Phishing domains under .wtf

.wtf accounts for 31 of the 224,866 domains in the PhishDestroy database (0.01%), with 2 new ones in the last 30 days. The most impersonated brand under .wtf is Telegram. 19 were online at the last check and 4 have a confirmed takedown.

31
Reported .wtf domains
0.01%
Share of PhishDestroy reports
2
Last 30 days
4
Confirmed takedowns

Detections per month

2025-11: 12025-12: 02026-01: 02026-02: 52026-03: 12026-04: 12026-05: 12026-06: 52026-07: 32026-08: 52026-09: 12026-10: 2
.wtf phishing domains detected per month: 25 from 2025-11 to 2026-10; peak 5.

Brands and registrars

Impersonated brands

  1. Telegram3
  2. Hyperliquid2
  3. MetaMask2
  4. Ankr1
  5. Dexscreener1
  6. Solana1
  7. BNB Chain1
  8. Bitget1

Registrars

  1. NameCheap7
  2. GoDaddy.com5
  3. NICENIC3
  4. Spaceship3
  5. NameSilo2
  6. Cloudflare2
  7. Vercel2
  8. Tucows Domains2

Latest .wtf phishing domains

The 30 most recently detected .wtf domains
DomainFirst detectedStatus at last checkRegistrar
lcnwtf.wtf2026-10-07OnlineNICENIC
fortix.wtf2026-10-06OnlineSpaceship
robincard.wtf2026-09-11OnlineNameCheap
darkweb.wtf2026-08-31OnlineTucows Domains
caser.wtf2026-08-25OfflineSpaceship
upgrader.wtf2026-08-25OfflineNameCheap
nudeai.wtf2026-08-05OnlineGlobal Domain
launchdrip.wtf2026-08-04OfflineHOSTINGER operations
wishbank.wtf2026-07-14OnlineGoDaddy.com
wagyu.wtf2026-07-08OfflineSpaceship
hyperliiquid.wtf2026-07-06OfflineName.com
changelly.wtf2026-06-20OnlineNICENIC
melania.wtf2026-06-20OnlineGoDaddy.com
h5.bitget.wtf2026-06-18OfflineGoDaddy.com
gitbook.wtf2026-06-15OnlineNameCheap
dinodrop.wtf2026-06-15OnlineNICENIC
tralalero-user.bandit.wtf2026-05-31OfflineGoDaddy.com
spiderpigbnb.wtf2026-04-01OnlineNameCheap
hashpet.wtf2026-03-07OnlineGoDaddy.com
etherbutts.wtf2026-02-26OnlineNameCheap
floppabase.wtf2026-02-26Taken downNameSilo
hyperliquid.wtf2026-02-26OfflineNameCheap
wlfisol.wtf2026-02-21OnlineTucows Domains
addictedtoshitcoins.wtf2026-02-01OnlineNameCheap
migrateslerf.wtf2025-11-16Taken downCloudflare
gone.wtf2025-10-17OnlineVercel
dexscreener.wtf2025-10-16OnlineVercel
slertfmigration.wtf2025-10-15Taken downCloudflare
migration-slerf.wtf2025-09-09OnlineNameSilo
projectcoin.wtf2025-09-01Taken downPorkbun

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .wtf registrations; first .wtf report 2024-07-26.