# Phishing domains under .group

.group accounts for 35 of the 224,866 domains in the PhishDestroy database (0.02%), with 0 new ones in the last 30 days. The most impersonated brand under .group is Ledger. 17 were online at the last check and 5 have a confirmed takedown.

35Reported .group domains

0.02%Share of PhishDestroy reports

0Last 30 days

5Confirmed takedowns

## Detections per month

.group phishing domains detected per month: 31 from 2025-11 to 2026-10; peak 11.

## Brands and registrars

### Impersonated brands

- [Ledger](https://phishdestroy.io/brand/ledger/)2
- [AMLBot](https://phishdestroy.io/brand/amlbot/)1
- [Solflare](https://phishdestroy.io/brand/solflare/)1
- [TikTok](https://phishdestroy.io/brand/tiktok/)1
- [Ethereum](https://phishdestroy.io/brand/ethereum/)1
- [Csgo](https://phishdestroy.io/brand/csgo/)1
- [Google](https://phishdestroy.io/brand/google/)1
- [Polymarket](https://phishdestroy.io/brand/polymarket/)1

### Registrars

- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)11
- Cloudflare4
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)2
- [Registrar of Domain Names REG.RU](https://phishdestroy.io/registrar/reg-ru/)2
- [Sav.com](https://phishdestroy.io/registrar/sav-com/)2
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)2
- [Trustname.com](https://phishdestroy.io/registrar/trustname/)2
- N/A1

## Latest .group phishing domains

The 30 most recently detected .group domains
Domain | First detected | Status at last check | Registrar | 
[amlverifier.group](https://phishdestroy.io/domain/amlverifier.group/) | 2026-09-15 | Online | Global Domain | 
[resuelvetusmovidas.group](https://phishdestroy.io/domain/resuelvetusmovidas.group/) | 2026-08-31 | Online | Register SPA | 
[freighttank.group](https://phishdestroy.io/domain/freighttank.group/) | 2026-08-10 | Online | Trustname.com | 
[paknext.group](https://phishdestroy.io/domain/paknext.group/) | 2026-08-10 | Online | Trustname.com | 
[ultlmate.group](https://phishdestroy.io/domain/ultlmate.group/) | 2026-08-10 | Offline | NameSilo | 
[open-osint.group](https://phishdestroy.io/domain/open-osint.group/) | 2026-07-31 | Unknown | NICENIC | 
[fpmarket.group](https://phishdestroy.io/domain/fpmarket.group/) | 2026-07-30 | Offline | Ultahost | 
[kolesa.group](https://phishdestroy.io/domain/kolesa.group/) | 2026-07-24 | Online | Registrar of Domain Names REG.RU | 
[xamaninvest.group](https://phishdestroy.io/domain/xamaninvest.group/) | 2026-06-28 | Offline | NICENIC | 
[cryptoex.group](https://phishdestroy.io/domain/cryptoex.group/) | 2026-06-15 | Online | HiChina (www.net.cn) | 
[cryptopass.maxwill.group](https://phishdestroy.io/domain/cryptopass.maxwill.group/) | 2026-03-24 | Online | PublicDomainRegistry.com | 
[rbfcuus.group](https://phishdestroy.io/domain/rbfcuus.group/) | 2026-03-11 | Online | Sav.com | 
[coinledger.group](https://phishdestroy.io/domain/coinledger.group/) | 2026-03-04 | Unknown | NiceNIC | 
[quantiva.group](https://phishdestroy.io/domain/quantiva.group/) | 2026-02-28 | Online | Registrar.eu | 
[io-en-us.group](https://phishdestroy.io/domain/io-en-us.group/) | 2026-02-26 | Online | Dynadot | 
[accessportal.group](https://phishdestroy.io/domain/accessportal.group/) | 2026-02-25 | Unknown | NiceNIC | 
[xaman.group](https://phishdestroy.io/domain/xaman.group/) | 2026-02-22 | Online | NiceNIC | 
[luna-market.group](https://phishdestroy.io/domain/luna-market.group/) | 2026-02-18 | Online | NiceNIC | 
[lacoursconstruction.group](https://phishdestroy.io/domain/lacoursconstruction.group/) | 2026-02-15 | Unknown | NiceNIC | 
[ledgerrecovery.group](https://phishdestroy.io/domain/ledgerrecovery.group/) | 2026-02-15 | Unknown | NiceNIC | 
[altadefinizionegratis.group](https://phishdestroy.io/domain/altadefinizionegratis.group/) | 2026-02-13 | Online | NiceNIC | 
[hit24.group](https://phishdestroy.io/domain/hit24.group/) | 2026-02-13 | Unknown | NiceNIC | 
[aster-dex.group](https://phishdestroy.io/domain/aster-dex.group/) | 2026-02-13 | Offline | NiceNIC | 
[approvedexperiencestraveller.group](https://phishdestroy.io/domain/approvedexperiencestraveller.group/) | 2026-02-11 | Online | GoDaddy.com | 
[changelly.group](https://phishdestroy.io/domain/changelly.group/) | 2026-01-27 | Offline | Regery.com | 
[standx.group](https://phishdestroy.io/domain/standx.group/) | 2025-12-16 | Taken down | NiceNIC | 
[jupiterswap.group](https://phishdestroy.io/domain/jupiterswap.group/) | 2025-12-15 | Unknown | NiceNIC | 
[polymarkets.group](https://phishdestroy.io/domain/polymarkets.group/) | 2025-12-06 | Taken down | Sav.com | 
[airdropalert.group](https://phishdestroy.io/domain/airdropalert.group/) | 2025-12-04 | Online | Cloudflare | 
[amlcheck.group](https://phishdestroy.io/domain/amlcheck.group/) | 2025-11-06 | Online | Cloudflare | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .group registrations; first .group report 2025-08-27.

Canonical: https://phishdestroy.io/tld/group/