Phishing domains under .ir

.ir accounts for 25 of the 224,866 domains in the PhishDestroy database (0.01%), with 1 new ones in the last 30 days. The most impersonated brand under .ir is Google. 15 were online at the last check and 9 have a confirmed takedown.

25
Reported .ir domains
0.01%
Share of PhishDestroy reports
1
Last 30 days
9
Confirmed takedowns

Detections per month

2025-11: 42025-12: 32026-01: 12026-02: 42026-03: 02026-04: 12026-05: 02026-06: 02026-07: 32026-08: 32026-09: 02026-10: 1
.ir phishing domains detected per month: 20 from 2025-11 to 2026-10; peak 4.

Brands and registrars

Impersonated brands

  1. Google3
  2. Apple2
  3. Ethereum1
  4. Telegram1
  5. OpenSea1
  6. Instagram1
  7. Coinbase1
  8. Instagram1

Registrars

  1. N/A1
  2. Cloudflare1
  3. IR-MIHAN-20051129 (ASN: 204213)1
  4. Abuseradar1
  5. Arvancloud.ir1

Latest .ir phishing domains

The 25 most recently detected .ir domains
DomainFirst detectedStatus at last checkRegistrar
faran.ac.ir2026-10-13Online—
zarsakhabar.ir2026-08-26Online—
qomculture.ir2026-08-17Online—
hezha-amazon.ir2026-08-14Online—
persiasysco.ir2026-07-30Online—
freeindex.ir2026-07-27Online—
invite.urmenu.ir2026-07-18Online—
s-10longs.ac10ao.dr-roudbaraki.ir2026-04-15Offline—
pr.discordfarsi.ir2026-02-26Taken down—
degen.ir2026-02-26Online—
khodadanad.ir2026-02-12OnlineArvancloud.ir
npv.alitavangar.ir2026-02-07OfflineAbuseradar
t.proreview.ir2026-01-07Offline—
respinaresane.ir2025-12-26Taken down—
coinbase.ir2025-12-05Online—
colorworld.ir2025-12-01Taken down—
kishvandnews.ir2025-11-27Taken down—
lvsclinic.ir2025-11-23Taken down—
instagramnewapp.ir2025-11-05Taken down—
mhdebr.ir2025-11-01OnlineIR-MIHAN-20051129 (ASN: 204213)
yadgirandeh.ir2025-10-26Taken downCloudflare
rsabz.ir2025-10-18Offline—
pensa.ir2025-09-16Online—
p0.fsoall.ir2025-09-06Taken down—
soniclabs.ir2025-09-03Taken downN/A

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .ir registrations; first .ir report 2025-09-03.