# Phishing domains under .run

.run accounts for 340 of the 224,866 domains in the PhishDestroy database (0.15%), with 22 new ones in the last 30 days. The most impersonated brand under .run is PancakeSwap. 135 were online at the last check and 33 have a confirmed takedown.

340Reported .run domains

0.15%Share of PhishDestroy reports

22Last 30 days

33Confirmed takedowns

## Detections per month

.run phishing domains detected per month: 288 from 2025-11 to 2026-10; peak 103.

## Brands and registrars

### Impersonated brands

- [PancakeSwap](https://phishdestroy.io/brand/pancakeswap/)10
- [Apple](https://phishdestroy.io/brand/apple/)10
- [Microsoft](https://phishdestroy.io/brand/microsoft/)8
- [Binance](https://phishdestroy.io/brand/binance/)8
- [Solana](https://phishdestroy.io/brand/solana/)6
- [Ledger](https://phishdestroy.io/brand/ledger/)6
- [Coinbase](https://phishdestroy.io/brand/coinbase/)6
- [Trezor](https://phishdestroy.io/brand/trezor/)4

### Registrars

- [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)124
- Cloudflare31
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)26
- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)22
- [Amazon Registrar](https://phishdestroy.io/registrar/amazon-registrar/)17
- [Tucows Domains](https://phishdestroy.io/registrar/tucows/)12
- HiChina (www.net.cn)10
- Cloudflare10

## Latest .run phishing domains

The 30 most recently detected .run domains
Domain | First detected | Status at last check | Registrar | 
[stashpatrick.run](https://phishdestroy.io/domain/stashpatrick.run/) | 2026-10-22 | Online | NICENIC | 
[poratls.run](https://phishdestroy.io/domain/poratls.run/) | 2026-10-21 | Online | NICENIC | 
[simplsewap.run](https://phishdestroy.io/domain/simplsewap.run/) | 2026-10-21 | Online | NICENIC | 
[phaarohexchange.run](https://phishdestroy.io/domain/phaarohexchange.run/) | 2026-10-21 | Online | NICENIC | 
[sopohn.run](https://phishdestroy.io/domain/sopohn.run/) | 2026-10-21 | Online | NICENIC | 
[virtsuwap.run](https://phishdestroy.io/domain/virtsuwap.run/) | 2026-10-21 | Online | NICENIC | 
[illuivum.run](https://phishdestroy.io/domain/illuivum.run/) | 2026-10-21 | Online | NICENIC | 
[prpeo.run](https://phishdestroy.io/domain/prpeo.run/) | 2026-10-21 | Online | NICENIC | 
[craemfinance.run](https://phishdestroy.io/domain/craemfinance.run/) | 2026-10-21 | Online | NICENIC | 
[arbdiex.run](https://phishdestroy.io/domain/arbdiex.run/) | 2026-10-21 | Online | NICENIC | 
[aeov.run](https://phishdestroy.io/domain/aeov.run/) | 2026-10-21 | Online | NICENIC | 
[treufi.run](https://phishdestroy.io/domain/treufi.run/) | 2026-10-21 | Online | NICENIC | 
[zetachain.run](https://phishdestroy.io/domain/zetachain.run/) | 2026-10-19 | Offline | PublicDomainRegistry.com | 
[ipgrussia.run](https://phishdestroy.io/domain/ipgrussia.run/) | 2026-10-09 | Online | NameSilo | 
[app.staketsone.run](https://phishdestroy.io/domain/app.staketsone.run/) | 2026-10-07 | Online | NICENIC | 
[why777.run](https://phishdestroy.io/domain/why777.run/) | 2026-10-07 | Online | NICENIC | 
[vpn-zero.run](https://phishdestroy.io/domain/vpn-zero.run/) | 2026-10-07 | Online | NICENIC | 
[bertie.run](https://phishdestroy.io/domain/bertie.run/) | 2026-10-07 | Offline | NICENIC | 
[bonanza.run](https://phishdestroy.io/domain/bonanza.run/) | 2026-10-04 | Online | NICENIC | 
[firelight.run](https://phishdestroy.io/domain/firelight.run/) | 2026-09-25 | Online | Eranet | 
[forcedrops.run](https://phishdestroy.io/domain/forcedrops.run/) | 2026-09-25 | Online | Dynadot | 
[force-drop.run](https://phishdestroy.io/domain/force-drop.run/) | 2026-09-25 | Online | Dynadot | 
[wick.run](https://phishdestroy.io/domain/wick.run/) | 2026-09-21 | Offline | PublicDomainRegistry.com | 
[rollbit.run](https://phishdestroy.io/domain/rollbit.run/) | 2026-09-19 | Online | Dynadot | 
[ripe.run](https://phishdestroy.io/domain/ripe.run/) | 2026-09-19 | Offline | PublicDomainRegistry.com | 
[dynamicsvg.plasmic.run](https://phishdestroy.io/domain/dynamicsvg.plasmic.run/) | 2026-09-13 | Online | Amazon Registrar | 
[wlive.plasmic.run](https://phishdestroy.io/domain/wlive.plasmic.run/) | 2026-09-12 | Online | Amazon Registrar | 
[livecdn.plasmic.run](https://phishdestroy.io/domain/livecdn.plasmic.run/) | 2026-09-12 | Online | Amazon Registrar | 
[cieldxrecovery.plasmic.run](https://phishdestroy.io/domain/cieldxrecovery.plasmic.run/) | 2026-09-12 | Online | Amazon Registrar | 
[livedesktop.plasmic.run](https://phishdestroy.io/domain/livedesktop.plasmic.run/) | 2026-09-12 | Online | Amazon Registrar | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .run registrations; first .run report 2025-07-12.

Canonical: https://phishdestroy.io/tld/run/