline | — | [wormhole-ui.pages.dev](https://phishdestroy.io/domain/wormhole-ui.pages.dev/) | 2026-02-26 | Offline | Cloudflare | [wormhole-mkdocs-ilariae-llms-script.pages.dev](https://phishdestroy.io/domain/wormhole-mkdocs-ilariae-llms-script.pages.dev/) | 2026-02-26 | Offline | Cloudflare | [313b2f9e.wormhole-5sz.pages.dev](https://phishdestroy.io/domain/313b2f9e.wormhole-5sz.pages.dev/) | 2026-02-26 | Taken down | Cloudflare | [wormholesol.pages.dev](https://phishdestroy.io/domain/wormholesol.pages.dev/) | 2026-02-26 | Offline | Cloudflare | [mywormihole.media](https://phishdestroy.io/domain/mywormihole.media/) | 2026-02-22 | Offline | NiceNIC | [meta-wwormhole.com](https://phishdestroy.io/domain/meta-wwormhole.com/) | 2026-02-10 | Unknown | NiceNIC | [wormhole-bridge.carrd.co](https://phishdestroy.io/domain/wormhole-bridge.carrd.co/) | 2026-01-02 | Taken down | MarkMonitor | [vv-wormhole.com](https://phishdestroy.io/domain/vv-wormhole.com/) | 2025-12-18 | Offline | Porkbun | [wormhole-academy-wormhole.vercel.app](https://phishdestroy.io/domain/wormhole-academy-wormhole.vercel.app/) | 2025-12-14 | Online | Vercel | [portelebredge.org](https://phishdestroy.io/domain/portelebredge.org/) | 2025-11-16 | Offline | NameSilo | [wormhole.ghost.io](https://phishdestroy.io/domain/wormhole.ghost.io/) | 2025-10-10 | Taken down | SKYCA-3 (ASN: 54113) | [wormhole.hyperspace.work](https://phishdestroy.io/domain/wormhole.hyperspace.work/) | 2025-10-02 | Online | Cloudflare | [All 23 Wormhole reports](https://phishdestroy.io/domain/?brand=Wormhole) ## Where they are registered and hosted ### Registrars - Cloudflare9 - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)2 - [Dynadot](https://phishdestroy.io/registrar/dynadot/)2 - SKYCA-3 (ASN: 54113)1 - [NameSilo](https://phishdestroy.io/registrar/namesilo/)1 - Vercel1 - [Porkbun](https://phishdestroy.io/registrar/porkbun/)1 - [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)1 ### Top-level domains - [.dev](https://phishdestroy.io/tld/dev/)8 - [.com](https://phishdestroy.io/tld/com/)3 - [.org](https://phishdestroy.io/tld/org/)2 - [.xyz](https://phishdestroy.io/tld/xyz/)2 - [.work](https://phishdestroy.io/tld/work/)1 - [.io](https://phishdestroy.io/tld/io/)1 - [.app](https://phishdestroy.io/tld/app/)1 - [.co](https://phishdestroy.io/tld/co/)1 ### Hosting networks - CLOUDFLARENET, US9 - Cloudflare, Inc.8 - AMAZON-02, US2 - CLOUDFLARENET - Cloudflare, Inc., US2 - OVH SAS1 - IONOS SE1 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Wormhole; share of all PhishDestroy reports: 0.01%. Canonical: https://phishdestroy.io/brand/wormhole/