# Phishing domains under .ai

.ai accounts for 809 of the 224,866 domains in the PhishDestroy database (0.36%), with 15 new ones in the last 30 days. The most impersonated brand under .ai is Coinbase. 132 were online at the last check and 484 have a confirmed takedown.

809Reported .ai domains

0.36%Share of PhishDestroy reports

15Last 30 days

484Confirmed takedowns

## Detections per month

.ai phishing domains detected per month: 794 from 2025-11 to 2026-10; peak 347.

## Brands and registrars

### Impersonated brands

- [Coinbase](https://phishdestroy.io/brand/coinbase/)148
- [Trezor](https://phishdestroy.io/brand/trezor/)132
- [MetaMask](https://phishdestroy.io/brand/metamask/)81
- [Kraken](https://phishdestroy.io/brand/kraken/)69
- [Ledger](https://phishdestroy.io/brand/ledger/)40
- [Sui](https://phishdestroy.io/brand/sui/)32
- [Rabby](https://phishdestroy.io/brand/rabby/)15
- [Phantom](https://phishdestroy.io/brand/phantom/)13

### Registrars

- CSC Corporate Domains612
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)45
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)38
- Framer16
- [NAMECHEAP](https://phishdestroy.io/registrar/namecheap/)10
- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)9
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)6
- Cloudflare6

## Latest .ai phishing domains

The 30 most recently detected .ai domains
Domain | First detected | Status at last check | Registrar | 
[autopilot.truefinance.ai](https://phishdestroy.io/domain/autopilot.truefinance.ai/) | 2026-10-22 | Online | GoDaddy.com | 
[app.oct24.ai](https://phishdestroy.io/domain/app.oct24.ai/) | 2026-10-16 | Online | NameCheap | 
[alturalgo.ai](https://phishdestroy.io/domain/alturalgo.ai/) | 2026-10-12 | Online | NameCheap | 
[engsuitesapp.framer.ai](https://phishdestroy.io/domain/engsuitesapp.framer.ai/) | 2026-10-10 | Offline | CSC Corporate Domains | 
[web-iostrt-trezr-cloud.framer.ai](https://phishdestroy.io/domain/web-iostrt-trezr-cloud.framer.ai/) | 2026-10-10 | Offline | CSC Corporate Domains | 
[en-trezor-io-start-setup.framer.ai](https://phishdestroy.io/domain/en-trezor-io-start-setup.framer.ai/) | 2026-10-10 | Offline | CSC Corporate Domains | 
[auth-spectrum-net-login1.framer.ai](https://phishdestroy.io/domain/auth-spectrum-net-login1.framer.ai/) | 2026-10-10 | Online | CSC Corporate Domains | 
[fxtrad.ai](https://phishdestroy.io/domain/fxtrad.ai/) | 2026-10-09 | Online | GNAME.COM | 
[live-ledgrapp.relumesite.ai](https://phishdestroy.io/domain/live-ledgrapp.relumesite.ai/) | 2026-10-08 | Online | Cloudflare | 
[yldx.ai](https://phishdestroy.io/domain/yldx.ai/) | 2026-10-08 | Online | GoDaddy.com | 
[web-log-en-trezur.framer.ai](https://phishdestroy.io/domain/web-log-en-trezur.framer.ai/) | 2026-09-27 | Offline | CSC Corporate Domains | 
[wormgpt.ai](https://phishdestroy.io/domain/wormgpt.ai/) | 2026-09-26 | Online | HOSTINGER operations | 
[demo.mosci.ai](https://phishdestroy.io/domain/demo.mosci.ai/) | 2026-09-25 | Online | NAMECHEAP | 
[att.balto.ai](https://phishdestroy.io/domain/att.balto.ai/) | 2026-09-23 | Online | GoDaddy.com | 
[onlineupholdio.framer.ai](https://phishdestroy.io/domain/onlineupholdio.framer.ai/) | 2026-09-22 | Online | CSC Corporate Domains | 
[newsbank.ai](https://phishdestroy.io/domain/newsbank.ai/) | 2026-09-21 | Online | Dreamscape Networks | 
[clashx.ai](https://phishdestroy.io/domain/clashx.ai/) | 2026-09-19 | Offline | NAMECHEAP | 
[apps-logon-ndaxcdn.framer.ai](https://phishdestroy.io/domain/apps-logon-ndaxcdn.framer.ai/) | 2026-09-19 | Offline | CSC Corporate Domains | 
[public-trezario.framer.ai](https://phishdestroy.io/domain/public-trezario.framer.ai/) | 2026-09-12 | Offline | CSC Corporate Domains | 
[cloude.ai](https://phishdestroy.io/domain/cloude.ai/) | 2026-09-11 | Online | Dynadot | 
[gvtc-auth.framer.ai](https://phishdestroy.io/domain/gvtc-auth.framer.ai/) | 2026-09-07 | Offline | CSC Corporate Domains | 
[icomarks.ai](https://phishdestroy.io/domain/icomarks.ai/) | 2026-09-07 | Online | GoDaddy.com | 
[dashboard.sirenai.ai](https://phishdestroy.io/domain/dashboard.sirenai.ai/) | 2026-09-06 | Offline | HOSTINGER operations | 
[web3o.ai](https://phishdestroy.io/domain/web3o.ai/) | 2026-09-04 | Offline | GNAME.COM | 
[unikyber.ai](https://phishdestroy.io/domain/unikyber.ai/) | 2026-09-04 | Online | Cloudflare | 
[osarc.ai](https://phishdestroy.io/domain/osarc.ai/) | 2026-09-02 | Online | InternetX | 
[video.gemini-omni.ai](https://phishdestroy.io/domain/video.gemini-omni.ai/) | 2026-09-01 | Offline | Spaceship | 
[momentum.mytessera.ai](https://phishdestroy.io/domain/momentum.mytessera.ai/) | 2026-08-31 | Online | NAMECHEAP | 
[decibels.ai](https://phishdestroy.io/domain/decibels.ai/) | 2026-08-28 | Offline | NAMECHEAP | 
[metamasks.ai](https://phishdestroy.io/domain/metamasks.ai/) | 2026-08-26 | Online | GoDaddy.com | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .ai registrations; first .ai report 2025-08-03.

Canonical: https://phishdestroy.io/tld/ai/