Phishing domains under .run

.run accounts for 340 of the 224,866 domains in the PhishDestroy database (0.15%), with 22 new ones in the last 30 days. The most impersonated brand under .run is PancakeSwap. 135 were online at the last check and 33 have a confirmed takedown.

340
Reported .run domains
0.15%
Share of PhishDestroy reports
22
Last 30 days
33
Confirmed takedowns

Detections per month

2025-11: 162025-12: 242026-01: 152026-02: 1032026-03: 292026-04: 92026-05: 112026-06: 92026-07: 242026-08: 82026-09: 212026-10: 19
.run phishing domains detected per month: 288 from 2025-11 to 2026-10; peak 103.

Brands and registrars

Impersonated brands

  1. PancakeSwap10
  2. Apple10
  3. Microsoft8
  4. Binance8
  5. Solana6
  6. Ledger6
  7. Coinbase6
  8. Trezor4

Registrars

  1. PublicDomainRegistry.com124
  2. Cloudflare31
  3. NICENIC26
  4. NiceNIC22
  5. Amazon Registrar17
  6. Tucows Domains12
  7. HiChina (www.net.cn)10
  8. Cloudflare10

Latest .run phishing domains

The 30 most recently detected .run domains
DomainFirst detectedStatus at last checkRegistrar
stashpatrick.run2026-10-22OnlineNICENIC
poratls.run2026-10-21OnlineNICENIC
simplsewap.run2026-10-21OnlineNICENIC
phaarohexchange.run2026-10-21OnlineNICENIC
sopohn.run2026-10-21OnlineNICENIC
virtsuwap.run2026-10-21OnlineNICENIC
illuivum.run2026-10-21OnlineNICENIC
prpeo.run2026-10-21OnlineNICENIC
craemfinance.run2026-10-21OnlineNICENIC
arbdiex.run2026-10-21OnlineNICENIC
aeov.run2026-10-21OnlineNICENIC
treufi.run2026-10-21OnlineNICENIC
zetachain.run2026-10-19OfflinePublicDomainRegistry.com
ipgrussia.run2026-10-09OnlineNameSilo
app.staketsone.run2026-10-07OnlineNICENIC
why777.run2026-10-07OnlineNICENIC
vpn-zero.run2026-10-07OnlineNICENIC
bertie.run2026-10-07OfflineNICENIC
bonanza.run2026-10-04OnlineNICENIC
firelight.run2026-09-25OnlineEranet
forcedrops.run2026-09-25OnlineDynadot
force-drop.run2026-09-25OnlineDynadot
wick.run2026-09-21OfflinePublicDomainRegistry.com
rollbit.run2026-09-19OnlineDynadot
ripe.run2026-09-19OfflinePublicDomainRegistry.com
dynamicsvg.plasmic.run2026-09-13OnlineAmazon Registrar
wlive.plasmic.run2026-09-12OnlineAmazon Registrar
livecdn.plasmic.run2026-09-12OnlineAmazon Registrar
cieldxrecovery.plasmic.run2026-09-12OnlineAmazon Registrar
livedesktop.plasmic.run2026-09-12OnlineAmazon Registrar

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .run registrations; first .run report 2025-07-12.