Intuit

Software & cloud United Statesintuit.comOperator of Mailchimp
Cert findings · 24 h
13
Cert findings · 7 days
21
19 on phishing hosts · 2 on Spamhaus DROP
Registered lookalikes
285
42 listed by a source or an address list
Official domains
4
verified from Intuit's own sites and records

Certificate findings for Intuit

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Intuit's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 33 findings, grouped by hostname

  1. en-quickbooks.com GB · AS48254 · TWENTYI 20i Limited
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    en-quickbooks.com
    First seen
    2026-11-05 09:40 UTC
    First published
    2026-11-05 09:50 UTC
    DNS
    Resolves · checked 2026-11-05 09:57 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.146.167.204.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.146.167.204
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-05 08:34 UTC to 2027-02-03 08:34 UTC
    Logged 2026-11-05 09:33 UTC in Google ParcelYard2027h1, entry 623,455,272
    SHA-256 2280c9687be74a53e0e057bf229a3e7ba59c296f90211b84b740b5fcfc61c26e
    Public key SHA-256 939bc3475310db7f32bfb3baad5fb77e2067c611d6f62d9614abd0033405868e
    Brand
    Intuit
    Addresses
    185.146.167.204 · United Kingdom · AS48254 TWENTYI 20i Limited
    Domain
    en-quickbooks.com
    Registered
    2026-09-07 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at mx.stackmail.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:48 UTC

    Suggest a correction

  2. intuitturbotax.com US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 21 y ago
    DetailsHide
    Hostname
    intuitturbotax.com
    First seen
    2026-11-05 09:05 UTC
    First published
    2026-10-28 07:41 UTC
    DNS
    Resolves · checked 2026-11-05 09:05 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.162.80.51.
    1. Phishing-host list fetched with the address
    2. Resolved to 69.162.80.51
    Brand
    Intuit
    Addresses
    69.162.80.51 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    69.162.80.55 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    intuitturbotax.com
    Registered
    2005-12-29 · BoteroSolutions.com S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  3. accountintuit.com NL · AS43350 · NFORCE NForce Entertainment…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    accountintuit.com
    First seen
    2026-11-05 09:02 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 77.247.182.242.
    1. Phishing-host list fetched with the address
    2. Resolved to 77.247.182.242
    Brand
    Intuit
    Addresses
    77.247.182.242 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    77.247.182.245 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    Domain
    accountintuit.com
    Registered
    2019-01-16 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

  4. quickbooksonline.cm NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    quickbooksonline.cm
    First seen
    2026-11-05 08:59 UTC
    First published
    2026-10-28 06:38 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.7.194.68.
    1. Phishing-host list fetched with the address
    2. Resolved to 212.7.194.68
    Brand
    Intuit
    Addresses
    212.7.194.68 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    69.162.80.59 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    quickbooksonline.cm
    Registered
    2017-04-19 · Netcom.cm Sarl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  5. quickbooks.co NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 16 y ago
    DetailsHide
    Hostname
    quickbooks.co
    First seen
    2026-11-05 08:59 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.7.194.71.
    1. Phishing-host list fetched with the address
    2. Resolved to 212.7.194.71
    Brand
    Intuit
    Addresses
    212.7.194.71 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    69.162.80.59 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    quickbooks.co
    Registered
    2010-07-21 · TLD Registrar Solutions Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  6. quickbooks.cm US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    quickbooks.cm
    First seen
    2026-11-05 08:59 UTC
    First published
    2026-10-28 05:36 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.162.80.53.
    1. Phishing-host list fetched with the address
    2. Resolved to 69.162.80.53
    Brand
    Intuit
    Addresses
    69.162.80.53 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    212.7.194.67 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    quickbooks.cm
    Registered
    2017-12-23 · Netcom.cm Sarl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  7. intuit5.com US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    intuit5.com
    First seen
    2026-11-05 08:59 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 216.245.213.73.
    1. Phishing-host list fetched with the address
    2. Resolved to 216.245.213.73
    Brand
    Intuit
    Addresses
    216.245.213.73 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    216.245.213.74 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    intuit5.com
    Registered
    2021-09-24 · Media Elite Holdings Limited, S.A.
    MX
    Receives mail at mail.h-email.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

