# Phishing domains under .ltd .ltd accounts for 475 of the 224,866 domains in the PhishDestroy database (0.21%), with 168 new ones in the last 30 days. The most impersonated brand under .ltd is Ondo. 110 were online at the last check and 23 have a confirmed takedown. 475Reported .ltd domains 0.21%Share of PhishDestroy reports 168Last 30 days 23Confirmed takedowns ## Detections per month .ltd phishing domains detected per month: 427 from 2025-11 to 2026-10; peak 183. ## Brands and registrars ### Impersonated brands - [Ondo](https://phishdestroy.io/brand/ondo/)94 - [Google](https://phishdestroy.io/brand/google/)14 - [MetaMask](https://phishdestroy.io/brand/metamask/)10 - [Binance](https://phishdestroy.io/brand/binance/)9 - [Ledger](https://phishdestroy.io/brand/ledger/)7 - [Coinbase](https://phishdestroy.io/brand/coinbase/)6 - [Binance](https://phishdestroy.io/brand/binance/)5 - [Coinbase](https://phishdestroy.io/brand/coinbase/)5 ### Registrars - [NICENIC](https://phishdestroy.io/registrar/nicenic/)183 - [Dynadot](https://phishdestroy.io/registrar/dynadot/)43 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)34 - [HOSTINGER operations](https://phishdestroy.io/registrar/hostinger/)24 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)24 - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)15 - [NameSilo](https://phishdestroy.io/registrar/namesilo/)13 - Cloudflare12 ## Latest .ltd phishing domains The 30 most recently detected .ltd domains Domain | First detected | Status at last check | Registrar | [portal.alpinainvestlimited.ltd](https://phishdestroy.io/domain/portal.alpinainvestlimited.ltd/) | 2026-10-19 | Online | Tucows Domains | [tangemwallet.ltd](https://phishdestroy.io/domain/tangemwallet.ltd/) | 2026-10-07 | Offline | NICENIC | [crowningcapital.ltd](https://phishdestroy.io/domain/crowningcapital.ltd/) | 2026-10-07 | Online | NameCheap | [egfin.ltd](https://phishdestroy.io/domain/egfin.ltd/) | 2026-10-06 | Unknown | NICENIC | [velnorabnk.ltd](https://phishdestroy.io/domain/velnorabnk.ltd/) | 2026-10-06 | Online | Sav.com | [globalfundsnexora.ltd](https://phishdestroy.io/domain/globalfundsnexora.ltd/) | 2026-10-04 | Online | Spaceship | [apexcrownmanagement.ltd](https://phishdestroy.io/domain/apexcrownmanagement.ltd/) | 2026-10-03 | Online | Spaceship | [cornerstone-investments.ltd](https://phishdestroy.io/domain/cornerstone-investments.ltd/) | 2026-10-03 | Online | Dynadot | [crownspring-capitals.ltd](https://phishdestroy.io/domain/crownspring-capitals.ltd/) | 2026-09-30 | Online | Dynadot | [promotrustcard.ltd](https://phishdestroy.io/domain/promotrustcard.ltd/) | 2026-09-29 | Online | PublicDomainRegistry.com | [pagos.evergreenfin.ltd](https://phishdestroy.io/domain/pagos.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [pingtai.evergreenfin.ltd](https://phishdestroy.io/domain/pingtai.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [trace.evergreenfin.ltd](https://phishdestroy.io/domain/trace.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [store.evergreenfin.ltd](https://phishdestroy.io/domain/store.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [partners.evergreenfin.ltd](https://phishdestroy.io/domain/partners.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [signin.evergreenfin.ltd](https://phishdestroy.io/domain/signin.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [servicios.evergreenfin.ltd](https://phishdestroy.io/domain/servicios.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [org.evergreenfin.ltd](https://phishdestroy.io/domain/org.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [ollama.evergreenfin.ltd](https://phishdestroy.io/domain/ollama.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [mobile.evergreenfin.ltd](https://phishdestroy.io/domain/mobile.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [meituan.evergreenfin.ltd](https://phishdestroy.io/domain/meituan.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [federation.evergreenfin.ltd](https://phishdestroy.io/domain/federation.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [beta-login.evergreenfin.ltd](https://phishdestroy.io/domain/beta-login.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [manage.evergreenfin.ltd](https://phishdestroy.io/domain/manage.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [loginpage.evergreenfin.ltd](https://phishdestroy.io/domain/loginpage.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [kr.evergreenfin.ltd](https://phishdestroy.io/domain/kr.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [idpage.evergreenfin.ltd](https://phishdestroy.io/domain/idpage.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [idcenter.evergreenfin.ltd](https://phishdestroy.io/domain/idcenter.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [facturacion.evergreenfin.ltd](https://phishdestroy.io/domain/facturacion.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [employees.evergreenfin.ltd](https://phishdestroy.io/domain/employees.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [EPP status codes](https://phishdestroy.io/glossary/epp-status/) - [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains) - [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup) - [All TLDs](https://phishdestroy.io/tld/) Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .ltd registrations; first .ltd report 2025-07-12. Canonical: https://phishdestroy.io/tld/ltd/