# Phishing domains under .sh

.sh accounts for 172 of the 224,866 domains in the PhishDestroy database (0.08%), with 1 new ones in the last 30 days. The most impersonated brand under .sh is Credit Agricole. 25 were online at the last check and 75 have a confirmed takedown.

172Reported .sh domains

0.08%Share of PhishDestroy reports

1Last 30 days

75Confirmed takedowns

## Detections per month

.sh phishing domains detected per month: 132 from 2025-11 to 2026-10; peak 30.

## Brands and registrars

### Impersonated brands

- [Credit Agricole](https://phishdestroy.io/brand/credit-agricole/)23
- [Facebook](https://phishdestroy.io/brand/facebook/)19
- [Facebook](https://phishdestroy.io/brand/facebook/)16
- [Trust Wallet](https://phishdestroy.io/brand/trust-wallet/)7
- [Google](https://phishdestroy.io/brand/google/)4
- [Trust Wallet](https://phishdestroy.io/brand/trust-wallet/)3
- [Arbitrum](https://phishdestroy.io/brand/arbitrum/)3
- [Yahoo](https://phishdestroy.io/brand/yahoo/)2

### Registrars

- Surge.sh131
- [Tucows Domains](https://phishdestroy.io/registrar/tucows/)8
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)8
- [Porkbun](https://phishdestroy.io/registrar/porkbun/)4
- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)4
- [NAMECHEAP](https://phishdestroy.io/registrar/namecheap/)4
- [Amazon Registrar](https://phishdestroy.io/registrar/amazon-registrar/)2
- Immaterialism2

## Latest .sh phishing domains

The 30 most recently detected .sh domains
Domain | First detected | Status at last check | Registrar | 
[smart-passport.singular.sh](https://phishdestroy.io/domain/smart-passport.singular.sh/) | 2026-10-14 | Online | NAMECHEAP | 
[claim-flap.sh](https://phishdestroy.io/domain/claim-flap.sh/) | 2026-09-06 | Offline | NICENIC | 
[msgg-serves.surge.sh](https://phishdestroy.io/domain/msgg-serves.surge.sh/) | 2026-09-04 | Online | Surge.sh | 
[my-new-bnb-bsccoin.surge.sh](https://phishdestroy.io/domain/my-new-bnb-bsccoin.surge.sh/) | 2026-09-02 | Offline | Surge.sh | 
[go-for-free-verify-badge-here.surge.sh](https://phishdestroy.io/domain/go-for-free-verify-badge-here.surge.sh/) | 2026-09-02 | Offline | Surge.sh | 
[usd-bsccoins.surge.sh](https://phishdestroy.io/domain/usd-bsccoins.surge.sh/) | 2026-09-01 | Offline | Surge.sh | 
[darknet.sh](https://phishdestroy.io/domain/darknet.sh/) | 2026-08-31 | Online | NameSilo | 
[boxd.sh](https://phishdestroy.io/domain/boxd.sh/) | 2026-08-31 | Online | NAMECHEAP | 
[new-click-app-99.surge.sh](https://phishdestroy.io/domain/new-click-app-99.surge.sh/) | 2026-08-31 | Offline | Surge.sh | 
[kolkata-fix-frant.surge.sh](https://phishdestroy.io/domain/kolkata-fix-frant.surge.sh/) | 2026-08-31 | Offline | Surge.sh | 
[ragebait.surge.sh](https://phishdestroy.io/domain/ragebait.surge.sh/) | 2026-08-26 | Offline | Surge.sh | 
[corelabs.sh](https://phishdestroy.io/domain/corelabs.sh/) | 2026-08-24 | Unknown | NICENIC | 
[trustwallet-cryptocard.surge.sh](https://phishdestroy.io/domain/trustwallet-cryptocard.surge.sh/) | 2026-08-20 | Offline | Surge.sh | 
[1inch-com-swap.surge.sh](https://phishdestroy.io/domain/1inch-com-swap.surge.sh/) | 2026-08-17 | Offline | Surge.sh | 
[orca-boxd-fork-orca-9ba527d3-cb00-41b6-b.boxd.sh](https://phishdestroy.io/domain/orca-boxd-fork-orca-9ba527d3-cb00-41b6-b.boxd.sh/) | 2026-08-16 | Online | NameCheap | 
[orca-boxd-fork-orca-7afce6e7-1ad3-43bb-8.boxd.sh](https://phishdestroy.io/domain/orca-boxd-fork-orca-7afce6e7-1ad3-43bb-8.boxd.sh/) | 2026-08-16 | Offline | NAMECHEAP | 
[auth.proximity.sh](https://phishdestroy.io/domain/auth.proximity.sh/) | 2026-08-05 | Online | NAMECHEAP | 
[enlist-flap.sh](https://phishdestroy.io/domain/enlist-flap.sh/) | 2026-08-04 | Offline | NICENIC | 
[verified-badge-submission-panneloo.surge.sh](https://phishdestroy.io/domain/verified-badge-submission-panneloo.surge.sh/) | 2026-08-03 | Offline | Surge.sh | 
[permanent-verified-blue-tick.surge.sh](https://phishdestroy.io/domain/permanent-verified-blue-tick.surge.sh/) | 2026-08-01 | Offline | Surge.sh | 
[apply-blue-mark-now.surge.sh](https://phishdestroy.io/domain/apply-blue-mark-now.surge.sh/) | 2026-08-01 | Offline | Surge.sh | 
[all-done-form-here-me.surge.sh](https://phishdestroy.io/domain/all-done-form-here-me.surge.sh/) | 2026-08-01 | Offline | Surge.sh | 
[compelete-verified-blue.surge.sh](https://phishdestroy.io/domain/compelete-verified-blue.surge.sh/) | 2026-08-01 | Offline | Surge.sh | 
[get-all-information-for-blue.surge.sh](https://phishdestroy.io/domain/get-all-information-for-blue.surge.sh/) | 2026-08-01 | Offline | Surge.sh | 
[verify-user.surge.sh](https://phishdestroy.io/domain/verify-user.surge.sh/) | 2026-07-30 | Offline | Surge.sh | 
[exodus-card.surge.sh](https://phishdestroy.io/domain/exodus-card.surge.sh/) | 2026-07-28 | Offline | Surge.sh | 
[submit-your-form-here.surge.sh](https://phishdestroy.io/domain/submit-your-form-here.surge.sh/) | 2026-07-28 | Offline | Surge.sh | 
[free-blue-verified-badge.surge.sh](https://phishdestroy.io/domain/free-blue-verified-badge.surge.sh/) | 2026-07-28 | Offline | Surge.sh | 
[badge-free-lifetime-verified.surge.sh](https://phishdestroy.io/domain/badge-free-lifetime-verified.surge.sh/) | 2026-07-28 | Offline | Surge.sh | 
[fou.sh](https://phishdestroy.io/domain/fou.sh/) | 2026-07-27 | Online | Gandi | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .sh registrations; first .sh report 2025-08-10.

Canonical: https://phishdestroy.io/tld/sh/