  8. glance-intuit.com NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    glance-intuit.com
    First seen
    2026-11-05 08:59 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 94.75.193.70.
    1. Phishing-host list fetched with the address
    2. Resolved to 94.75.193.70
    Brand
    Intuit
    Addresses
    94.75.193.70 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    23.105.175.16 · United States · AS30633 LEASEWEB-USA-WDC - Leaseweb USA, Inc.
    Domain
    glance-intuit.com
    Registered
    2018-09-28 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

  9. quickbooks.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 2 mo ago
    DetailsHide
    Hostname
    quickbooks.pl
    First seen
    2026-11-05 01:02 UTC
    First published
    2026-11-05 01:50 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-04 23:47 UTC to 2027-02-02 23:47 UTC
    Logged 2026-11-05 00:45 UTC in Let's Encrypt Sycamore2027h1, entry 950,379,689
    SHA-256 90317b81f89fff5d0f7f0d369abeaae9f3863f80040e8e7b2735719ede57c8f8
    Public key SHA-256 5e9aa0cf14a711cb5e4a1175234d358b0d4071e0fb5643609f836062e9dadaeb
    Brand
    Intuit
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    quickbooks.pl
    Registered
    2026-09-05 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:55 UTC

    Suggest a correction

  10. www.quickbooks.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 2 mo ago
    DetailsHide
    Hostname
    www.quickbooks.pl
    First seen
    2026-11-05 00:50 UTC
    First published
    2026-11-05 01:50 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-04 23:47 UTC to 2027-02-02 23:47 UTC
    Logged 2026-11-05 00:45 UTC in Let's Encrypt Sycamore2027h1, entry 950,379,689
    SHA-256 90317b81f89fff5d0f7f0d369abeaae9f3863f80040e8e7b2735719ede57c8f8
    Public key SHA-256 5e9aa0cf14a711cb5e4a1175234d358b0d4071e0fb5643609f836062e9dadaeb
    Brand
    Intuit
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    quickbooks.pl
    Registered
    2026-09-05 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:55 UTC

    Suggest a correction

  11. quickbooksintuit.xyz HK · AS211443 · SINOWORLDWIDE SINO WORLDWID…
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    quickbooksintuit.xyz
    First seen
    2026-11-04 20:10 UTC
    First published
    2026-11-04 21:09 UTC
    DNS
    Resolves · checked 2026-11-04 21:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.92.41.104.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.92.41.104
    4. Latest DNS check
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 91.92.41.104.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 91.92.41.104
    3. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 19:01 UTC to 2027-02-02 19:01 UTC
    Logged 2026-11-04 19:59 UTC in Geomys Tuscolo2027h1, entry 477,192,476
    SHA-256 adab76324eedbf3fd8efdf26692685a99778103601aa8b9af582ff646c653d49
    Public key SHA-256 136c3d82d2b0789a5c41f4e46df60d97bbb1ce9c6955ee60cfb04e72dad83c0e
    Brand
    Intuit
    Addresses
    91.92.41.104 · Hong Kong · AS211443 SINOWORLDWIDE SINO WORLDWIDE TRADING LIMITED
    Domain
    quickbooksintuit.xyz
    Registered
    2026-11-03 · CSL Computer Service Langenbach GmbH d/b/a joker.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 20:14 UTC

    Suggest a correction

  12. quickbo0ks.com NL · AS49981 · WorldStream WorldStream B.V.Lookalike of quickbooks.com · similar-looking characters
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    quickbo0ks.com
    First seen
    2026-11-04 17:34 UTC
    First published
    2026-10-29 17:26 UTC
    DNS
    Resolves · checked 2026-11-04 17:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.82.67.96.
    1. Phishing-host list fetched with the address
    2. Resolved to 45.82.67.96
    Brand
    Intuit (spelled like quickbooks.com with similar-looking characters)
    Addresses
    45.82.67.96 · Netherlands · AS49981 WorldStream WorldStream B.V.
    Domain
    quickbo0ks.com
    Registered
    2016-12-25 · Internet Domain Service BS Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:27 UTC

