Phishing domains under .to

.to accounts for 393 of the 224,866 domains in the PhishDestroy database (0.17%), with 10 new ones in the last 30 days. The most impersonated brand under .to is MetaMask. 232 were online at the last check and 67 have a confirmed takedown.

393
Reported .to domains
0.17%
Share of PhishDestroy reports
10
Last 30 days
67
Confirmed takedowns

Detections per month

2025-11: 182025-12: 362026-01: 72026-02: 422026-03: 352026-04: 572026-05: 92026-06: 362026-07: 112026-08: 282026-09: 262026-10: 8
.to phishing domains detected per month: 313 from 2025-11 to 2026-10; peak 57.

Brands and registrars

Impersonated brands

  1. MetaMask25
  2. Ethereum21
  3. Google10
  4. Bitcoin9
  5. Uniswap8
  6. Rabby7
  7. Ledger7
  8. Solana7

Registrars

  1. Government of Kingdom of Tonga222
  2. NAMECHEAP39
  3. NameCheap34
  4. Spaceship18
  5. NAMECHEAP16
  6. NiceNIC14
  7. NICENIC12
  8. Dynadot7

Latest .to phishing domains

The 30 most recently detected .to domains
DomainFirst detectedStatus at last checkRegistrar
yomix.to2026-10-16OnlineDYNADOT
ethmix.to2026-10-14OnlineNAMECHEAP
ethereum-qr-code-generator.to2026-10-14OnlineTonic
litecoin-qr-code-generator.to2026-10-14OnlineTonic
com-qr.to2026-10-13OnlineNICENIC
en-atomicwallet.to2026-10-11OfflineTonic
ssnarmy.to2026-10-11OnlineTonic
us-tronlink.to2026-10-08OnlineTonic
tm24.to2026-09-27OnlineNICENIC
krakentor.to2026-09-25OnlineGovernment of Kingdom of Tonga
slmpieswap.to2026-09-19OfflineGovernment of Kingdom of Tonga
chengelly-info.to2026-09-19OnlineGovernment of Kingdom of Tonga
sideshift-info.to2026-09-19OnlineGovernment of Kingdom of Tonga
clv.to2026-09-19OnlineDynadot
web-simpleswap.to2026-09-19OnlineGovernment of Kingdom of Tonga
uniswap-info.to2026-09-19OnlineGovernment of Kingdom of Tonga
stealfhex.to2026-09-19OnlineGovernment of Kingdom of Tonga
amlbot.to2026-09-18OfflineGovernment of Kingdom of Tonga
mxservicexpres.to2026-09-17OnlineGovernment of Kingdom of Tonga
slon7.to2026-09-15OfflineGovernment of Kingdom of Tonga
hyperiiquid.to2026-09-15OnlineGovernment of Kingdom of Tonga
tripmaster.to2026-09-14OnlineNICENIC
unlswap.to2026-09-14OnlineGovernment of Kingdom of Tonga
uniswaps.to2026-09-14OnlineGovernment of Kingdom of Tonga
simpieswap-io.to2026-09-14OfflineGovernment of Kingdom of Tonga
slon89.to2026-09-13OnlineGovernment of Kingdom of Tonga
global-app.to2026-09-13OnlineGovernment of Kingdom of Tonga
romulti.to2026-09-10OnlineGovernment of Kingdom of Tonga
multitools.to2026-09-10OnlineGovernment of Kingdom of Tonga
bly.to2026-09-07OnlineNAMECHEAP

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .to registrations; first .to report 2025-07-12.