# Phishing domains under .finance

.finance accounts for 683 of the 224,866 domains in the PhishDestroy database (0.30%), with 30 new ones in the last 30 days. The most impersonated brand under .finance is MetaMask. 226 were online at the last check and 114 have a confirmed takedown.

683Reported .finance domains

0.30%Share of PhishDestroy reports

30Last 30 days

114Confirmed takedowns

## Detections per month

.finance phishing domains detected per month: 540 from 2025-11 to 2026-10; peak 130.

## Brands and registrars

### Impersonated brands

- [MetaMask](https://phishdestroy.io/brand/metamask/)35
- [Pendle](https://phishdestroy.io/brand/pendle/)20
- [Aerodrome](https://phishdestroy.io/brand/aerodrome/)15
- [Google](https://phishdestroy.io/brand/google/)14
- [Aave](https://phishdestroy.io/brand/aave/)12
- [PancakeSwap](https://phishdestroy.io/brand/pancakeswap/)11
- [Revolut](https://phishdestroy.io/brand/revolut/)9
- [Binance](https://phishdestroy.io/brand/binance/)9

### Registrars

- [NICENIC](https://phishdestroy.io/registrar/nicenic/)186
- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)113
- Cloudflare92
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)48
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)21
- N/A20
- [HOSTINGER operations](https://phishdestroy.io/registrar/hostinger/)20
- [Tucows Domains](https://phishdestroy.io/registrar/tucows/)18

## Latest .finance phishing domains

The 30 most recently detected .finance domains
Domain | First detected | Status at last check | Registrar | 
[kumibot.finance](https://phishdestroy.io/domain/kumibot.finance/) | 2026-10-21 | Online | NICENIC | 
[vvelodrome.finance](https://phishdestroy.io/domain/vvelodrome.finance/) | 2026-10-20 | Online | NICENIC | 
[whspr.finance](https://phishdestroy.io/domain/whspr.finance/) | 2026-10-20 | Online | NICENIC | 
[airhead.finance](https://phishdestroy.io/domain/airhead.finance/) | 2026-10-20 | Offline | NameSilo | 
[vlodrome.finance](https://phishdestroy.io/domain/vlodrome.finance/) | 2026-10-19 | Online | NICENIC | 
[clearpoolpolicy.finance](https://phishdestroy.io/domain/clearpoolpolicy.finance/) | 2026-10-13 | Offline | NICENIC | 
[diverge.finance](https://phishdestroy.io/domain/diverge.finance/) | 2026-10-10 | Online | GoDaddy Online Services Cayman Islands | 
[solincinerator.finance](https://phishdestroy.io/domain/solincinerator.finance/) | 2026-10-09 | Unknown | NICENIC | 
[graniteassets.finance](https://phishdestroy.io/domain/graniteassets.finance/) | 2026-10-09 | Online | GNAME.COM | 
[lifeyield.finance](https://phishdestroy.io/domain/lifeyield.finance/) | 2026-10-09 | Online | GoDaddy.com | 
[wwwondo.finance](https://phishdestroy.io/domain/wwwondo.finance/) | 2026-10-08 | Online | Web Commerce Communications dba WebNic.c | 
[katrina.finance](https://phishdestroy.io/domain/katrina.finance/) | 2026-10-07 | Online | NICENIC | 
[ellipalwallet.finance](https://phishdestroy.io/domain/ellipalwallet.finance/) | 2026-10-07 | Offline | NICENIC | 
[apps-doppler.finance](https://phishdestroy.io/domain/apps-doppler.finance/) | 2026-10-07 | Online | NICENIC | 
[tge-onre.finance](https://phishdestroy.io/domain/tge-onre.finance/) | 2026-10-07 | Online | NICENIC | 
[hub-onre.finance](https://phishdestroy.io/domain/hub-onre.finance/) | 2026-10-07 | Online | NICENIC | 
[defi-doppler.finance](https://phishdestroy.io/domain/defi-doppler.finance/) | 2026-10-07 | Online | NICENIC | 
[allocations-doppler.finance](https://phishdestroy.io/domain/allocations-doppler.finance/) | 2026-10-07 | Online | NICENIC | 
[allocation-apyx.finance](https://phishdestroy.io/domain/allocation-apyx.finance/) | 2026-10-07 | Online | NICENIC | 
[myxrp.finance](https://phishdestroy.io/domain/myxrp.finance/) | 2026-10-05 | Offline | NameCheap | 
[syrup.maqle.finance](https://phishdestroy.io/domain/syrup.maqle.finance/) | 2026-10-04 | Online | GNAME.COM | 
[bitnest.finance](https://phishdestroy.io/domain/bitnest.finance/) | 2026-09-29 | Online | Amazon Registrar | 
[secvalmu96bm09zr.entendre.finance](https://phishdestroy.io/domain/secvalmu96bm09zr.entendre.finance/) | 2026-09-29 | Online | Cloudflare | 
[probe-org-02ujrct5.entendre.finance](https://phishdestroy.io/domain/probe-org-02ujrct5.entendre.finance/) | 2026-09-29 | Online | Cloudflare | 
[securitytest-20260924-051618.entendre.finance](https://phishdestroy.io/domain/securitytest-20260924-051618.entendre.finance/) | 2026-09-29 | Online | Cloudflare | 
[en-zerion.finance](https://phishdestroy.io/domain/en-zerion.finance/) | 2026-09-29 | Offline | NICENIC | 
[saltswap.finance](https://phishdestroy.io/domain/saltswap.finance/) | 2026-09-23 | Online | NameCheap | 
[solvbtc.finance](https://phishdestroy.io/domain/solvbtc.finance/) | 2026-09-22 | Online | NICENIC | 
[contracts-moonwell.finance](https://phishdestroy.io/domain/contracts-moonwell.finance/) | 2026-09-22 | Online | NICENIC | 
[aerodrones.finance](https://phishdestroy.io/domain/aerodrones.finance/) | 2026-09-22 | Online | NICENIC | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .finance registrations; first .finance report 2024-03-19.

Canonical: https://phishdestroy.io/tld/finance/