    Suggest a correction

  13. www.intuit-research.com US · AS26496 · GoDaddy.com, LLC
    Phishing hostGoDaddyAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 14 y ago
    DetailsHide
    Hostname
    www.intuit-research.com
    First seen
    2026-11-04 02:31 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 148.66.136.190.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 148.66.136.190
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-04 02:28 UTC to 2027-05-21 02:28 UTC
    Logged 2026-11-04 02:28 UTC in GoDaddy Aquamarine2027h1, entry 176,158,868
    SHA-256 3c7cdae13130c12f7a3b9c1aa89f937527da472cfba48a46e6f2047718b88db3
    Public key SHA-256 aa1a368aad1ff30b1f5e2fe6c17f8aa5c011ecc4d514f4c27228a18bec783b0e
    Brand
    Intuit
    Addresses
    148.66.136.190 · United States · AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC · GoDaddy (shared hosting)
    GoDaddy
    GoDaddy (148.66.136.190): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    intuit-research.com
    Registered
    2013-02-26 · NameCheap, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  14. intuit-research.com US · AS26496 · GoDaddy.com, LLC
    Phishing hostGoDaddyAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 14 y ago
    DetailsHide
    Hostname
    intuit-research.com
    First seen
    2026-11-04 02:31 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 148.66.136.190.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 148.66.136.190
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-04 02:28 UTC to 2027-05-21 02:28 UTC
    Logged 2026-11-04 02:28 UTC in GoDaddy Aquamarine2027h1, entry 176,158,868
    SHA-256 3c7cdae13130c12f7a3b9c1aa89f937527da472cfba48a46e6f2047718b88db3
    Public key SHA-256 aa1a368aad1ff30b1f5e2fe6c17f8aa5c011ecc4d514f4c27228a18bec783b0e
    Brand
    Intuit
    Addresses
    148.66.136.190 · United States · AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC · GoDaddy (shared hosting)
    GoDaddy
    GoDaddy (148.66.136.190): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    intuit-research.com
    Registered
    2013-02-26 · NameCheap, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  15. intuitio.pro FR · AS16276 · OVH OVH SAS
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    intuitio.pro
    First seen
    2026-11-03 21:06 UTC
    First published
    2026-11-03 21:33 UTC
    DNS
    Resolves · checked 2026-11-04 21:40 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.236.255.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.91.236.255
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 20:06 UTC to 2027-02-01 20:06 UTC
    Logged 2026-11-03 21:04 UTC in Let's Encrypt Willow2027h1, entry 920,540,577
    SHA-256 23c82f93347bcfc3da217e44b5041e58f09c245456e29cf4d8dc810dd015543a
    Public key SHA-256 35496c89f480e194cf55685b67691f1412733a471c37bd011e558c20b6766909
    Brand
    Intuit
    Addresses
    51.91.236.255 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.91.236.255): a cloud provider. It rents servers and addresses to its customers.
    Domain
    intuitio.pro
    Registered
    2022-10-26 · OVH SAS
    MX
    Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:57 UTC

