# Phishing domains under .li

.li accounts for 26 of the 224,866 domains in the PhishDestroy database (0.01%), with 0 new ones in the last 30 days. The most impersonated brand under .li is Phantom. 15 were online at the last check and 2 have a confirmed takedown.

26Reported .li domains

0.01%Share of PhishDestroy reports

0Last 30 days

2Confirmed takedowns

## Detections per month

.li phishing domains detected per month: 23 from 2025-11 to 2026-10; peak 4.

## Brands and registrars

### Impersonated brands

- [Phantom](https://phishdestroy.io/brand/phantom/)2
- [MetaMask](https://phishdestroy.io/brand/metamask/)2
- [Coinbase](https://phishdestroy.io/brand/coinbase/)1
- [Ledger](https://phishdestroy.io/brand/ledger/)1
- [Uphold](https://phishdestroy.io/brand/uphold/)1
- [Roblox](https://phishdestroy.io/brand/roblox/)1
- [Microsoft](https://phishdestroy.io/brand/microsoft/)1
- [Trust Wallet](https://phishdestroy.io/brand/trust-wallet/)1

### Registrars

- [Google Blogger](https://phishdestroy.io/registrar/google/)3
- N/A1
- [GOOGLE (ASN: 15169)](https://phishdestroy.io/registrar/google/)1
- GOOGL-2 (ASN: 396982)1
- Switch.ch1
- [Google](https://phishdestroy.io/registrar/google/)1

## Latest .li phishing domains

The 26 most recently detected .li domains
Domain | First detected | Status at last check | Registrar | 
[wormhole.xlu.li](https://phishdestroy.io/domain/wormhole.xlu.li/) | 2026-09-20 | Offline | — | 
[did.li](https://phishdestroy.io/domain/did.li/) | 2026-08-08 | Online | — | 
[hmds.li](https://phishdestroy.io/domain/hmds.li/) | 2026-07-27 | Online | — | 
[joker.li](https://phishdestroy.io/domain/joker.li/) | 2026-07-27 | Online | — | 
[contact-metamask-support.blogspot.li](https://phishdestroy.io/domain/contact-metamask-support.blogspot.li/) | 2026-07-15 | Online | — | 
[coinbaseprologiinn.blogspot.li](https://phishdestroy.io/domain/coinbaseprologiinn.blogspot.li/) | 2026-06-28 | Online | Google Blogger | 
[trezor-io-startt.blogspot.li](https://phishdestroy.io/domain/trezor-io-startt.blogspot.li/) | 2026-06-26 | Online | Google Blogger | 
[duty-free-test-test.li](https://phishdestroy.io/domain/duty-free-test-test.li/) | 2026-06-17 | Offline | — | 
[torzon-market.li](https://phishdestroy.io/domain/torzon-market.li/) | 2026-05-19 | Offline | — | 
[usdtsend.li](https://phishdestroy.io/domain/usdtsend.li/) | 2026-05-07 | Offline | — | 
[secureactivitysett726411.li](https://phishdestroy.io/domain/secureactivitysett726411.li/) | 2026-04-25 | Offline | — | 
[urlz.li](https://phishdestroy.io/domain/urlz.li/) | 2026-04-06 | Online | — | 
[metamaskextensuon.blogspot.li](https://phishdestroy.io/domain/metamaskextensuon.blogspot.li/) | 2026-03-10 | Online | Google Blogger | 
[pairs.li](https://phishdestroy.io/domain/pairs.li/) | 2026-03-04 | Offline | — | 
[prem.li](https://phishdestroy.io/domain/prem.li/) | 2026-02-22 | Online | — | 
[phantom-wallets.blogspot.li](https://phishdestroy.io/domain/phantom-wallets.blogspot.li/) | 2026-01-28 | Online | Google | 
[uphold-wallettt.blogspot.li](https://phishdestroy.io/domain/uphold-wallettt.blogspot.li/) | 2026-01-24 | Online | — | 
[com-en-us.li](https://phishdestroy.io/domain/com-en-us.li/) | 2026-01-20 | Offline | Switch.ch | 
[9516.li](https://phishdestroy.io/domain/9516.li/) | 2025-12-29 | Offline | — | 
[lombard-finance.li](https://phishdestroy.io/domain/lombard-finance.li/) | 2025-12-14 | Taken down | — | 
[en-us-uphold-login.blogspot.li](https://phishdestroy.io/domain/en-us-uphold-login.blogspot.li/) | 2025-12-09 | Online | — | 
[connect-uphold-login-account.blogspot.li](https://phishdestroy.io/domain/connect-uphold-login-account.blogspot.li/) | 2025-12-09 | Online | — | 
[ledger-support.li](https://phishdestroy.io/domain/ledger-support.li/) | 2025-11-11 | Offline | GOOGL-2 (ASN: 396982) | 
[app-efhen.li](https://phishdestroy.io/domain/app-efhen.li/) | 2025-10-28 | Offline | — | 
[phantomwalletdownload.blogspot.li](https://phishdestroy.io/domain/phantomwalletdownload.blogspot.li/) | 2025-10-08 | Online | GOOGLE (ASN: 15169) | 
[euc.li](https://phishdestroy.io/domain/euc.li/) | 2025-09-07 | Taken down | N/A | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .li registrations; first .li report 2025-09-07.

Canonical: https://phishdestroy.io/tld/li/