Phishing domains under .vip

.vip accounts for 2,085 of the 224,866 domains in the PhishDestroy database (0.93%), with 48 new ones in the last 30 days. The most impersonated brand under .vip is Bet365. 741 were online at the last check and 158 have a confirmed takedown.

2,085
Reported .vip domains
0.93%
Share of PhishDestroy reports
48
Last 30 days
158
Confirmed takedowns

Detections per month

2025-11: 762025-12: 942026-01: 1052026-02: 4122026-03: 1822026-04: 882026-05: 522026-06: 3972026-07: 2692026-08: 1262026-09: 652026-10: 38
.vip phishing domains detected per month: 1,904 from 2025-11 to 2026-10; peak 412.

Brands and registrars

Impersonated brands

  1. Bet365133
  2. Google55
  3. MetaMask54
  4. WhatsApp44
  5. Cloudflare28
  6. Kraken26
  7. Binance26
  8. Coinbase19

Registrars

  1. Gname.com512
  2. NiceNIC228
  3. NICENIC192
  4. Dynadot164
  5. NameMart162
  6. Namemart124
  7. Dynadot103
  8. NameSilo82

Latest .vip phishing domains

The 30 most recently detected .vip domains
DomainFirst detectedStatus at last checkRegistrar
legmao.vip2026-10-22Online—
spc-ph.vip2026-10-20OnlineNameSilo
spc-ai.vip2026-10-20OnlineNameSilo
getsurecard.vip2026-10-20OnlineNICENIC
678940.vip2026-10-19OnlineDYNADOT
asaxu.vip2026-10-19OfflineDYNADOT
ganar2026it.vip2026-10-17OnlineGname.com
ganar2026sp.vip2026-10-17OnlineGname.com
strendus.vip2026-10-16OfflineDynadot
multivers.vip2026-10-15OnlineNameSilo
hoodpad.vip2026-10-15OnlineNameSilo
instander.vip2026-10-15OnlinePorkbun
royal-captal-ex.vip2026-10-14OnlineNameMart
mettax.vip2026-10-14OnlineGoDaddy.com
ameriean-expiess.vip2026-10-14OnlineNameSilo
pinkbridge.vip2026-10-13OnlineGlobal Domain
cryptoairdropnews.vip2026-10-13OnlineDYNADOT
3lk94f.go.watchs.vip2026-10-13OfflineDYNADOT
american-expiess.vip2026-10-13OnlineNameSilo
auroravivid.vip2026-10-13OnlineNameSilo
sigmabull.vip2026-10-13OnlineDYNADOT
metks.vip2026-10-13OnlineDominet (HK)
webs3coinme.vip2026-10-11OnlineNameMart
trmeritking.vip2026-10-11UnknownNICENIC
madridbt-barut.vip2026-10-10OnlineRegistrar.eu
jeanphil.vip2026-10-10OnlineNICENIC
onchnia.vip2026-10-09OnlineGname.com
zkdarkpool.vip2026-10-09OnlineNamemart
sbigold.vip2026-10-09OnlineDynadot
icatrade.vip2026-10-09OnlineGname.com

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .vip registrations; first .vip report 2025-07-03.