Phishing domains under .li

.li accounts for 26 of the 224,866 domains in the PhishDestroy database (0.01%), with 0 new ones in the last 30 days. The most impersonated brand under .li is Phantom. 15 were online at the last check and 2 have a confirmed takedown.

26
Reported .li domains
0.01%
Share of PhishDestroy reports
0
Last 30 days
2
Confirmed takedowns

Detections per month

2025-11: 12025-12: 42026-01: 32026-02: 12026-03: 22026-04: 22026-05: 22026-06: 32026-07: 32026-08: 12026-09: 12026-10: 0
.li phishing domains detected per month: 23 from 2025-11 to 2026-10; peak 4.

Brands and registrars

Impersonated brands

  1. Phantom2
  2. MetaMask2
  3. Coinbase1
  4. Ledger1
  5. Uphold1
  6. Roblox1
  7. Microsoft1
  8. Trust Wallet1

Registrars

  1. Google Blogger3
  2. N/A1
  3. GOOGLE (ASN: 15169)1
  4. GOOGL-2 (ASN: 396982)1
  5. Switch.ch1
  6. Google1

Latest .li phishing domains

The 26 most recently detected .li domains
DomainFirst detectedStatus at last checkRegistrar
wormhole.xlu.li2026-09-20Offline—
did.li2026-08-08Online—
hmds.li2026-07-27Online—
joker.li2026-07-27Online—
contact-metamask-support.blogspot.li2026-07-15Online—
coinbaseprologiinn.blogspot.li2026-06-28OnlineGoogle Blogger
trezor-io-startt.blogspot.li2026-06-26OnlineGoogle Blogger
duty-free-test-test.li2026-06-17Offline—
torzon-market.li2026-05-19Offline—
usdtsend.li2026-05-07Offline—
secureactivitysett726411.li2026-04-25Offline—
urlz.li2026-04-06Online—
metamaskextensuon.blogspot.li2026-03-10OnlineGoogle Blogger
pairs.li2026-03-04Offline—
prem.li2026-02-22Online—
phantom-wallets.blogspot.li2026-01-28OnlineGoogle
uphold-wallettt.blogspot.li2026-01-24Online—
com-en-us.li2026-01-20OfflineSwitch.ch
9516.li2025-12-29Offline—
lombard-finance.li2025-12-14Taken down—
en-us-uphold-login.blogspot.li2025-12-09Online—
connect-uphold-login-account.blogspot.li2025-12-09Online—
ledger-support.li2025-11-11OfflineGOOGL-2 (ASN: 396982)
app-efhen.li2025-10-28Offline—
phantomwalletdownload.blogspot.li2025-10-08OnlineGOOGLE (ASN: 15169)
euc.li2025-09-07Taken downN/A

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .li registrations; first .li report 2025-09-07.