Disney+

Streaming & media United Statesdisneyplus.comRank 179 of the most impersonated
Cert findings · 24 h
2
Cert findings · 7 days
27
1 reported or listed · 26 on phishing hosts
Registered lookalikes
167
13 listed by a source or an address list
Official domains
126
verified from Disney+'s own sites and records

Certificate findings for Disney+

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Disney+'s name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 27 findings, grouped by hostname

  1. mydisneygiftcard.com US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    mydisneygiftcard.com
    First seen
    2026-11-05 09:04 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 216.245.213.78.
    1. Phishing-host list fetched with the address
    2. Resolved to 216.245.213.78
    Brand
    Disney+
    Addresses
    216.245.213.78 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    216.245.213.77 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    mydisneygiftcard.com
    Registered
    2018-04-30 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:27 UTC

    Suggest a correction

  2. disney.cm NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 y ago
    DetailsHide
    Hostname
    disney.cm
    First seen
    2026-11-05 09:02 UTC
    First published
    2026-10-28 07:41 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.7.194.71.
    1. Phishing-host list fetched with the address
    2. Resolved to 212.7.194.71
    Brand
    Disney+
    Addresses
    212.7.194.71 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    69.162.80.58 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    disney.cm
    Registered
    2009-08-28 · Netcom.cm Sarl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  3. disney-games.com US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    disney-games.com
    First seen
    2026-11-04 08:58 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 216.245.213.74.
    1. Phishing-host list fetched with the address
    2. Resolved to 216.245.213.74
    Brand
    Disney+
    Addresses
    216.245.213.74 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    77.247.182.249 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    Domain
    disney-games.com
    Registered
    2019-02-15 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

  4. www.disneyplusplus.com DE · AS24940 · HETZNER-AS Hetzner Online G…
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    www.disneyplusplus.com
    First seen
    2026-11-04 01:16 UTC
    First published
    2026-11-04 01:42 UTC
    DNS
    Resolves · checked 2026-11-05 01:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.98.101.145.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.98.101.145
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 00:14 UTC to 2027-02-02 00:14 UTC
    Logged 2026-11-04 01:13 UTC in Google PlumbersArms2027h1, entry 600,386,148
    SHA-256 616b0b6695561f7c2b359e886acd0e55ce6d463bdf15b719048ba8adae3716b8
    Public key SHA-256 fa915a0105c7d1bad78ffdd4e6ce2f4a487d245532de9389168185035b4a6077
    Brand
    Disney+
    Addresses
    91.98.101.145 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (91.98.101.145): a cloud provider. It rents servers and addresses to its customers.
    Domain
    disneyplusplus.com
    Registered
    2023-01-11 · Dynadot Inc
    MX
    Receives mail at mx.domainparking.de
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  5. disneyplusplus.com DE · AS24940 · HETZNER-AS Hetzner Online G…
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    disneyplusplus.com
    First seen
    2026-11-04 01:16 UTC
    First published
    2026-11-04 01:42 UTC
    DNS
    Resolves · checked 2026-11-05 01:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.98.101.145.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.98.101.145
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 00:14 UTC to 2027-02-02 00:14 UTC
    Logged 2026-11-04 01:13 UTC in Google PlumbersArms2027h1, entry 600,386,148
    SHA-256 616b0b6695561f7c2b359e886acd0e55ce6d463bdf15b719048ba8adae3716b8
    Public key SHA-256 fa915a0105c7d1bad78ffdd4e6ce2f4a487d245532de9389168185035b4a6077
    Brand
    Disney+
    Addresses
    91.98.101.145 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (91.98.101.145): a cloud provider. It rents servers and addresses to its customers.
    Domain
    disneyplusplus.com
    Registered
    2023-01-11 · Dynadot Inc
    MX
    Receives mail at mx.domainparking.de
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  6. disney-ver.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 d ago
    DetailsHide
    Hostname
    disney-ver.store
    First seen
    2026-11-02 09:04 UTC
    First published
    2026-11-02 09:27 UTC
    Listing
    CERT Polska listed it 2026-11-02 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Not resolving · checked 2026-11-05 10:33 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-01 10:25 UTC to 2027-01-30 10:25 UTC
    Logged 2026-11-01 11:24 UTC in Geomys Tuscolo2027h1, entry 431,854,027
    SHA-256 7aab18ad10bdf22fcb32fb7d8d874ae636d3bd16364bd743988d7d4aa209ee65
    Public key SHA-256 6a532d6beafb17053f7f51cce832ffaa1e571f58a0bb2661d9557488990e01ff
    Brand
    Disney+
    Addresses
    104.21.60.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:3c75
    2606:4700:3037::ac43:c423
    Cloudflare
    Cloudflare (104.21.60.117, 172.67.196.35): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    disney-ver.store
    Registered
    2026-11-01 · InterNetX GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  7. www.babyboo-disney.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 12 mo ago
    DetailsHide
    Hostname
    www.babyboo-disney.pl
    First seen
    2026-11-02 03:52 UTC
    First published
    2026-11-02 04:28 UTC
    DNS
    Resolves · checked 2026-11-05 04:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 02:50 UTC to 2027-01-31 02:50 UTC
    Logged 2026-11-02 03:49 UTC in DigiCert Sphinx2027h1, entry 332,245,993
    SHA-256 6646974abe939bc147ba15ec9b97e756d262748520e73164e409c7267fa37970
    Public key SHA-256 23f2dedacac85740137a2c3ff5e64d4430f1996bac9ab61d822106506a5fc039
    Brand
    Disney+
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    babyboo-disney.pl
    Registered
    2025-11-09 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 05:03 UTC

