Proton

Email & webmail Switzerlandproton.meOperator of Proton Mail
Cert findings · 24 h
0
Cert findings · 7 days
33
13 reported or listed · 20 on phishing hosts
Registered lookalikes
363
34 listed by a source or an address list
Official domains
14
verified from Proton's own sites and records

Certificate findings for Proton

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Proton's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 35 findings, grouped by hostname

  1. protonvpn.study SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.study
    First seen
    2026-11-04 05:57 UTC
    First published
    2026-11-04 06:49 UTC
    DNS
    Resolves · checked 2026-11-05 07:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 04:54 UTC to 2027-02-02 04:54 UTC
    Logged 2026-11-04 05:52 UTC in Google ParcelYard2027h1, entry 603,173,626
    SHA-256 783eff044fcb06f6b143593bd81ce5a955a4e00570ef5276c8ed2ab87ddc1ff7
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.study
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:06 UTC

    Suggest a correction

  2. protonvpn.rest SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.rest
    First seen
    2026-11-04 05:16 UTC
    First published
    2026-11-04 05:23 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 04:13 UTC to 2027-02-02 04:13 UTC
    Logged 2026-11-04 05:12 UTC in DigiCert Sphinx2027h1, entry 351,004,106
    SHA-256 801729cebf4471ae200755b9e349045b0070bb251891e682adbd2c6740186f61
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.rest
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:02 UTC

    Suggest a correction

  3. protonvpn.forum SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.forum
    First seen
    2026-11-04 05:11 UTC
    First published
    2026-11-04 05:23 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 04:06 UTC to 2027-02-02 04:06 UTC
    Logged 2026-11-04 05:05 UTC in Google PlumbersArms2027h1, entry 603,010,243
    SHA-256 819ff5d2a023e85041d991d24b83a0ba5decb815124014be8cee687c51d9a87f
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.forum
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:16 UTC

    Suggest a correction

  4. protonvpn.courses SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.courses
    First seen
    2026-11-04 05:04 UTC
    First published
    2026-11-04 05:23 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 03:54 UTC to 2027-02-02 03:54 UTC
    Logged 2026-11-04 04:53 UTC in DigiCert Sphinx2027h1, entry 350,836,800
    SHA-256 29d75aa2f2964fe342be1df0be3c0e6c9374f638c0e637564be7a610b7bfb6ff
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.courses
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:16 UTC

    Suggest a correction

  5. protonvpn.surf SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.surf
    First seen
    2026-11-04 05:01 UTC
    First published
    2026-11-04 05:23 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 03:57 UTC to 2027-02-02 03:57 UTC
    Logged 2026-11-04 04:56 UTC in Google PlumbersArms2027h1, entry 602,917,262
    SHA-256 03b91f7ba47f70c18bd44a59cdb8a79ef38686fdfa38d0f530daf0dc19467cb3
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.surf
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:08 UTC

    Suggest a correction

  6. protonvpn.qpon SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.qpon
    First seen
    2026-11-04 05:01 UTC
    First published
    2026-11-04 05:23 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 03:58 UTC to 2027-02-02 03:58 UTC
    Logged 2026-11-04 04:56 UTC in DigiCert Wyvern2027h1, entry 398,005,551
    SHA-256 899bd51b23dc5263149e7d3e099d41d57b73cf53e4dd9f2b126e3ded4d3949ea
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.qpon
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:08 UTC

    Suggest a correction

  7. protonvpn.garden SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.garden
    First seen
    2026-11-04 04:49 UTC
    First published
    2026-11-04 05:23 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 03:46 UTC to 2027-02-02 03:46 UTC
    Logged 2026-11-04 04:45 UTC in DigiCert Wyvern2027h1, entry 397,898,489
    SHA-256 27c56c99ad9d2dd7023adab407acff98c273a3cf234f95fbfdc02d1f45655284
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.garden
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:08 UTC

    Suggest a correction

  8. protonvpn.casa SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.casa
    First seen
    2026-11-04 04:21 UTC
    First published
    2026-11-04 05:23 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Certificate logged in CT
    2. Resolved to 172.232.24.161
    3. Phishing-host list fetched with the address
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 03:19 UTC to 2027-02-02 03:19 UTC
    Logged 2026-11-04 04:17 UTC in IPng Networks Halloumi2027h1, entry 356,873,756
    SHA-256 2b7bd84145fa8a8605771f6cfac5191fb7d1bb281aca04b036e0f3a4573eac8e
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.casa
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 04:42 UTC

