# Phishing domains under .ir

.ir accounts for 25 of the 224,866 domains in the PhishDestroy database (0.01%), with 1 new ones in the last 30 days. The most impersonated brand under .ir is Google. 15 were online at the last check and 9 have a confirmed takedown.

25Reported .ir domains

0.01%Share of PhishDestroy reports

1Last 30 days

9Confirmed takedowns

## Detections per month

.ir phishing domains detected per month: 20 from 2025-11 to 2026-10; peak 4.

## Brands and registrars

### Impersonated brands

- [Google](https://phishdestroy.io/brand/google/)3
- [Apple](https://phishdestroy.io/brand/apple/)2
- [Ethereum](https://phishdestroy.io/brand/ethereum/)1
- [Telegram](https://phishdestroy.io/brand/telegram/)1
- [OpenSea](https://phishdestroy.io/brand/opensea/)1
- [Instagram](https://phishdestroy.io/brand/instagram/)1
- [Coinbase](https://phishdestroy.io/brand/coinbase/)1
- [Instagram](https://phishdestroy.io/brand/instagram/)1

### Registrars

- N/A1
- Cloudflare1
- IR-MIHAN-20051129 (ASN: 204213)1
- [Abuseradar](https://phishdestroy.io/registrar/abuseradar/)1
- Arvancloud.ir1

## Latest .ir phishing domains

The 25 most recently detected .ir domains
Domain | First detected | Status at last check | Registrar | 
[faran.ac.ir](https://phishdestroy.io/domain/faran.ac.ir/) | 2026-10-13 | Online | — | 
[zarsakhabar.ir](https://phishdestroy.io/domain/zarsakhabar.ir/) | 2026-08-26 | Online | — | 
[qomculture.ir](https://phishdestroy.io/domain/qomculture.ir/) | 2026-08-17 | Online | — | 
[hezha-amazon.ir](https://phishdestroy.io/domain/hezha-amazon.ir/) | 2026-08-14 | Online | — | 
[persiasysco.ir](https://phishdestroy.io/domain/persiasysco.ir/) | 2026-07-30 | Online | — | 
[freeindex.ir](https://phishdestroy.io/domain/freeindex.ir/) | 2026-07-27 | Online | — | 
[invite.urmenu.ir](https://phishdestroy.io/domain/invite.urmenu.ir/) | 2026-07-18 | Online | — | 
[s-10longs.ac10ao.dr-roudbaraki.ir](https://phishdestroy.io/domain/s-10longs.ac10ao.dr-roudbaraki.ir/) | 2026-04-15 | Offline | — | 
[pr.discordfarsi.ir](https://phishdestroy.io/domain/pr.discordfarsi.ir/) | 2026-02-26 | Taken down | — | 
[degen.ir](https://phishdestroy.io/domain/degen.ir/) | 2026-02-26 | Online | — | 
[khodadanad.ir](https://phishdestroy.io/domain/khodadanad.ir/) | 2026-02-12 | Online | Arvancloud.ir | 
[npv.alitavangar.ir](https://phishdestroy.io/domain/npv.alitavangar.ir/) | 2026-02-07 | Offline | Abuseradar | 
[t.proreview.ir](https://phishdestroy.io/domain/t.proreview.ir/) | 2026-01-07 | Offline | — | 
[respinaresane.ir](https://phishdestroy.io/domain/respinaresane.ir/) | 2025-12-26 | Taken down | — | 
[coinbase.ir](https://phishdestroy.io/domain/coinbase.ir/) | 2025-12-05 | Online | — | 
[colorworld.ir](https://phishdestroy.io/domain/colorworld.ir/) | 2025-12-01 | Taken down | — | 
[kishvandnews.ir](https://phishdestroy.io/domain/kishvandnews.ir/) | 2025-11-27 | Taken down | — | 
[lvsclinic.ir](https://phishdestroy.io/domain/lvsclinic.ir/) | 2025-11-23 | Taken down | — | 
[instagramnewapp.ir](https://phishdestroy.io/domain/instagramnewapp.ir/) | 2025-11-05 | Taken down | — | 
[mhdebr.ir](https://phishdestroy.io/domain/mhdebr.ir/) | 2025-11-01 | Online | IR-MIHAN-20051129 (ASN: 204213) | 
[yadgirandeh.ir](https://phishdestroy.io/domain/yadgirandeh.ir/) | 2025-10-26 | Taken down | Cloudflare | 
[rsabz.ir](https://phishdestroy.io/domain/rsabz.ir/) | 2025-10-18 | Offline | — | 
[pensa.ir](https://phishdestroy.io/domain/pensa.ir/) | 2025-09-16 | Online | — | 
[p0.fsoall.ir](https://phishdestroy.io/domain/p0.fsoall.ir/) | 2025-09-06 | Taken down | — | 
[soniclabs.ir](https://phishdestroy.io/domain/soniclabs.ir/) | 2025-09-03 | Taken down | N/A | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .ir registrations; first .ir report 2025-09-03.

Canonical: https://phishdestroy.io/tld/ir/