# Phishing domains under .onl

.onl accounts for 76 of the 224,866 domains in the PhishDestroy database (0.03%), with 1 new ones in the last 30 days. The most impersonated brand under .onl is SushiSwap. 28 were online at the last check and 7 have a confirmed takedown.

76Reported .onl domains

0.03%Share of PhishDestroy reports

1Last 30 days

7Confirmed takedowns

## Detections per month

.onl phishing domains detected per month: 54 from 2025-11 to 2026-10; peak 16.

## Brands and registrars

### Impersonated brands

- [SushiSwap](https://phishdestroy.io/brand/sushiswap/)21
- [Google](https://phishdestroy.io/brand/google/)20
- [Fake Staking](https://phishdestroy.io/brand/fake-staking/)2
- [Coinbase](https://phishdestroy.io/brand/coinbase/)1
- [Raydium](https://phishdestroy.io/brand/raydium/)1
- [Bank of america](https://phishdestroy.io/brand/bank-of-america/)1
- [Ethereum](https://phishdestroy.io/brand/ethereum/)1
- [Instagram](https://phishdestroy.io/brand/instagram/)1

### Registrars

- [Dynadot](https://phishdestroy.io/registrar/dynadot/)42
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)12
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)5
- [Porkbun](https://phishdestroy.io/registrar/porkbun/)3
- [Gname.com](https://phishdestroy.io/registrar/name-com/)2
- Cloudflare1
- [Amazon Registrar](https://phishdestroy.io/registrar/amazon-registrar/)1
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)1

## Latest .onl phishing domains

The 30 most recently detected .onl domains
Domain | First detected | Status at last check | Registrar | 
[hvvl.onl](https://phishdestroy.io/domain/hvvl.onl/) | 2026-10-01 | Online | Dynadot | 
[yunk-frerink.alc.onl](https://phishdestroy.io/domain/yunk-frerink.alc.onl/) | 2026-09-17 | Online | Porkbun | 
[cityprimetrustpay.onl](https://phishdestroy.io/domain/cityprimetrustpay.onl/) | 2026-09-11 | Online | Dynadot | 
[fpb.onl](https://phishdestroy.io/domain/fpb.onl/) | 2026-09-11 | Online | Dynadot | 
[cityprimetrustpay.onl.qylo.onl](https://phishdestroy.io/domain/cityprimetrustpay.onl.qylo.onl/) | 2026-09-11 | Offline | DYNADOT | 
[marsmarket.onl](https://phishdestroy.io/domain/marsmarket.onl/) | 2026-08-31 | Online | Dynadot | 
[unijoin.onl](https://phishdestroy.io/domain/unijoin.onl/) | 2026-08-28 | Online | Dynadot | 
[naga99.onl](https://phishdestroy.io/domain/naga99.onl/) | 2026-07-03 | Online | Dynadot | 
[tr.madridbet-gir.onl](https://phishdestroy.io/domain/tr.madridbet-gir.onl/) | 2026-06-23 | Offline | Dynadot | 
[darkmattermarket.onl](https://phishdestroy.io/domain/darkmattermarket.onl/) | 2026-06-15 | Online | Dynadot | 
[airdropsalert.onl](https://phishdestroy.io/domain/airdropsalert.onl/) | 2026-04-22 | Online | Dynadot | 
[tokenpocket.onl](https://phishdestroy.io/domain/tokenpocket.onl/) | 2026-04-15 | Taken down | Dynadot | 
[s.safebank.onl](https://phishdestroy.io/domain/s.safebank.onl/) | 2026-04-05 | Offline | MarkMonitor | 
[minecraftapk.onl](https://phishdestroy.io/domain/minecraftapk.onl/) | 2026-04-03 | Online | NameCheap | 
[solanapay.onl](https://phishdestroy.io/domain/solanapay.onl/) | 2026-03-28 | Online | Dynadot | 
[testturing.tur.onl](https://phishdestroy.io/domain/testturing.tur.onl/) | 2026-03-07 | Online | Amazon Registrar | 
[bypayco-be.onl](https://phishdestroy.io/domain/bypayco-be.onl/) | 2026-03-06 | Online | NameSilo | 
[zyncoin.sushi.onl](https://phishdestroy.io/domain/zyncoin.sushi.onl/) | 2026-02-26 | Offline | — | 
[dogelon.sushi.onl](https://phishdestroy.io/domain/dogelon.sushi.onl/) | 2026-02-26 | Offline | — | 
[nearprotocol.sushi.onl](https://phishdestroy.io/domain/nearprotocol.sushi.onl/) | 2026-02-26 | Offline | — | 
[jweb-baseiinetmx.onl](https://phishdestroy.io/domain/jweb-baseiinetmx.onl/) | 2026-02-26 | Offline | — | 
[stakingsrewards.onl](https://phishdestroy.io/domain/stakingsrewards.onl/) | 2026-02-26 | Offline | Dynadot | 
[wweb-baseiinetmx.onl](https://phishdestroy.io/domain/wweb-baseiinetmx.onl/) | 2026-02-26 | Offline | — | 
[vitadao.sushi.onl](https://phishdestroy.io/domain/vitadao.sushi.onl/) | 2026-02-26 | Offline | — | 
[aml.onl](https://phishdestroy.io/domain/aml.onl/) | 2026-02-26 | Offline | — | 
[tornadocash.onl](https://phishdestroy.io/domain/tornadocash.onl/) | 2026-02-26 | Offline | Porkbun | 
[lbank.onl](https://phishdestroy.io/domain/lbank.onl/) | 2026-02-24 | Offline | Gname.com | 
[doge.sushi-cc.onl](https://phishdestroy.io/domain/doge.sushi-cc.onl/) | 2026-01-25 | Offline | Dynadot | 
[astr.stakingsrewards.onl](https://phishdestroy.io/domain/astr.stakingsrewards.onl/) | 2026-01-20 | Offline | Dynadot | 
[airdropalerts.onl](https://phishdestroy.io/domain/airdropalerts.onl/) | 2026-01-04 | Offline | Dynadot | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .onl registrations; first .onl report 2025-08-11.

Canonical: https://phishdestroy.io/tld/onl/