    Suggest a correction

  9. www.protonvpn.cc SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    www.protonvpn.cc
    First seen
    2026-11-03 22:52 UTC
    First published
    2026-11-03 23:22 UTC
    DNS
    Resolves · checked 2026-11-04 23:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 21:50 UTC to 2027-02-01 21:50 UTC
    Logged 2026-11-03 22:49 UTC in Google ParcelYard2027h1, entry 598,236,742
    SHA-256 518fc4b75bd4308a8d38e39a065a6386139296794275317b18cceed7189973f7
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.cc
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  10. protonvpn.cc SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    protonvpn.cc
    First seen
    2026-11-03 22:52 UTC
    First published
    2026-11-03 23:22 UTC
    DNS
    Resolves · checked 2026-11-04 23:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 21:48 UTC to 2027-02-01 21:48 UTC
    Logged 2026-11-03 22:46 UTC in Google PlumbersArms2027h1, entry 598,653,737
    SHA-256 90d86b259fa60e68a2e9ffdf82bcd6573d54d48a8bc191263e9ead7cf7b72357
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Proton
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    protonvpn.cc
    Registered
    2026-11-03 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  11. www.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    www.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  12. webmail.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    webmail.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  13. webdisk.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    webdisk.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  14. mail.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    mail.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  15. en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  16. cpcontacts.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    cpcontacts.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  17. cpcalendars.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    cpcalendars.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  18. cpanel.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    cpanel.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  19. autodiscover.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    autodiscover.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  20. autoconfig.en-protonvpn.com GB · AS199404 · WHG-IN WHG Hosting Services…
    ListedPhishing hostUnder en-protonvpn.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    autoconfig.en-protonvpn.com
    First seen
    2026-11-03 03:11 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask, listing en-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.92.174.190.
    1. Phishing-host list fetched with the address
    2. Resolved to 190.92.174.190
    3. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 02:11 UTC to 2027-02-01 02:11 UTC
    Logged 2026-11-03 03:10 UTC in Google ParcelYard2027h1, entry 582,890,668
    SHA-256 576af25c54ce6b158052c4eaabcf4887b2e83366bebf99afd6b433a01bd73840
    Public key SHA-256 62befc64e7ab8d191b9f4612469764ce5f4b434cceb88313189b56b120c4d7cf
    Brand
    Proton
    Addresses
    190.92.174.190 · United Kingdom · AS199404 WHG-IN WHG Hosting Services Ltd
    Domain
    en-protonvpn.com
    Registered
    2026-05-23 · Spaceship, Inc.
    MX
    Receives mail at en-protonvpn.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  21. w2-protonvpn.com US · AS399077 · Tcloudnet
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    w2-protonvpn.com
    First seen
    2026-11-02 22:51 UTC
    First published
    2026-11-02 23:02 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:12 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-31 23:59 UTC
    Logged 2026-11-02 22:46 UTC in IPng Networks Gouda2027h1, entry 297,072,287
    SHA-256 14642f6fda6dd97a7fd99716833ce7dc58a4ce77c0310c7c3459d56ff5110185
    Public key SHA-256 a5a36ca361b6f076c0860be5e7b7d7b9fc48c6ee60d8e28d835b29397de24475
    Brand
    Proton
    Addresses
    156.240.210.148 · United States · AS399077 TERAEXCH - Tcloudnet
    Domain
    w2-protonvpn.com
    Registered
    2025-10-21 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  22. www.w2-protonvpn.com US · AS399077 · Tcloudnet
    ListedUnder w2-protonvpn.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    www.w2-protonvpn.com
    First seen
    2026-11-02 22:51 UTC
    First published
    2026-11-02 23:02 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:12 UTC
    Listed
    MetaMask, listing w2-protonvpn.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-31 23:59 UTC
    Logged 2026-11-02 22:46 UTC in IPng Networks Gouda2027h1, entry 297,072,287
    SHA-256 14642f6fda6dd97a7fd99716833ce7dc58a4ce77c0310c7c3459d56ff5110185
    Public key SHA-256 a5a36ca361b6f076c0860be5e7b7d7b9fc48c6ee60d8e28d835b29397de24475
    Brand
    Proton
    Addresses
    156.240.210.148 · United States · AS399077 TERAEXCH - Tcloudnet
    Domain
    w2-protonvpn.com
    Registered
    2025-10-21 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  23. protonvpn.st US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    protonvpn.st
    First seen
    2026-10-30 17:21 UTC
    First published
    2026-10-30 18:07 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:13 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 16:19 UTC to 2027-01-28 17:17 UTC
    Logged 2026-10-30 17:19 UTC in Geomys Tuscolo2027h1, entry 410,091,922
    SHA-256 4924889294a853f2856436c978b9cd14a01fc078bdfd041a26ea914313eecaa5
    Public key SHA-256 9005f964811a0aefa529e7c7902289f5a70bfb08fa15da3f1bb85c79b380ab9c
    Brand
    Proton
    Addresses
    104.21.43.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:d9fa
    2606:4700:3037::6815:2b1f
    Cloudflare
    Cloudflare (104.21.43.31, 172.67.217.250): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    protonvpn.st
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  24. www.standardnotes.com.cn HK · AS135377 · UCLOUD INFORMATION TECHNOLO…
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.standardnotes.com.cn
    First seen
    2026-10-27 21:37 UTC
    DNS
    Resolves · checked 2026-11-05 09:07 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 101.36.109.250.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 101.36.109.250
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-10-27 20:00 UTC to 2027-01-25 19:59 UTC
    Logged 2026-10-27 21:29 UTC in Google Xenon2027h1, entry 600,403,417
    SHA-256 f2a3afa8bf14782b03afeaf9452e38f37d5abe9a153b5cf600681834fb9cf008
    Public key SHA-256 8bb92b07d2038fab1c128e851b9bc951d1a31ed464f6e57a7d6d2d8a4ad0c343
    Brand
    Proton
    Addresses
    101.36.109.250 · Hong Kong · AS135377 UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
    Domain
    standardnotes.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

  25. standardnotes.com.cn HK · AS135377 · UCLOUD INFORMATION TECHNOLO…
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    standardnotes.com.cn
    First seen
    2026-10-27 21:37 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 101.36.109.250.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 101.36.109.250
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-10-27 20:00 UTC to 2027-01-25 19:59 UTC
    Logged 2026-10-27 21:29 UTC in Google Xenon2027h1, entry 600,403,417
    SHA-256 f2a3afa8bf14782b03afeaf9452e38f37d5abe9a153b5cf600681834fb9cf008
    Public key SHA-256 8bb92b07d2038fab1c128e851b9bc951d1a31ed464f6e57a7d6d2d8a4ad0c343
    Brand
    Proton
    Addresses
    101.36.109.250 · Hong Kong · AS135377 UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
    Domain
    standardnotes.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Proton when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Email & webmail

All brands →