# Phishing domains under .dev

.dev accounts for 20,181 of the 224,866 domains in the PhishDestroy database (8.97%), with 13 new ones in the last 30 days. The most impersonated brand under .dev is Ledger. 6,121 were online at the last check and 3,038 have a confirmed takedown.

20,181Reported .dev domains

8.97%Share of PhishDestroy reports

13Last 30 days

3,038Confirmed takedowns

## Detections per month

.dev phishing domains detected per month: 20,107 from 2025-11 to 2026-10; peak 5,878.

## Brands and registrars

### Impersonated brands

- [Ledger](https://phishdestroy.io/brand/ledger/)3,954
- [Trezor](https://phishdestroy.io/brand/trezor/)988
- [Cloudflare](https://phishdestroy.io/brand/cloudflare/)776
- [Coinbase](https://phishdestroy.io/brand/coinbase/)496
- [Exodus](https://phishdestroy.io/brand/exodus/)460
- [Google](https://phishdestroy.io/brand/google/)415
- [MetaMask](https://phishdestroy.io/brand/metamask/)358
- [Ledger](https://phishdestroy.io/brand/ledger/)354

### Registrars

- Cloudflare16,880
- Cloudflare Pages2,550
- Cloudflare R2123
- Cloudflare Workers86
- CloudFlare79
- [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)71
- Tencent Cloud65
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)40

## Latest .dev phishing domains

The 30 most recently detected .dev domains
Domain | First detected | Status at last check | Registrar | 
[ichanger.dev](https://phishdestroy.io/domain/ichanger.dev/) | 2026-10-22 | Online | NICENIC | 
[open-ledger.dev](https://phishdestroy.io/domain/open-ledger.dev/) | 2026-10-20 | Online | CloudFlare | 
[sharkhack.dev](https://phishdestroy.io/domain/sharkhack.dev/) | 2026-10-20 | Online | NICENIC | 
[frytt.dev](https://phishdestroy.io/domain/frytt.dev/) | 2026-10-19 | Online | Name.com | 
[projectretrac.dev](https://phishdestroy.io/domain/projectretrac.dev/) | 2026-10-19 | Online | NICENIC | 
[consumer-d1.cdn.dpduk.dev](https://phishdestroy.io/domain/consumer-d1.cdn.dpduk.dev/) | 2026-10-07 | Online | Nom-IQ dba Com Laude | 
[freeclaude.dev](https://phishdestroy.io/domain/freeclaude.dev/) | 2026-10-07 | Online | Dynadot | 
[metaweb.dev](https://phishdestroy.io/domain/metaweb.dev/) | 2026-10-03 | Offline | Dynadot | 
[rotk.dev](https://phishdestroy.io/domain/rotk.dev/) | 2026-10-01 | Online | Namecheap | 
[chameleon-dpjy42k5uyg7.edgeone.dev](https://phishdestroy.io/domain/chameleon-dpjy42k5uyg7.edgeone.dev/) | 2026-09-23 | Online | MarkMonitor | 
[bandizip.dev](https://phishdestroy.io/domain/bandizip.dev/) | 2026-09-22 | Online | GNAME.COM | 
[schoolcord-dpt53h5jqo4b.edgeone.dev](https://phishdestroy.io/domain/schoolcord-dpt53h5jqo4b.edgeone.dev/) | 2026-09-22 | Online | MarkMonitor | 
[bahyamediasitustox-dptg601qh8fp.edgeone.dev](https://phishdestroy.io/domain/bahyamediasitustox-dptg601qh8fp.edgeone.dev/) | 2026-09-22 | Online | MarkMonitor | 
[fil-eggen-dpt6n0jn28p0.edgeone.dev](https://phishdestroy.io/domain/fil-eggen-dpt6n0jn28p0.edgeone.dev/) | 2026-09-21 | Online | MarkMonitor | 
[shibiozai.dev](https://phishdestroy.io/domain/shibiozai.dev/) | 2026-09-21 | Unknown | Sav.com | 
[xminesserversaqwq.edgeone.dev](https://phishdestroy.io/domain/xminesserversaqwq.edgeone.dev/) | 2026-09-20 | Online | MarkMonitor | 
[feminist-brown-plkm1dgi.edgeone.dev](https://phishdestroy.io/domain/feminist-brown-plkm1dgi.edgeone.dev/) | 2026-09-19 | Online | MarkMonitor | 
[kkkksgsgdfdjfdhhfdhlhdflhxkkkk-dpxklwputyu8.edgeone.dev](https://phishdestroy.io/domain/kkkksgsgdfdjfdhhfdhlhdflhxkkkk-dpxklwputyu8.edgeone.dev/) | 2026-09-18 | Online | MarkMonitor | 
[restless-water-0e20.keithvalentineahcy12976.workers.dev](https://phishdestroy.io/domain/restless-water-0e20.keithvalentineahcy12976.workers.dev/) | 2026-09-17 | Offline | Cloudflare Workers | 
[gvnis-zev-4y0b-0ylk7-16-09-2026-hh.pages.dev](https://phishdestroy.io/domain/gvnis-zev-4y0b-0ylk7-16-09-2026-hh.pages.dev/) | 2026-09-17 | Online | Cloudflare Pages | 
[web3studiov2.pages.dev](https://phishdestroy.io/domain/web3studiov2.pages.dev/) | 2026-09-17 | Online | Cloudflare Pages | 
[publicsale-mocaverse.pages.dev](https://phishdestroy.io/domain/publicsale-mocaverse.pages.dev/) | 2026-09-17 | Offline | Cloudflare Pages | 
[eeeer2322.pages.dev](https://phishdestroy.io/domain/eeeer2322.pages.dev/) | 2026-09-17 | Offline | CloudFlare | 
[sbhero-ledger.pages.dev](https://phishdestroy.io/domain/sbhero-ledger.pages.dev/) | 2026-09-17 | Offline | Cloudflare Pages | 
[the-ledger-4sk.pages.dev](https://phishdestroy.io/domain/the-ledger-4sk.pages.dev/) | 2026-09-17 | Offline | Cloudflare Pages | 
[wandering-thunder-febc.nauweb7.workers.dev](https://phishdestroy.io/domain/wandering-thunder-febc.nauweb7.workers.dev/) | 2026-09-17 | Offline | CloudFlare | 
[m-smartrectify.pages.dev](https://phishdestroy.io/domain/m-smartrectify.pages.dev/) | 2026-09-17 | Offline | Cloudflare Pages | 
[7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev](https://phishdestroy.io/domain/7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/) | 2026-09-17 | Offline | CloudFlare | 
[rainbet-eu-de.pages.dev](https://phishdestroy.io/domain/rainbet-eu-de.pages.dev/) | 2026-09-17 | Online | CloudFlare | 
[the-rainbet-fr-com.pages.dev](https://phishdestroy.io/domain/the-rainbet-fr-com.pages.dev/) | 2026-09-17 | Offline | Cloudflare Pages | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .dev registrations; first .dev report 2024-03-20.

Canonical: https://phishdestroy.io/tld/dev/