    Suggest a correction

  8. babyboo-disney.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 12 mo ago
    DetailsHide
    Hostname
    babyboo-disney.pl
    First seen
    2026-11-02 03:51 UTC
    First published
    2026-11-02 04:28 UTC
    DNS
    Resolves · checked 2026-11-05 04:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 02:50 UTC to 2027-01-31 02:50 UTC
    Logged 2026-11-02 03:49 UTC in DigiCert Sphinx2027h1, entry 332,245,993
    SHA-256 6646974abe939bc147ba15ec9b97e756d262748520e73164e409c7267fa37970
    Public key SHA-256 23f2dedacac85740137a2c3ff5e64d4430f1996bac9ab61d822106506a5fc039
    Brand
    Disney+
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    babyboo-disney.pl
    Registered
    2025-11-09 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 05:03 UTC

    Suggest a correction

  9. disney-gaz.vip AE · AS215730 · FZCO
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    disney-gaz.vip
    First seen
    2026-11-01 22:32 UTC
    First published
    2026-11-01 22:48 UTC
    DNS
    Resolves · checked 2026-11-04 22:56 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 85.192.49.195.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 85.192.49.195
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-01 21:29 UTC to 2027-01-30 22:27 UTC
    Logged 2026-11-01 22:29 UTC in Google ParcelYard2027h1, entry 562,054,091
    SHA-256 493ab76b55d7b66bf881ba735ec78cf2d8119cc2fa43a55b5e80a65c7d2636f8
    Public key SHA-256 e3ceb81f7c1e8cf2e7a6a8dabe240f6b5d18112951962c63292cd917064f05fe
    Brand
    Disney+
    Addresses
    85.192.49.195 · United Arab Emirates · AS215730 H2NEXUS-AS H2NEXUS CLOUD SERVICES - FZCO
    Domain
    disney-gaz.vip
    Registered
    2025-11-12 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  10. hercules-disney.shop MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    hercules-disney.shop
    First seen
    2026-11-01 13:57 UTC
    First published
    2026-11-01 14:12 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 217.156.123.104.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 217.156.123.104
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-01 12:55 UTC to 2027-01-30 13:53 UTC
    Logged 2026-11-01 13:55 UTC in DigiCert Sphinx2027h1, entry 328,938,363
    SHA-256 d4ed15da8351ef874e8106c6332db1e3a5096c35a5436a8168f65e086cae7d2e
    Public key SHA-256 0f3995ff11db3e6ca643e535045e1ccaf341fdb05b4878adf8a4808f22420b2d
    Brand
    Disney+
    Addresses
    217.156.123.104 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    hercules-disney.shop
    Registered
    2026-08-27 · Dynadot Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 04:49 UTC

