# Phishing domains under .to .to accounts for 393 of the 224,866 domains in the PhishDestroy database (0.17%), with 10 new ones in the last 30 days. The most impersonated brand under .to is MetaMask. 232 were online at the last check and 67 have a confirmed takedown. 393Reported .to domains 0.17%Share of PhishDestroy reports 10Last 30 days 67Confirmed takedowns ## Detections per month .to phishing domains detected per month: 313 from 2025-11 to 2026-10; peak 57. ## Brands and registrars ### Impersonated brands - [MetaMask](https://phishdestroy.io/brand/metamask/)25 - [Ethereum](https://phishdestroy.io/brand/ethereum/)21 - [Google](https://phishdestroy.io/brand/google/)10 - [Bitcoin](https://phishdestroy.io/brand/bitcoin/)9 - [Uniswap](https://phishdestroy.io/brand/uniswap/)8 - [Rabby](https://phishdestroy.io/brand/rabby/)7 - [Ledger](https://phishdestroy.io/brand/ledger/)7 - [Solana](https://phishdestroy.io/brand/solana/)7 ### Registrars - [Government of Kingdom of Tonga](https://phishdestroy.io/registrar/government-of-kingdom-of-tonga/)222 - [NAMECHEAP](https://phishdestroy.io/registrar/namecheap/)39 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)34 - [Spaceship](https://phishdestroy.io/registrar/spaceship/)18 - [NAMECHEAP](https://phishdestroy.io/registrar/namecheap/)16 - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)14 - [NICENIC](https://phishdestroy.io/registrar/nicenic/)12 - [Dynadot](https://phishdestroy.io/registrar/dynadot/)7 ## Latest .to phishing domains The 30 most recently detected .to domains Domain | First detected | Status at last check | Registrar | [yomix.to](https://phishdestroy.io/domain/yomix.to/) | 2026-10-16 | Online | DYNADOT | [ethmix.to](https://phishdestroy.io/domain/ethmix.to/) | 2026-10-14 | Online | NAMECHEAP | [ethereum-qr-code-generator.to](https://phishdestroy.io/domain/ethereum-qr-code-generator.to/) | 2026-10-14 | Online | Tonic | [litecoin-qr-code-generator.to](https://phishdestroy.io/domain/litecoin-qr-code-generator.to/) | 2026-10-14 | Online | Tonic | [com-qr.to](https://phishdestroy.io/domain/com-qr.to/) | 2026-10-13 | Online | NICENIC | [en-atomicwallet.to](https://phishdestroy.io/domain/en-atomicwallet.to/) | 2026-10-11 | Offline | Tonic | [ssnarmy.to](https://phishdestroy.io/domain/ssnarmy.to/) | 2026-10-11 | Online | Tonic | [us-tronlink.to](https://phishdestroy.io/domain/us-tronlink.to/) | 2026-10-08 | Online | Tonic | [tm24.to](https://phishdestroy.io/domain/tm24.to/) | 2026-09-27 | Online | NICENIC | [krakentor.to](https://phishdestroy.io/domain/krakentor.to/) | 2026-09-25 | Online | Government of Kingdom of Tonga | [slmpieswap.to](https://phishdestroy.io/domain/slmpieswap.to/) | 2026-09-19 | Offline | Government of Kingdom of Tonga | [chengelly-info.to](https://phishdestroy.io/domain/chengelly-info.to/) | 2026-09-19 | Online | Government of Kingdom of Tonga | [sideshift-info.to](https://phishdestroy.io/domain/sideshift-info.to/) | 2026-09-19 | Online | Government of Kingdom of Tonga | [clv.to](https://phishdestroy.io/domain/clv.to/) | 2026-09-19 | Online | Dynadot | [web-simpleswap.to](https://phishdestroy.io/domain/web-simpleswap.to/) | 2026-09-19 | Online | Government of Kingdom of Tonga | [uniswap-info.to](https://phishdestroy.io/domain/uniswap-info.to/) | 2026-09-19 | Online | Government of Kingdom of Tonga | [stealfhex.to](https://phishdestroy.io/domain/stealfhex.to/) | 2026-09-19 | Online | Government of Kingdom of Tonga | [amlbot.to](https://phishdestroy.io/domain/amlbot.to/) | 2026-09-18 | Offline | Government of Kingdom of Tonga | [mxservicexpres.to](https://phishdestroy.io/domain/mxservicexpres.to/) | 2026-09-17 | Online | Government of Kingdom of Tonga | [slon7.to](https://phishdestroy.io/domain/slon7.to/) | 2026-09-15 | Offline | Government of Kingdom of Tonga | [hyperiiquid.to](https://phishdestroy.io/domain/hyperiiquid.to/) | 2026-09-15 | Online | Government of Kingdom of Tonga | [tripmaster.to](https://phishdestroy.io/domain/tripmaster.to/) | 2026-09-14 | Online | NICENIC | [unlswap.to](https://phishdestroy.io/domain/unlswap.to/) | 2026-09-14 | Online | Government of Kingdom of Tonga | [uniswaps.to](https://phishdestroy.io/domain/uniswaps.to/) | 2026-09-14 | Online | Government of Kingdom of Tonga | [simpieswap-io.to](https://phishdestroy.io/domain/simpieswap-io.to/) | 2026-09-14 | Offline | Government of Kingdom of Tonga | [slon89.to](https://phishdestroy.io/domain/slon89.to/) | 2026-09-13 | Online | Government of Kingdom of Tonga | [global-app.to](https://phishdestroy.io/domain/global-app.to/) | 2026-09-13 | Online | Government of Kingdom of Tonga | [romulti.to](https://phishdestroy.io/domain/romulti.to/) | 2026-09-10 | Online | Government of Kingdom of Tonga | [multitools.to](https://phishdestroy.io/domain/multitools.to/) | 2026-09-10 | Online | Government of Kingdom of Tonga | [bly.to](https://phishdestroy.io/domain/bly.to/) | 2026-09-07 | Online | NAMECHEAP | ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [EPP status codes](https://phishdestroy.io/glossary/epp-status/) - [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains) - [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup) - [All TLDs](https://phishdestroy.io/tld/) Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .to registrations; first .to report 2025-07-12. Canonical: https://phishdestroy.io/tld/to/