Phishing domains under .dev

.dev accounts for 20,181 of the 224,866 domains in the PhishDestroy database (8.97%), with 13 new ones in the last 30 days. The most impersonated brand under .dev is Ledger. 6,121 were online at the last check and 3,038 have a confirmed takedown.

20,181
Reported .dev domains
8.97%
Share of PhishDestroy reports
13
Last 30 days
3,038
Confirmed takedowns

Detections per month

2025-11: 3842025-12: 6192026-01: 1192026-02: 58782026-03: 41162026-04: 43862026-05: 5982026-06: 16542026-07: 4572026-08: 11832026-09: 7042026-10: 9
.dev phishing domains detected per month: 20,107 from 2025-11 to 2026-10; peak 5,878.

Brands and registrars

Impersonated brands

  1. Ledger3,954
  2. Trezor988
  3. Cloudflare776
  4. Coinbase496
  5. Exodus460
  6. Google415
  7. MetaMask358
  8. Ledger354

Registrars

  1. Cloudflare16,880
  2. Cloudflare Pages2,550
  3. Cloudflare R2123
  4. Cloudflare Workers86
  5. CloudFlare79
  6. MarkMonitor71
  7. Tencent Cloud65
  8. Dynadot40

Latest .dev phishing domains

The 30 most recently detected .dev domains
DomainFirst detectedStatus at last checkRegistrar
ichanger.dev2026-10-22OnlineNICENIC
open-ledger.dev2026-10-20OnlineCloudFlare
sharkhack.dev2026-10-20OnlineNICENIC
frytt.dev2026-10-19OnlineName.com
projectretrac.dev2026-10-19OnlineNICENIC
consumer-d1.cdn.dpduk.dev2026-10-07OnlineNom-IQ dba Com Laude
freeclaude.dev2026-10-07OnlineDynadot
metaweb.dev2026-10-03OfflineDynadot
rotk.dev2026-10-01OnlineNamecheap
chameleon-dpjy42k5uyg7.edgeone.dev2026-09-23OnlineMarkMonitor
bandizip.dev2026-09-22OnlineGNAME.COM
schoolcord-dpt53h5jqo4b.edgeone.dev2026-09-22OnlineMarkMonitor
bahyamediasitustox-dptg601qh8fp.edgeone.dev2026-09-22OnlineMarkMonitor
fil-eggen-dpt6n0jn28p0.edgeone.dev2026-09-21OnlineMarkMonitor
shibiozai.dev2026-09-21UnknownSav.com
xminesserversaqwq.edgeone.dev2026-09-20OnlineMarkMonitor
feminist-brown-plkm1dgi.edgeone.dev2026-09-19OnlineMarkMonitor
kkkksgsgdfdjfdhhfdhlhdflhxkkkk-dpxklwputyu8.edgeone.dev2026-09-18OnlineMarkMonitor
restless-water-0e20.keithvalentineahcy12976.workers.dev2026-09-17OfflineCloudflare Workers
gvnis-zev-4y0b-0ylk7-16-09-2026-hh.pages.dev2026-09-17OnlineCloudflare Pages
web3studiov2.pages.dev2026-09-17OnlineCloudflare Pages
publicsale-mocaverse.pages.dev2026-09-17OfflineCloudflare Pages
eeeer2322.pages.dev2026-09-17OfflineCloudFlare
sbhero-ledger.pages.dev2026-09-17OfflineCloudflare Pages
the-ledger-4sk.pages.dev2026-09-17OfflineCloudflare Pages
wandering-thunder-febc.nauweb7.workers.dev2026-09-17OfflineCloudFlare
m-smartrectify.pages.dev2026-09-17OfflineCloudflare Pages
7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev2026-09-17OfflineCloudFlare
rainbet-eu-de.pages.dev2026-09-17OnlineCloudFlare
the-rainbet-fr-com.pages.dev2026-09-17OfflineCloudflare Pages

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .dev registrations; first .dev report 2024-03-20.