# Phishing domains under .cloud

.cloud accounts for 366 of the 224,866 domains in the PhishDestroy database (0.16%), with 12 new ones in the last 30 days. The most impersonated brand under .cloud is MetaMask. 117 were online at the last check and 20 have a confirmed takedown.

366Reported .cloud domains

0.16%Share of PhishDestroy reports

12Last 30 days

20Confirmed takedowns

## Detections per month

.cloud phishing domains detected per month: 301 from 2025-11 to 2026-10; peak 70.

## Brands and registrars

### Impersonated brands

- [MetaMask](https://phishdestroy.io/brand/metamask/)32
- [Apple](https://phishdestroy.io/brand/apple/)14
- [PancakeSwap](https://phishdestroy.io/brand/pancakeswap/)11
- [Jupiter](https://phishdestroy.io/brand/jupiter/)10
- [Dpd](https://phishdestroy.io/brand/dpd/)10
- [Ledger](https://phishdestroy.io/brand/ledger/)8
- [Aave](https://phishdestroy.io/brand/aave/)6
- [Wordpress](https://phishdestroy.io/brand/wordpress/)6

### Registrars

- [HOSTINGER operations](https://phishdestroy.io/registrar/hostinger/)74
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)66
- [Web Commerce Communications](https://phishdestroy.io/registrar/webnic/)51
- [Dominet (HK)](https://phishdestroy.io/registrar/dominet/)15
- [Gname.com](https://phishdestroy.io/registrar/name-com/)12
- [GoDaddy](https://phishdestroy.io/registrar/godaddy/)12
- [NAMECHEAP](https://phishdestroy.io/registrar/namecheap/)12
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)10

## Latest .cloud phishing domains

The 30 most recently detected .cloud domains
Domain | First detected | Status at last check | Registrar | 
[rabbyweb.cloud](https://phishdestroy.io/domain/rabbyweb.cloud/) | 2026-10-21 | Online | Dynadot | 
[us05.cloud](https://phishdestroy.io/domain/us05.cloud/) | 2026-10-20 | Online | NAMECHEAP | 
[zcontainx.cloud](https://phishdestroy.io/domain/zcontainx.cloud/) | 2026-10-20 | Online | Dominet (HK) | 
[com-gateway-api-gateway-dex-app.cloud](https://phishdestroy.io/domain/com-gateway-api-gateway-dex-app.cloud/) | 2026-10-16 | Online | Web Commerce Communications | 
[com-v3-swap-portal-gateway.cloud](https://phishdestroy.io/domain/com-v3-swap-portal-gateway.cloud/) | 2026-10-14 | Online | Web Commerce Communications | 
[bill.you-track.cloud](https://phishdestroy.io/domain/bill.you-track.cloud/) | 2026-10-13 | Online | Tucows Domains | 
[trustwalletpay.cloud](https://phishdestroy.io/domain/trustwalletpay.cloud/) | 2026-10-11 | Online | HOSTINGER operations | 
[onchnia.cloud](https://phishdestroy.io/domain/onchnia.cloud/) | 2026-10-09 | Online | Gname.com | 
[phantom.larpshop.cloud](https://phishdestroy.io/domain/phantom.larpshop.cloud/) | 2026-10-09 | Offline | OVH | 
[trajetoprime.cloud](https://phishdestroy.io/domain/trajetoprime.cloud/) | 2026-10-07 | Unknown | NICENIC | 
[certs.armt.cloud](https://phishdestroy.io/domain/certs.armt.cloud/) | 2026-09-27 | Online | NAMECHEAP | 
[aurex.cloud](https://phishdestroy.io/domain/aurex.cloud/) | 2026-09-25 | Online | NAMECHEAP | 
[uuss6s.cloud](https://phishdestroy.io/domain/uuss6s.cloud/) | 2026-09-18 | Online | Alibaba Cloud Computing | 
[daz3d.cloud](https://phishdestroy.io/domain/daz3d.cloud/) | 2026-09-14 | Unknown | NICENIC | 
[lzdocanalyzer.cloud](https://phishdestroy.io/domain/lzdocanalyzer.cloud/) | 2026-09-11 | Online | NAMECHEAP | 
[matanga.cloud](https://phishdestroy.io/domain/matanga.cloud/) | 2026-09-08 | Online | NICENIC | 
[orium.cloud](https://phishdestroy.io/domain/orium.cloud/) | 2026-09-05 | Online | Trustname.com | 
[bitoq.cloud](https://phishdestroy.io/domain/bitoq.cloud/) | 2026-09-04 | Offline | Gname.com | 
[rojadirecta.cloud](https://phishdestroy.io/domain/rojadirecta.cloud/) | 2026-09-03 | Online | Key-Systems | 
[kraaken.cloud](https://phishdestroy.io/domain/kraaken.cloud/) | 2026-09-03 | Offline | Spaceship | 
[orca.aykutbayrambey.cloud](https://phishdestroy.io/domain/orca.aykutbayrambey.cloud/) | 2026-09-03 | Online | HOSTINGER operations | 
[fndk.cloud](https://phishdestroy.io/domain/fndk.cloud/) | 2026-09-02 | Online | Gname.com | 
[tectonic-finance.cloud](https://phishdestroy.io/domain/tectonic-finance.cloud/) | 2026-09-01 | Unknown | NICENIC | 
[wiseforum.cloud](https://phishdestroy.io/domain/wiseforum.cloud/) | 2026-08-31 | Unknown | NICENIC | 
[reconnect.cloud](https://phishdestroy.io/domain/reconnect.cloud/) | 2026-08-28 | Offline | HOSTINGER operations | 
[tetherdapp.cloud](https://phishdestroy.io/domain/tetherdapp.cloud/) | 2026-08-26 | Offline | NAMECHEAP | 
[appeals-termmax.cloud](https://phishdestroy.io/domain/appeals-termmax.cloud/) | 2026-08-23 | Unknown | NICENIC | 
[ryven.cloud](https://phishdestroy.io/domain/ryven.cloud/) | 2026-08-20 | Unknown | NICENIC | 
[phase1-xrpl.cloud](https://phishdestroy.io/domain/phase1-xrpl.cloud/) | 2026-08-20 | Unknown | NICENIC | 
[lista-dao.cloud](https://phishdestroy.io/domain/lista-dao.cloud/) | 2026-08-20 | Unknown | NICENIC | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .cloud registrations; first .cloud report 2025-07-12.

Canonical: https://phishdestroy.io/tld/cloud/