    Suggest a correction

  11. www.erp.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.erp.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:59 UTC to 2027-01-30 04:59 UTC
    Logged 2026-11-01 05:57 UTC in IPng Networks Gouda2027h1, entry 283,658,319
    SHA-256 284d3bf0b95c194ccb6c6a9905c9d4c693ac81354b90bafaaab14ca02ae2dfde
    Public key SHA-256 1c66c80dfe8d698d4068a398943dd31f0106959a5c8cd546b0fe6f2e535f5f33
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  12. www.disney.com.np.rupitor.com GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    www.disney.com.np.rupitor.com
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    rupitor.com
    Registered
    2018-06-08 · OwnRegistrar, Inc.
    MX
    Receives mail at rupitor.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  13. www.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  14. webmail.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    webmail.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  15. webdisk.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    webdisk.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  16. mail.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    mail.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  17. erp.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    erp.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:59 UTC to 2027-01-30 04:59 UTC
    Logged 2026-11-01 05:57 UTC in IPng Networks Gouda2027h1, entry 283,658,319
    SHA-256 284d3bf0b95c194ccb6c6a9905c9d4c693ac81354b90bafaaab14ca02ae2dfde
    Public key SHA-256 1c66c80dfe8d698d4068a398943dd31f0106959a5c8cd546b0fe6f2e535f5f33
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  18. disney.com.np.rupitor.com GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostSame certificateAddress hosted confirmed phishing in the last 48 h · Same certificate as disney.com.np, on a phishing host at 192.250.235.17MX presentSPF ~allDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    disney.com.np.rupitor.com
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Same certificate
    Same certificate as disney.com.np: on a phishing host at 192.250.235.17; a Disney+ lookalike
    Hosting-alias name of disney.com.np
    Disney+ appears in this hostname
    Resolved to 192.250.235.17, an address that hosted confirmed phishing
    Certificate 615752240f1b1121… · 3 domains on it · first seen 2026-11-01 06:01 UTC
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    rupitor.com
    Registered
    2018-06-08 · OwnRegistrar, Inc.
    MX
    Receives mail at rupitor.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  19. disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostSame certificateAddress hosted confirmed phishing in the last 48 h · Same certificate as disney.com.np.rupitor.com, on a phishing host at 192.250.235.17MX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Same certificate
    Same certificate as disney.com.np.rupitor.com: on a phishing host at 192.250.235.17; a Disney+ lookalike
    Hosting-alias name of disney.com.np.rupitor.com
    Disney+ appears in this hostname
    Resolved to 192.250.235.17, an address that hosted confirmed phishing
    Certificate 615752240f1b1121… · 3 domains on it · first seen 2026-11-01 06:01 UTC
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  20. cpcontacts.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    cpcontacts.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  21. cpcalendars.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    cpcalendars.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  22. cpanel.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    cpanel.disney.com.np
    First seen
    2026-11-01 06:01 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  23. autodiscover.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    autodiscover.disney.com.np
    First seen
    2026-11-01 06:00 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  24. autoconfig.disney.com.np GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    autoconfig.disney.com.np
    First seen
    2026-11-01 06:00 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.250.235.17.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.250.235.17
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 04:58 UTC to 2027-01-30 04:58 UTC
    Logged 2026-11-01 05:57 UTC in Geomys Tuscolo2027h1, entry 429,159,929
    SHA-256 615752240f1b1121e79318da5d4056f9824fe647ee1840f5097f51250bfa1624
    Public key SHA-256 2924baab29886faeadb4c2381a5d6145015ca1104f0017c2bc4c2e4e995612bb
    Brand
    Disney+
    Addresses
    192.250.235.17 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    disney.com.np
    MX
    Receives mail at disney.com.np
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  25. www.pinnower-disney.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.pinnower-disney.de
    First seen
    2026-10-30 06:56 UTC
    First published
    2026-10-30 07:37 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 05:52 UTC to 2027-01-28 05:52 UTC
    Logged 2026-10-30 06:50 UTC in Google PlumbersArms2027h1, entry 519,044,771
    SHA-256 032e2d4c9aa17a2aac825eaf65eb8a3eb44489b0e4d4ca0564c2cce1eaa54602
    Public key SHA-256 d36d5b9e1682953c93eafe84745f01f6c421bddbae74f2f11c769622e37ff857
    Brand
    Disney+
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    pinnower-disney.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  26. pinnower-disney.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    pinnower-disney.de
    First seen
    2026-10-30 06:56 UTC
    First published
    2026-10-30 07:37 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 05:52 UTC to 2027-01-28 05:52 UTC
    Logged 2026-10-30 06:50 UTC in Google PlumbersArms2027h1, entry 519,044,771
    SHA-256 032e2d4c9aa17a2aac825eaf65eb8a3eb44489b0e4d4ca0564c2cce1eaa54602
    Public key SHA-256 d36d5b9e1682953c93eafe84745f01f6c421bddbae74f2f11c769622e37ff857
    Brand
    Disney+
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    pinnower-disney.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  27. generation-disney.fr DE · AS8560 · IONOS-AS IONOS SE
    Phishing hostIONOSAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 7 y ago
    DetailsHide
    Hostname
    generation-disney.fr
    First seen
    2026-10-30 00:21 UTC
    First published
    2026-10-30 00:48 UTC
    DNS
    Resolves · checked 2026-11-05 00:53 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 217.160.0.21.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 217.160.0.21
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV R36 · precertificate
    Valid 2026-10-30 00:00 UTC to 2027-05-12 23:59 UTC
    Logged 2026-10-30 00:17 UTC in Let's Encrypt Sycamore2027h1, entry 846,957,527
    SHA-256 4ec22d423f5af2372f05f382a933b5622617ea40ee74cec9db882bd5cf1173cd
    Public key SHA-256 340fe1e6b28639b4a194ec96e9d07430ee6c3f63b3ebd90b32f25f1ea54754c7
    Brand
    Disney+
    Addresses
    217.160.0.21 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (217.160.0.21): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    generation-disney.fr
    Registered
    2019-12-27 · IONOS SE
    MX
    Receives mail at mx00.ionos.fr, mx01.ionos.fr
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Disney+ when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Streaming & media

All brands →