MarkMonitor: phishing domains and abuse response

PhishDestroy reported 171 phishing domains registered with MarkMonitor between 2026-01-02 and 2026-06-18, sending 174 abuse reports. Median time from the first report until a domain stopped resolving: 24.6 days (n = 95). 23 of 117 domains were still active 90 days after the first report. The database holds 2,711 MarkMonitor domains in total.

171
Domains reported (window)
174
Abuse reports sent
24.6 days
Median time to unavailable
2,711
In the database now

Abuse-report outcome

Status of the reported domains at the last check of the Registrar Scoreboard dataset (2026-09-09): Offline 86 (50%); Live 76 (44%); Suspended 9 (5%).

90th percentile time to unavailable: 43.8 days. Response time starts at the first stored report and ends at the first observation that the domain no longer resolved; it is not proof of registrar action.

What is registered there

Impersonated brands

  1. MetaMask217
  2. Trezor212
  3. Coinbase207
  4. Kraken159
  5. Ledger110
  6. KuCoin92
  7. Microsoft77
  8. Phantom60

Top-level domains

  1. .io1,078
  2. .com844
  3. .site270
  4. .dev94
  5. .app64
  6. .net50
  7. .be12
  8. .in11

Most reported domains

  1. franklinturtle.com
  2. phantomeextensionn.blogspot.fi
  3. 0000-wispy-dust-1495.fly.dev
  4. accurate-lime-2lmw3rvzhq-hbcfcgodx5.edgeone.dev
  5. ack.securebankinggroup.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a

Latest MarkMonitor phishing domains

The 30 most recently detected domains at MarkMonitor
DomainFirst detectedStatus at last checkRegistrar
your-trustwallet.is-not-certified.com2026-10-19UnknownMarkMonitor
eu.webservices.asia2026-10-19OfflineMarkMonitor
onedrive.at-us.therelayservice.com2026-10-06OfflineMarkMonitor
uniswaplendwap.top2026-09-25OnlineMarkMonitor
chameleon-dpjy42k5uyg7.edgeone.dev2026-09-23OnlineMarkMonitor
schoolcord-dpt53h5jqo4b.edgeone.dev2026-09-22OnlineMarkMonitor
bahyamediasitustox-dptg601qh8fp.edgeone.dev2026-09-22OnlineMarkMonitor
fil-eggen-dpt6n0jn28p0.edgeone.dev2026-09-21OnlineMarkMonitor
xminesserversaqwq.edgeone.dev2026-09-20OnlineMarkMonitor
outlook.webaccess-alert.com2026-09-19OfflineMarkMonitor
feminist-brown-plkm1dgi.edgeone.dev2026-09-19OnlineMarkMonitor
kkkksgsgdfdjfdhhfdhlhdflhxkkkk-dpxklwputyu8.edgeone.dev2026-09-18OnlineMarkMonitor
xfinity-updateform.square.site2026-09-17OnlineMarkMonitor
treshs-ddlh-3f916985f3fc.herokuapp.com2026-09-17OfflineMarkMonitor
firelight-voting-allocations.web.app2026-09-17OnlineMarkMonitor
firelight-voting.web.app2026-09-17OnlineMarkMonitor
hopium.web.app2026-09-17OnlineMarkMonitor
thesamenft.web.app2026-09-17OnlineMarkMonitor
firelight-voting-reward.web.app2026-09-17OnlineMarkMonitor
voucher.tinylinks.click2026-09-17OfflineMarkMonitor
checkingyourskymail-101970.square.site2026-09-17OnlineMarkMonitor
duubaiiimuseumm.webflow.io2026-09-16OfflineMarkMonitor
tussaudsdubai----madame.webflow.io2026-09-16OfflineMarkMonitor
maadame---tusssauds-duubai.webflow.io2026-09-16OfflineMarkMonitor
jdbdkdbsosu.blogspot.com2026-09-16OnlineMarkMonitor
bifrostwallethub.web.app2026-09-15OnlineMarkMonitor
showroom.ebaymotorspro.co.uk2026-09-15OnlineMarkmonitor
loginsecurde4-dpqom26teqv9.edgeone.dev2026-09-15OnlineMarkMonitor
teletechdigital.webflow.io2026-09-15OfflineMarkMonitor
ledger-deskto-support.square.site2026-09-14OnlineMarkMonitor

Related

Sources: Registrar Scoreboard dataset (/assets/data/registrar-accountability.json, reports 2026-01-02 to 2026-06-18) and the PhishDestroy domain-report database, built 2026-10-22. Registrar names are matched to stored registration data on a best-effort basis.