# Phishing domains under .wtf

.wtf accounts for 31 of the 224,866 domains in the PhishDestroy database (0.01%), with 2 new ones in the last 30 days. The most impersonated brand under .wtf is Telegram. 19 were online at the last check and 4 have a confirmed takedown.

31Reported .wtf domains

0.01%Share of PhishDestroy reports

2Last 30 days

4Confirmed takedowns

## Detections per month

.wtf phishing domains detected per month: 25 from 2025-11 to 2026-10; peak 5.

## Brands and registrars

### Impersonated brands

- [Telegram](https://phishdestroy.io/brand/telegram/)3
- [Hyperliquid](https://phishdestroy.io/brand/hyperliquid/)2
- [MetaMask](https://phishdestroy.io/brand/metamask/)2
- [Ankr](https://phishdestroy.io/brand/ankr/)1
- [Dexscreener](https://phishdestroy.io/brand/dexscreener/)1
- [Solana](https://phishdestroy.io/brand/solana/)1
- [BNB Chain](https://phishdestroy.io/brand/bnb-chain/)1
- [Bitget](https://phishdestroy.io/brand/bitget/)1

### Registrars

- [NameCheap](https://phishdestroy.io/registrar/namecheap/)7
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)5
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)3
- [Spaceship](https://phishdestroy.io/registrar/spaceship/)3
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)2
- Cloudflare2
- Vercel2
- [Tucows Domains](https://phishdestroy.io/registrar/tucows/)2

## Latest .wtf phishing domains

The 30 most recently detected .wtf domains
Domain | First detected | Status at last check | Registrar | 
[lcnwtf.wtf](https://phishdestroy.io/domain/lcnwtf.wtf/) | 2026-10-07 | Online | NICENIC | 
[fortix.wtf](https://phishdestroy.io/domain/fortix.wtf/) | 2026-10-06 | Online | Spaceship | 
[robincard.wtf](https://phishdestroy.io/domain/robincard.wtf/) | 2026-09-11 | Online | NameCheap | 
[darkweb.wtf](https://phishdestroy.io/domain/darkweb.wtf/) | 2026-08-31 | Online | Tucows Domains | 
[caser.wtf](https://phishdestroy.io/domain/caser.wtf/) | 2026-08-25 | Offline | Spaceship | 
[upgrader.wtf](https://phishdestroy.io/domain/upgrader.wtf/) | 2026-08-25 | Offline | NameCheap | 
[nudeai.wtf](https://phishdestroy.io/domain/nudeai.wtf/) | 2026-08-05 | Online | Global Domain | 
[launchdrip.wtf](https://phishdestroy.io/domain/launchdrip.wtf/) | 2026-08-04 | Offline | HOSTINGER operations | 
[wishbank.wtf](https://phishdestroy.io/domain/wishbank.wtf/) | 2026-07-14 | Online | GoDaddy.com | 
[wagyu.wtf](https://phishdestroy.io/domain/wagyu.wtf/) | 2026-07-08 | Offline | Spaceship | 
[hyperliiquid.wtf](https://phishdestroy.io/domain/hyperliiquid.wtf/) | 2026-07-06 | Offline | Name.com | 
[changelly.wtf](https://phishdestroy.io/domain/changelly.wtf/) | 2026-06-20 | Online | NICENIC | 
[melania.wtf](https://phishdestroy.io/domain/melania.wtf/) | 2026-06-20 | Online | GoDaddy.com | 
[h5.bitget.wtf](https://phishdestroy.io/domain/h5.bitget.wtf/) | 2026-06-18 | Offline | GoDaddy.com | 
[gitbook.wtf](https://phishdestroy.io/domain/gitbook.wtf/) | 2026-06-15 | Online | NameCheap | 
[dinodrop.wtf](https://phishdestroy.io/domain/dinodrop.wtf/) | 2026-06-15 | Online | NICENIC | 
[tralalero-user.bandit.wtf](https://phishdestroy.io/domain/tralalero-user.bandit.wtf/) | 2026-05-31 | Offline | GoDaddy.com | 
[spiderpigbnb.wtf](https://phishdestroy.io/domain/spiderpigbnb.wtf/) | 2026-04-01 | Online | NameCheap | 
[hashpet.wtf](https://phishdestroy.io/domain/hashpet.wtf/) | 2026-03-07 | Online | GoDaddy.com | 
[etherbutts.wtf](https://phishdestroy.io/domain/etherbutts.wtf/) | 2026-02-26 | Online | NameCheap | 
[floppabase.wtf](https://phishdestroy.io/domain/floppabase.wtf/) | 2026-02-26 | Taken down | NameSilo | 
[hyperliquid.wtf](https://phishdestroy.io/domain/hyperliquid.wtf/) | 2026-02-26 | Offline | NameCheap | 
[wlfisol.wtf](https://phishdestroy.io/domain/wlfisol.wtf/) | 2026-02-21 | Online | Tucows Domains | 
[addictedtoshitcoins.wtf](https://phishdestroy.io/domain/addictedtoshitcoins.wtf/) | 2026-02-01 | Online | NameCheap | 
[migrateslerf.wtf](https://phishdestroy.io/domain/migrateslerf.wtf/) | 2025-11-16 | Taken down | Cloudflare | 
[gone.wtf](https://phishdestroy.io/domain/gone.wtf/) | 2025-10-17 | Online | Vercel | 
[dexscreener.wtf](https://phishdestroy.io/domain/dexscreener.wtf/) | 2025-10-16 | Online | Vercel | 
[slertfmigration.wtf](https://phishdestroy.io/domain/slertfmigration.wtf/) | 2025-10-15 | Taken down | Cloudflare | 
[migration-slerf.wtf](https://phishdestroy.io/domain/migration-slerf.wtf/) | 2025-09-09 | Online | NameSilo | 
[projectcoin.wtf](https://phishdestroy.io/domain/projectcoin.wtf/) | 2025-09-01 | Taken down | Porkbun | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .wtf registrations; first .wtf report 2024-07-26.

Canonical: https://phishdestroy.io/tld/wtf/