# Phishing domains under .vip

.vip accounts for 2,085 of the 224,866 domains in the PhishDestroy database (0.93%), with 48 new ones in the last 30 days. The most impersonated brand under .vip is Bet365. 741 were online at the last check and 158 have a confirmed takedown.

2,085Reported .vip domains

0.93%Share of PhishDestroy reports

48Last 30 days

158Confirmed takedowns

## Detections per month

.vip phishing domains detected per month: 1,904 from 2025-11 to 2026-10; peak 412.

## Brands and registrars

### Impersonated brands

- [Bet365](https://phishdestroy.io/brand/bet365/)133
- [Google](https://phishdestroy.io/brand/google/)55
- [MetaMask](https://phishdestroy.io/brand/metamask/)54
- [WhatsApp](https://phishdestroy.io/brand/whatsapp/)44
- [Cloudflare](https://phishdestroy.io/brand/cloudflare/)28
- [Kraken](https://phishdestroy.io/brand/kraken/)26
- [Binance](https://phishdestroy.io/brand/binance/)26
- [Coinbase](https://phishdestroy.io/brand/coinbase/)19

### Registrars

- [Gname.com](https://phishdestroy.io/registrar/name-com/)512
- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)228
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)192
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)164
- [NameMart](https://phishdestroy.io/registrar/namemart-pte-ltd/)162
- [Namemart](https://phishdestroy.io/registrar/namemart-pte-ltd/)124
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)103
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)82

## Latest .vip phishing domains

The 30 most recently detected .vip domains
Domain | First detected | Status at last check | Registrar | 
[legmao.vip](https://phishdestroy.io/domain/legmao.vip/) | 2026-10-22 | Online | — | 
[spc-ph.vip](https://phishdestroy.io/domain/spc-ph.vip/) | 2026-10-20 | Online | NameSilo | 
[spc-ai.vip](https://phishdestroy.io/domain/spc-ai.vip/) | 2026-10-20 | Online | NameSilo | 
[getsurecard.vip](https://phishdestroy.io/domain/getsurecard.vip/) | 2026-10-20 | Online | NICENIC | 
[678940.vip](https://phishdestroy.io/domain/678940.vip/) | 2026-10-19 | Online | DYNADOT | 
[asaxu.vip](https://phishdestroy.io/domain/asaxu.vip/) | 2026-10-19 | Offline | DYNADOT | 
[ganar2026it.vip](https://phishdestroy.io/domain/ganar2026it.vip/) | 2026-10-17 | Online | Gname.com | 
[ganar2026sp.vip](https://phishdestroy.io/domain/ganar2026sp.vip/) | 2026-10-17 | Online | Gname.com | 
[strendus.vip](https://phishdestroy.io/domain/strendus.vip/) | 2026-10-16 | Offline | Dynadot | 
[multivers.vip](https://phishdestroy.io/domain/multivers.vip/) | 2026-10-15 | Online | NameSilo | 
[hoodpad.vip](https://phishdestroy.io/domain/hoodpad.vip/) | 2026-10-15 | Online | NameSilo | 
[instander.vip](https://phishdestroy.io/domain/instander.vip/) | 2026-10-15 | Online | Porkbun | 
[royal-captal-ex.vip](https://phishdestroy.io/domain/royal-captal-ex.vip/) | 2026-10-14 | Online | NameMart | 
[mettax.vip](https://phishdestroy.io/domain/mettax.vip/) | 2026-10-14 | Online | GoDaddy.com | 
[ameriean-expiess.vip](https://phishdestroy.io/domain/ameriean-expiess.vip/) | 2026-10-14 | Online | NameSilo | 
[pinkbridge.vip](https://phishdestroy.io/domain/pinkbridge.vip/) | 2026-10-13 | Online | Global Domain | 
[cryptoairdropnews.vip](https://phishdestroy.io/domain/cryptoairdropnews.vip/) | 2026-10-13 | Online | DYNADOT | 
[3lk94f.go.watchs.vip](https://phishdestroy.io/domain/3lk94f.go.watchs.vip/) | 2026-10-13 | Offline | DYNADOT | 
[american-expiess.vip](https://phishdestroy.io/domain/american-expiess.vip/) | 2026-10-13 | Online | NameSilo | 
[auroravivid.vip](https://phishdestroy.io/domain/auroravivid.vip/) | 2026-10-13 | Online | NameSilo | 
[sigmabull.vip](https://phishdestroy.io/domain/sigmabull.vip/) | 2026-10-13 | Online | DYNADOT | 
[metks.vip](https://phishdestroy.io/domain/metks.vip/) | 2026-10-13 | Online | Dominet (HK) | 
[webs3coinme.vip](https://phishdestroy.io/domain/webs3coinme.vip/) | 2026-10-11 | Online | NameMart | 
[trmeritking.vip](https://phishdestroy.io/domain/trmeritking.vip/) | 2026-10-11 | Unknown | NICENIC | 
[madridbt-barut.vip](https://phishdestroy.io/domain/madridbt-barut.vip/) | 2026-10-10 | Online | Registrar.eu | 
[jeanphil.vip](https://phishdestroy.io/domain/jeanphil.vip/) | 2026-10-10 | Online | NICENIC | 
[onchnia.vip](https://phishdestroy.io/domain/onchnia.vip/) | 2026-10-09 | Online | Gname.com | 
[zkdarkpool.vip](https://phishdestroy.io/domain/zkdarkpool.vip/) | 2026-10-09 | Online | Namemart | 
[sbigold.vip](https://phishdestroy.io/domain/sbigold.vip/) | 2026-10-09 | Online | Dynadot | 
[icatrade.vip](https://phishdestroy.io/domain/icatrade.vip/) | 2026-10-09 | Online | Gname.com | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .vip registrations; first .vip report 2025-07-03.

Canonical: https://phishdestroy.io/tld/vip/