    Suggest a correction

  16. wd.quickbooks-dashboards.com HK · AS135392 · MillenialHost Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    wd.quickbooks-dashboards.com
    First seen
    2026-11-03 15:42 UTC
    First published
    2026-11-03 16:45 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 167.148.201.137.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 167.148.201.137
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 14:37 UTC to 2027-02-01 14:37 UTC
    Logged 2026-11-03 15:36 UTC in IPng Networks Gouda2027h1, entry 304,139,081
    SHA-256 5723c2f940994d79f74e7dc5f1eb2088460d75ef625d0e3ccdb1f5fad6615e66
    Public key SHA-256 b6ac7a29bdc62bc2441b1e9102e6e96b7497711cc703828446a3522bc627ea6f
    Brand
    Intuit
    Addresses
    167.148.201.137 · Hong Kong · AS135392 MILLENIALHOSTLIMITED-AS-GB - MillenialHost Limited
    Domain
    quickbooks-dashboards.com
    Registered
    2026-11-03 · CNOBIN INFORMATION TECHNOLOGY LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  17. www.intuitio.pro FR · AS16276 · OVH OVH SAS
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    www.intuitio.pro
    First seen
    2026-11-03 14:37 UTC
    First published
    2026-11-03 15:38 UTC
    DNS
    Resolves · checked 2026-11-04 15:44 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.236.255.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.91.236.255
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 13:36 UTC to 2027-02-01 13:36 UTC
    Logged 2026-11-03 14:34 UTC in IPng Networks Halloumi2027h1, entry 349,663,668
    SHA-256 be61f70e3d35b2e49d86fac526617b7e827620ed1dee4842eef6f192e6fb9abc
    Public key SHA-256 5e3c0d2669b8abebaa4338aacd1d3f35e7bc5f06b07fb86f95e187094a40b848
    Brand
    Intuit
    Addresses
    51.91.236.255 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.91.236.255): a cloud provider. It rents servers and addresses to its customers.
    Domain
    intuitio.pro
    Registered
    2022-10-26 · OVH SAS
    MX
    Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:57 UTC

    Suggest a correction

  18. intuitmarket.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    intuitmarket.wasmer.app
    First seen
    2026-11-03 04:47 UTC
    First published
    2026-11-03 04:56 UTC
    DNS
    Resolves · checked 2026-11-05 05:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 03:46 UTC to 2027-02-01 03:46 UTC
    Logged 2026-11-03 04:44 UTC in Geomys Tuscolo2027h1, entry 454,193,843
    SHA-256 2c9381e1f8e98b68b20fcad792b3e58959c7256702b2195536d1014ba33eff44
    Public key SHA-256 e8d1c2daf28c78cdb0def20a299124c6f8d988e1acd14a9d9a2a22c1b9f1738d
    Brand
    Intuit
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  19. www.helpe-quickbooks-o.cyou MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.helpe-quickbooks-o.cyou
    First seen
    2026-10-30 13:11 UTC
    First published
    2026-10-30 13:53 UTC
    DNS
    Resolves · checked 2026-11-04 14:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 81.180.92.199.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 81.180.92.199
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 12:07 UTC to 2027-01-28 12:07 UTC
    Logged 2026-10-30 13:06 UTC in Google PlumbersArms2027h1, entry 523,528,494
    SHA-256 70341f5a5d4f469273041084247a225c6137ad7f6d9197daff29bdff5b1e9c0b
    Public key SHA-256 592f189ffb6ae5734dda51e6f8575b378cb1790b3ff0b9ff5f0021b1245ebe99
    Brand
    Intuit
    Addresses
    81.180.92.199 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    helpe-quickbooks-o.cyou
    Registered
    2026-06-10 · NameSilo, LLC
    MX
    Receives mail at mail.helpe-quickbooks-o.cyou
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:12 UTC

    Suggest a correction

  20. helpe-quickbooks-o.cyou MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    helpe-quickbooks-o.cyou
    First seen
    2026-10-30 13:11 UTC
    First published
    2026-10-30 13:53 UTC
    DNS
    Resolves · checked 2026-11-04 14:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 81.180.92.199.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 81.180.92.199
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 12:07 UTC to 2027-01-28 12:07 UTC
    Logged 2026-10-30 13:06 UTC in Google PlumbersArms2027h1, entry 523,528,494
    SHA-256 70341f5a5d4f469273041084247a225c6137ad7f6d9197daff29bdff5b1e9c0b
    Public key SHA-256 592f189ffb6ae5734dda51e6f8575b378cb1790b3ff0b9ff5f0021b1245ebe99
    Brand
    Intuit
    Addresses
    81.180.92.199 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    helpe-quickbooks-o.cyou
    Registered
    2026-06-10 · NameSilo, LLC
    MX
    Receives mail at mail.helpe-quickbooks-o.cyou
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:12 UTC

