# Phishing domains under .xyz

.xyz accounts for 10,450 of the 224,866 domains in the PhishDestroy database (4.65%), with 677 new ones in the last 30 days. The most impersonated brand under .xyz is MetaMask. 2,183 were online at the last check and 539 have a confirmed takedown.

10,450Reported .xyz domains

4.65%Share of PhishDestroy reports

677Last 30 days

539Confirmed takedowns

## Detections per month

.xyz phishing domains detected per month: 8,827 from 2025-11 to 2026-10; peak 2,449.

## Brands and registrars

### Impersonated brands

- [MetaMask](https://phishdestroy.io/brand/metamask/)563
- [Bet365](https://phishdestroy.io/brand/bet365/)510
- [Google](https://phishdestroy.io/brand/google/)271
- [Solana](https://phishdestroy.io/brand/solana/)271
- [SushiSwap](https://phishdestroy.io/brand/sushiswap/)163
- [Hyperliquid](https://phishdestroy.io/brand/hyperliquid/)162
- [Coinbase](https://phishdestroy.io/brand/coinbase/)161
- [Binance](https://phishdestroy.io/brand/binance/)160

### Registrars

- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)1,974
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)1,675
- [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)1,019
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)660
- [Gname.com](https://phishdestroy.io/registrar/name-com/)586
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)544
- [OwnRegistrar](https://phishdestroy.io/registrar/ownregistrar/)455
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)259

## Latest .xyz phishing domains

The 30 most recently detected .xyz domains
Domain | First detected | Status at last check | Registrar | 
[kazimer777.xyz](https://phishdestroy.io/domain/kazimer777.xyz/) | 2026-10-22 | Unknown | Spaceship | 
[stonlklfun.xyz](https://phishdestroy.io/domain/stonlklfun.xyz/) | 2026-10-22 | Online | NICENIC | 
[paprertradae.xyz](https://phishdestroy.io/domain/paprertradae.xyz/) | 2026-10-22 | Online | NICENIC | 
[trontrace.xyz](https://phishdestroy.io/domain/trontrace.xyz/) | 2026-10-22 | Online | NICENIC | 
[australiaxclmemainnet.xyz](https://phishdestroy.io/domain/australiaxclmemainnet.xyz/) | 2026-10-22 | Online | Dynadot | 
[mydpd.jdevr.xyz](https://phishdestroy.io/domain/mydpd.jdevr.xyz/) | 2026-10-22 | Unknown | NameSilo | 
[reward-kinetiqfnd.xyz](https://phishdestroy.io/domain/reward-kinetiqfnd.xyz/) | 2026-10-21 | Unknown | NICENIC | 
[fables-proposals.xyz](https://phishdestroy.io/domain/fables-proposals.xyz/) | 2026-10-21 | Unknown | NICENIC | 
[fables-proposal.xyz](https://phishdestroy.io/domain/fables-proposal.xyz/) | 2026-10-21 | Unknown | NICENIC | 
[taskerx.800876.xyz](https://phishdestroy.io/domain/taskerx.800876.xyz/) | 2026-10-21 | Offline | Name.com | 
[rewards-fables.xyz](https://phishdestroy.io/domain/rewards-fables.xyz/) | 2026-10-21 | Unknown | NICENIC | 
[mishmaxoen.xyz](https://phishdestroy.io/domain/mishmaxoen.xyz/) | 2026-10-21 | Online | Eranet | 
[fables-votings.xyz](https://phishdestroy.io/domain/fables-votings.xyz/) | 2026-10-21 | Unknown | NICENIC | 
[fables-votes.xyz](https://phishdestroy.io/domain/fables-votes.xyz/) | 2026-10-21 | Unknown | NICENIC | 
[votings-fables.xyz](https://phishdestroy.io/domain/votings-fables.xyz/) | 2026-10-21 | Unknown | NICENIC | 
[hyperliquid-en.xyz](https://phishdestroy.io/domain/hyperliquid-en.xyz/) | 2026-10-21 | Online | PublicDomainRegistry.com | 
[strkshield.xyz](https://phishdestroy.io/domain/strkshield.xyz/) | 2026-10-21 | Online | Porkbun | 
[sitemvgu4nlkkybe.xyz](https://phishdestroy.io/domain/sitemvgu4nlkkybe.xyz/) | 2026-10-20 | Online | Eranet | 
[whitelist-accrosapi.xyz](https://phishdestroy.io/domain/whitelist-accrosapi.xyz/) | 2026-10-20 | Offline | NICENIC | 
[streamoors.xyz](https://phishdestroy.io/domain/streamoors.xyz/) | 2026-10-20 | Online | NICENIC | 
[veililt.xyz](https://phishdestroy.io/domain/veililt.xyz/) | 2026-10-20 | Online | NICENIC | 
[migrate-superseed.xyz](https://phishdestroy.io/domain/migrate-superseed.xyz/) | 2026-10-20 | Unknown | NICENIC | 
[nigat99.xyz](https://phishdestroy.io/domain/nigat99.xyz/) | 2026-10-20 | Unknown | NICENIC | 
[freua.xyz](https://phishdestroy.io/domain/freua.xyz/) | 2026-10-20 | Unknown | NICENIC | 
[collectrcrypt.xyz](https://phishdestroy.io/domain/collectrcrypt.xyz/) | 2026-10-20 | Online | NICENIC | 
[cardlboardtradle.xyz](https://phishdestroy.io/domain/cardlboardtradle.xyz/) | 2026-10-20 | Unknown | NICENIC | 
[stoneventure2.xyz](https://phishdestroy.io/domain/stoneventure2.xyz/) | 2026-10-20 | Online | NICENIC | 
[governances-aero.xyz](https://phishdestroy.io/domain/governances-aero.xyz/) | 2026-10-20 | Online | NICENIC | 
[evm-access.xyz](https://phishdestroy.io/domain/evm-access.xyz/) | 2026-10-20 | Unknown | NICENIC | 
[monlock.xyz](https://phishdestroy.io/domain/monlock.xyz/) | 2026-10-20 | Online | NameCheap | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .xyz registrations; first .xyz report 2024-03-19.

Canonical: https://phishdestroy.io/tld/xyz/