Phishing domains under .app

.app accounts for 14,317 of the 224,866 domains in the PhishDestroy database (6.37%), with 176 new ones in the last 30 days. The most impersonated brand under .app is MetaMask. 6,565 were online at the last check and 2,641 have a confirmed takedown.

14,317
Reported .app domains
6.37%
Share of PhishDestroy reports
176
Last 30 days
2,641
Confirmed takedowns

Detections per month

2025-11: 5772025-12: 9892026-01: 3142026-02: 27622026-03: 9302026-04: 9032026-05: 4232026-06: 16742026-07: 14172026-08: 24152026-09: 8332026-10: 148
.app phishing domains detected per month: 13,385 from 2025-11 to 2026-10; peak 2,762.

Brands and registrars

Impersonated brands

  1. MetaMask802
  2. Trezor692
  3. Google486
  4. Moonshot389
  5. Coinbase353
  6. Ledger349
  7. OpenSea294
  8. Solana260

Registrars

  1. Netlify2,167
  2. Vercel1,707
  3. Tucows Domains1,672
  4. Vercel1,633
  5. Squarespace Domains II642
  6. NiceNIC628
  7. Typedream616
  8. Cloudflare586

Latest .app phishing domains

The 30 most recently detected .app domains
DomainFirst detectedStatus at last checkRegistrar
penguinsegg.app2026-10-22OnlineNICENIC
overview--en--trzer-en.typedream.app2026-10-22UnknownSquarespace Domains II
getpikashow.app2026-10-21OnlineSpaceship
xaman-dashboard.app2026-10-21OfflineNameSilo
hyperecosystems.app2026-10-21OnlineNICENIC
amlradar.app2026-10-20OnlineKey-Systems
app.poseidondata.app2026-10-20OnlineNamecheap
dashboard-cake.app2026-10-20OnlineNICENIC
dashboard-curve.app2026-10-20OnlineNICENIC
web-netcoins-login-doc.typedream.app2026-10-20Online—
dow-nload-ledger-live--doc.typedream.app2026-10-20Online—
access-divace-bridge.typedream.app2026-10-20Online—
gametweak.app2026-10-19OnlineNamecheap
quantaai.app2026-10-19OnlineCloudFlare
bitmix.app2026-10-19OnlineNICENIC
anniversary-xaman.app2026-10-19OnlineDynadot
ledger-live-download-auth-co.typedream.app2026-10-19Online—
secondfi-desktop.app2026-10-19OnlineNICENIC
tiers-velit.app2026-10-19OnlineNICENIC
get-zksync.app2026-10-19OnlineNICENIC
claim-bybit.app2026-10-19OnlineNICENIC
claim-soniclabs.app2026-10-19OnlineNICENIC
dashboard-robin.app2026-10-19OnlineNICENIC
get-cashcat.app2026-10-19OnlineNICENIC
get-symbiosis.app2026-10-19OnlineNICENIC
paperstrade.app2026-10-19OnlineNICENIC
safe-ldgreliveapp.typedream.app2026-10-19Online—
support--legderlive--us--learn.typedream.app2026-10-19OnlineSquarespace Domains II
ledger-com-start-sso-start-web.typedream.app2026-10-17Offline—
ledger-live-donload-web.typedream.app2026-10-17Offline—

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .app registrations; first .app report 2024-03-20.