1API GmbH: phishing domains and abuse response

PhishDestroy reported 32 phishing domains registered with 1API GmbH between 2026-01-02 and 2026-06-18, sending 33 abuse reports. Median time from the first report until a domain stopped resolving: 8.5 days (n = 11). 14 of 25 domains were still active 90 days after the first report. The database holds 587 1API GmbH domains in total.

32
Domains reported (window)
33
Abuse reports sent
8.5 days
Median time to unavailable
587
In the database now

Abuse-report outcome

Status of the reported domains at the last check of the Registrar Scoreboard dataset (2026-09-09): Live 21 (66%); Offline 11 (34%).

90th percentile time to unavailable: 48.2 days. Response time starts at the first stored report and ends at the first observation that the domain no longer resolved; it is not proof of registrar action.

What is registered there

Impersonated brands

  1. Ledger126
  2. Trezor65
  3. Google48
  4. Trezor30
  5. Ledger22
  6. Ethereum15
  7. MetaMask14
  8. Exodus8

Top-level domains

  1. .io449
  2. .com38
  3. .app14
  4. .link12
  5. .gg10
  6. .tc7
  7. .co6
  8. .net5

Most reported domains

  1. b-offer.link/admin
  2. ag-dkb.site44.com
  3. app.securesphereholdings.com
  4. asociacion-felina-argentina.com
  5. bafkreid5akqsjzkofrb2xmhytj3bpeevrvgm3gh2k7v44ucvv2el4m67oe.ipfs.w3s.link

Latest 1API GmbH phishing domains

The 30 most recently detected domains at 1API GmbH
DomainFirst detectedStatus at last checkRegistrar
faydd.com2026-10-11Online1API
almaei-hr.com2026-10-08Online1API
bybgrupoconsultor.com2026-09-27Online1API
sssssksjs.onemob.com2026-09-17Online1API
shor.tf2026-09-17Online1API
myatomicwallet.readme.io2026-09-17Online1API
bridge-trezre.readme.io2026-09-17Online1API
suite-intro.readme.io2026-09-17Online1API
home-suite.readme.io2026-09-17Online1API
public-ensuite.readme.io2026-09-17Online1API
homepage-terzor.readme.io2026-09-17Online1API
index-suite.readme.io2026-09-17Online1API
web-trazerio.readme.io2026-09-17Online1API
io-setup.readme.io2026-09-17Online1API
suites-trezo.readme.io2026-09-17Online1API
startio-trezreio.readme.io2026-09-17Online1API
web-iostart.readme.io2026-09-17Online1API
global-trezer.readme.io2026-09-17Online1API
new-iostart.readme.io2026-09-17Online1API
startio-suit.readme.io2026-09-17Online1API
webiostart.readme.io2026-09-17Online1API
new-startsio.readme.io2026-09-17Online1API
suitesapp-trezo.readme.io2026-09-17Online1API
startio-trezer.readme.io2026-09-17Online1API
trezo-bridgeen.readme.io2026-09-17Online1API
io-suiteapps.readme.io2026-09-17Online1API
ensuite-trezo.readme.io2026-09-17Online1API
startio-trezr.readme.io2026-09-17Online1API
starten-trezrio.readme.io2026-09-17Online1API
eng-trezroio.readme.io2026-09-17Online1API

Related

Sources: Registrar Scoreboard dataset (/assets/data/registrar-accountability.json, reports 2026-01-02 to 2026-06-18) and the PhishDestroy domain-report database, built 2026-10-22. Registrar names are matched to stored registration data on a best-effort basis.