Digitalocean: phishing domains and abuse response

PhishDestroy reported 28 phishing domains registered with Digitalocean between 2026-01-02 and 2026-06-18, sending 28 abuse reports. Median time from the first report until a domain stopped resolving: 19.0 days (n = 13). 9 of 22 domains were still active 90 days after the first report. The database holds 3 Digitalocean domains in total.

28
Domains reported (window)
28
Abuse reports sent
19.0 days
Median time to unavailable
3
In the database now

Abuse-report outcome

Status of the reported domains at the last check of the Registrar Scoreboard dataset (2026-09-09): Live 15 (54%); Offline 13 (46%).

90th percentile time to unavailable: 39.2 days. Response time starts at the first stored report and ends at the first observation that the domain no longer resolved; it is not proof of registrar action.

What is registered there

Impersonated brands

  1. Telegram1

Top-level domains

  1. .live1
  2. .br1
  3. .store1

Most reported domains

  1. 138.197.183.112/admin
  2. 139.59.209.29/admin
  3. 143.110.236.148/admin
  4. 157.230.19.213/admin
  5. 178.62.211.192/admin

Latest Digitalocean phishing domains

The 3 most recently detected domains at Digitalocean
DomainFirst detectedStatus at last checkRegistrar
velmora-live.store2026-03-23OfflineDigitalocean
cms.transfer.com.br2026-03-17OnlineDigitalocean
morpho-o.live2026-01-26OfflineDigitalocean

Related

Sources: Registrar Scoreboard dataset (/assets/data/registrar-accountability.json, reports 2026-01-02 to 2026-06-18) and the PhishDestroy domain-report database, built 2026-10-22. Registrar names are matched to stored registration data on a best-effort basis.