    Suggest a correction

  21. www.quickbooksonlinesupport.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    www.quickbooksonlinesupport.com
    First seen
    2026-10-29 08:10 UTC
    First published
    2026-10-29 08:49 UTC
    DNS
    Resolves · checked 2026-11-05 09:05 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-29 07:08 UTC to 2027-01-27 07:08 UTC
    Logged 2026-10-29 08:07 UTC in Google ParcelYard2027h1, entry 502,240,637
    SHA-256 86780fc1d99a8a6d9eaa6cfa3c48cca6fe32a6942023838ab96c6dab139763b8
    Public key SHA-256 0e598682c6fda8f63fd66fb55be75e018391617606d9bb9ad69f7392f19a2af8
    Brand
    Intuit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    quickbooksonlinesupport.com
    Registered
    2026-08-07 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:52 UTC

    Suggest a correction

  22. quickbooksonlinesupport.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    quickbooksonlinesupport.com
    First seen
    2026-10-29 08:10 UTC
    First published
    2026-10-29 08:49 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-29 07:08 UTC to 2027-01-27 07:08 UTC
    Logged 2026-10-29 08:07 UTC in Google ParcelYard2027h1, entry 502,240,637
    SHA-256 86780fc1d99a8a6d9eaa6cfa3c48cca6fe32a6942023838ab96c6dab139763b8
    Public key SHA-256 0e598682c6fda8f63fd66fb55be75e018391617606d9bb9ad69f7392f19a2af8
    Brand
    Intuit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    quickbooksonlinesupport.com
    Registered
    2026-08-07 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:52 UTC

    Suggest a correction

  23. intuit-rewards.live US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    intuit-rewards.live
    First seen
    2026-10-27 16:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · delisted on 2026-11-02
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-27 15:51 UTC to 2027-01-22 09:16 UTC
    Logged 2026-10-27 16:01 UTC in DigiCert Wyvern2027h1, entry 322,929,536
    SHA-256 0f9f1156542cebb2c550c4890f92d9a83b3cb550cab2c8d4e90343ecee6f7bb8
    Public key SHA-256 cf8e9c2500d3a6ab720dc5a25045fae0e3fa8575039268c1c331d7909054d3ed
    Brand
    Intuit
    Addresses
    104.21.70.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.138.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:8a07
    2606:4700:3034::6815:46ac
    Cloudflare
    Cloudflare (104.21.70.172, 172.67.138.7): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    intuit-rewards.live
    Registered
    2026-04-28 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:32 UTC

    Suggest a correction

  24. www.intuitinc.net CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 mo ago
    DetailsHide
    Hostname
    www.intuitinc.net
    First seen
    2026-10-27 15:07 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-27 14:06 UTC to 2027-01-25 14:06 UTC
    Logged 2026-10-27 15:04 UTC in DigiCert Wyvern2027h1, entry 322,640,979
    SHA-256 03625e1856f4384cabba612f1d5b288ea310058327764acd0d1e990bbf0c3710
    Public key SHA-256 dfbe81908acaf1b67f7c04fd85794c5751eba0883580cc0b4b41a83815043fe4
    Brand
    Intuit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    intuitinc.net
    Registered
    2025-06-09 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:32 UTC

    Suggest a correction

  25. intuitinc.net CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 mo ago
    DetailsHide
    Hostname
    intuitinc.net
    First seen
    2026-10-27 15:07 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-27 14:06 UTC to 2027-01-25 14:06 UTC
    Logged 2026-10-27 15:04 UTC in DigiCert Wyvern2027h1, entry 322,640,979
    SHA-256 03625e1856f4384cabba612f1d5b288ea310058327764acd0d1e990bbf0c3710
    Public key SHA-256 dfbe81908acaf1b67f7c04fd85794c5751eba0883580cc0b4b41a83815043fe4
    Brand
    Intuit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    intuitinc.net
    Registered
    2025-06-09 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:32 UTC

