Phishing domains under .im

.im accounts for 70 of the 224,866 domains in the PhishDestroy database (0.03%), with 7 new ones in the last 30 days. The most impersonated brand under .im is Ledger. 35 were online at the last check and 9 have a confirmed takedown.

70
Reported .im domains
0.03%
Share of PhishDestroy reports
7
Last 30 days
9
Confirmed takedowns

Detections per month

2025-11: 22025-12: 42026-01: 72026-02: 132026-03: 72026-04: 22026-05: 32026-06: 92026-07: 82026-08: 22026-09: 72026-10: 4
.im phishing domains detected per month: 68 from 2025-11 to 2026-10; peak 13.

Brands and registrars

Impersonated brands

  1. Ledger3
  2. Trezor3
  3. Ethereum2
  4. Zoom2
  5. Cosmos2
  6. Microsoft2
  7. Coinbase2
  8. Google2

Registrars

  1. Redacted42
  2. Cloudflare2
  3. N/A1
  4. SHOPIFY-NET (ASN: 13335)1
  5. LINODE (ASN: 63949)1
  6. Kalada1

Latest .im phishing domains

The 30 most recently detected .im domains
DomainFirst detectedStatus at last checkRegistrar
trocador-app.im2026-10-21Offline—
en-exodus.co.im2026-10-15Online—
help.steampowered.com.im2026-10-15OnlineRedacted
trezor-suite.im2026-10-10OnlineRedacted
atomicwallet.im2026-09-27OnlineRedacted
mintpwt.im2026-09-25Online—
osejp.im2026-09-22OnlineRedacted
rufus.im2026-09-21OfflineRedacted
godatafeed.im2026-09-16OnlineRedacted
bitwinex.im2026-09-11OnlineRedacted
metaswap.im2026-09-09Online—
eth.im2026-08-18OnlineRedacted
tronscan.org.im2026-08-09OfflineRedacted
bitget.arbitrum.im2026-07-29Online—
konvert.im2026-07-27OfflineRedacted
2132.im2026-07-27OnlineRedacted
chat.consultation.com.im2026-07-24Online—
trezor.wallet.com.im2026-07-22Online—
bt.arbitrum.im2026-07-14Online—
ledger.org.im2026-07-10Online—
sez.im2026-07-06Online—
bozei.im2026-06-23OnlineRedacted
lvvas.im2026-06-23Online—
krab7.im2026-06-17Offline—
upholdvip.im2026-06-16Offline—
trx.im2026-06-15OnlineRedacted
trezor.com.im2026-06-15OnlineRedacted
uniswap.org.net.im2026-06-08OfflineKalada
slon8.im2026-06-08Offline—
krab3.im2026-06-08Offline—

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .im registrations; first .im report 2025-09-06.