Phishing domains under .sh

.sh accounts for 172 of the 224,866 domains in the PhishDestroy database (0.08%), with 1 new ones in the last 30 days. The most impersonated brand under .sh is Credit Agricole. 25 were online at the last check and 75 have a confirmed takedown.

172
Reported .sh domains
0.08%
Share of PhishDestroy reports
1
Last 30 days
75
Confirmed takedowns

Detections per month

2025-11: 302025-12: 42026-01: 52026-02: 142026-03: 52026-04: 12026-05: 82026-06: 262026-07: 152026-08: 182026-09: 52026-10: 1
.sh phishing domains detected per month: 132 from 2025-11 to 2026-10; peak 30.

Brands and registrars

Impersonated brands

  1. Credit Agricole23
  2. Facebook19
  3. Facebook16
  4. Trust Wallet7
  5. Google4
  6. Trust Wallet3
  7. Arbitrum3
  8. Yahoo2

Registrars

  1. Surge.sh131
  2. Tucows Domains8
  3. NICENIC8
  4. Porkbun4
  5. NiceNIC4
  6. NAMECHEAP4
  7. Amazon Registrar2
  8. Immaterialism2

Latest .sh phishing domains

The 30 most recently detected .sh domains
DomainFirst detectedStatus at last checkRegistrar
smart-passport.singular.sh2026-10-14OnlineNAMECHEAP
claim-flap.sh2026-09-06OfflineNICENIC
msgg-serves.surge.sh2026-09-04OnlineSurge.sh
my-new-bnb-bsccoin.surge.sh2026-09-02OfflineSurge.sh
go-for-free-verify-badge-here.surge.sh2026-09-02OfflineSurge.sh
usd-bsccoins.surge.sh2026-09-01OfflineSurge.sh
darknet.sh2026-08-31OnlineNameSilo
boxd.sh2026-08-31OnlineNAMECHEAP
new-click-app-99.surge.sh2026-08-31OfflineSurge.sh
kolkata-fix-frant.surge.sh2026-08-31OfflineSurge.sh
ragebait.surge.sh2026-08-26OfflineSurge.sh
corelabs.sh2026-08-24UnknownNICENIC
trustwallet-cryptocard.surge.sh2026-08-20OfflineSurge.sh
1inch-com-swap.surge.sh2026-08-17OfflineSurge.sh
orca-boxd-fork-orca-9ba527d3-cb00-41b6-b.boxd.sh2026-08-16OnlineNameCheap
orca-boxd-fork-orca-7afce6e7-1ad3-43bb-8.boxd.sh2026-08-16OfflineNAMECHEAP
auth.proximity.sh2026-08-05OnlineNAMECHEAP
enlist-flap.sh2026-08-04OfflineNICENIC
verified-badge-submission-panneloo.surge.sh2026-08-03OfflineSurge.sh
permanent-verified-blue-tick.surge.sh2026-08-01OfflineSurge.sh
apply-blue-mark-now.surge.sh2026-08-01OfflineSurge.sh
all-done-form-here-me.surge.sh2026-08-01OfflineSurge.sh
compelete-verified-blue.surge.sh2026-08-01OfflineSurge.sh
get-all-information-for-blue.surge.sh2026-08-01OfflineSurge.sh
verify-user.surge.sh2026-07-30OfflineSurge.sh
exodus-card.surge.sh2026-07-28OfflineSurge.sh
submit-your-form-here.surge.sh2026-07-28OfflineSurge.sh
free-blue-verified-badge.surge.sh2026-07-28OfflineSurge.sh
badge-free-lifetime-verified.surge.sh2026-07-28OfflineSurge.sh
fou.sh2026-07-27OnlineGandi

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .sh registrations; first .sh report 2025-08-10.