    Suggest a correction

  26. quickbooksvalidationcode.ru MD · AS48753 · AVAHOHST AVA HOST SRL
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    quickbooksvalidationcode.ru
    First seen
    2026-10-27 07:11 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 195.20.18.201.
    1. Phishing-host list fetched with the address
    2. Resolved to 195.20.18.201
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 320,357,115
    SHA-256 595b81e8a0b9a219bbfb440884c0e30feae1c9eeb67216ed424a6561ead15d42
    Brand
    Intuit
    Addresses
    195.20.18.201 · Moldova · AS48753 AVAHOHST AVA HOST SRL
    Domain
    quickbooksvalidationcode.ru
    MX
    Receives mail at quickbooksvalidationcode.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  27. quickbooks-validation-code.com MD · AS48753 · AVAHOHST AVA HOST SRL
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 18 mo ago
    DetailsHide
    Hostname
    quickbooks-validation-code.com
    First seen
    2026-10-27 07:11 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 195.20.18.201.
    1. Phishing-host list fetched with the address
    2. Resolved to 195.20.18.201
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 467,502,236
    SHA-256 104f2d967d1dcc5f76661aeb2207b9aa9da3b14b911b70bc6e7b9f636dd1fca7
    Brand
    Intuit
    Addresses
    195.20.18.201 · Moldova · AS48753 AVAHOHST AVA HOST SRL
    Domain
    quickbooks-validation-code.com
    Registered
    2025-05-19 · TuringSign Inc. d/b/a Cosmotown
    MX
    Receives mail at quickbooks-validation-code.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  28. www.subscriptions-intuit.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    www.subscriptions-intuit.com
    First seen
    2026-10-26 10:11 UTC
    DNS
    Resolves · checked 2026-11-05 09:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.57.91.91
    3. Latest DNS check
    Certificate
    Logged in Google PlumbersArms2027h1, entry 453,625,260
    SHA-256 1b7ffdf3bd1c5ee888a233a4b33326d946a07fe4e96d9e01cfa6d7a59160b2b8
    Brand
    Intuit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    subscriptions-intuit.com
    Registered
    2026-08-04 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  29. www.intuit-quickbookssupport.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    www.intuit-quickbookssupport.com
    First seen
    2026-10-26 10:11 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.57.91.91
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 452,904,822
    SHA-256 153e55183a742366de28fda3da208f23cc5210b835051f745e4f1ef5ebbcabd3
    Brand
    Intuit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    intuit-quickbookssupport.com
    Registered
    2026-08-04 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  30. subscriptions-intuit.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    subscriptions-intuit.com
    First seen
    2026-10-26 10:11 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.57.91.91
    3. Latest DNS check
    Certificate
    Logged in Google PlumbersArms2027h1, entry 453,625,260
    SHA-256 1b7ffdf3bd1c5ee888a233a4b33326d946a07fe4e96d9e01cfa6d7a59160b2b8
    Brand
    Intuit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    subscriptions-intuit.com
    Registered
    2026-08-04 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  31. intuit-quickbookssupport.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    intuit-quickbookssupport.com
    First seen
    2026-10-26 10:11 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.57.91.91
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 452,904,822
    SHA-256 153e55183a742366de28fda3da208f23cc5210b835051f745e4f1ef5ebbcabd3
    Brand
    Intuit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    intuit-quickbookssupport.com
    Registered
    2026-08-04 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  32. www.intuitpayment.site VG · AS200313 · ProHoster-AS IT WEB LTD
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    www.intuitpayment.site
    First seen
    2026-10-26 09:00 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.212.128.153.
    1. Phishing-host list fetched with the address
    2. Resolved to 185.212.128.153
    3. Latest DNS check
    Certificate
    Logged in Geomys Tuscolo2027h1, entry 356,884,486
    SHA-256 40297d20a34b0f7d2b7a39382b193a0d61520031fde4590d19be4b9f51bf9dcd
    Brand
    Intuit
    Addresses
    185.212.128.153 · British Virgin Islands · AS200313 ProHoster-AS IT WEB LTD
    Domain
    intuitpayment.site
    Registered
    2026-10-26 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Intuit when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Software & cloud

All brands →