Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-05 12:01 UTC
Certificate-log entries · 24 h
318.1M
from 84 distinct feeds
Unique certificates · 24 h
33.3M
each reviewed
Names resolved · 24 h
21.1M
15.4M with an address
Findings · 24 h
5,360
226 of 1,061 brands targeted

531 hostnames from the last 24 hours.

  1. pagopa-gov.online CN · AS132203 · Tencent Building, Kejizhong…PagoPA
    Phishing hostTencent CloudAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    pagopa-gov.online
    First seen
    2026-11-04 13:02 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 43.165.5.244.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 43.165.5.244
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 11:50 UTC to 2027-02-02 11:50 UTC
    Logged 2026-11-04 12:49 UTC in Google PlumbersArms2027h1, entry 608,996,628
    SHA-256 4cc47e47ec673a54bbeea57f1a0ac1cc3e658e2b048a4856afe6e91362254bea
    Public key SHA-256 b4babfb93e5e82b5a53ad58f5846b6deeca41c82ed6a5602ceb9bae3f0eb6d91
    Brand
    PagoPA
    Addresses
    43.165.5.244 · China · AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue · Tencent Cloud (cloud provider)
    Tencent Cloud
    Tencent Cloud (43.165.5.244): a cloud provider. It rents servers and addresses to its customers.
    Domain
    pagopa-gov.online
    Registered
    2026-11-04 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:11 UTC

    Suggest a correction

  2. walmartcom.com US · AS40244 · Turnkey Internet Inc.Walmart
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 16 y ago
    DetailsHide
    Hostname
    walmartcom.com
    First seen
    2026-11-04 13:02 UTC
    DNS
    Resolves · checked 2026-11-04 13:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 199.193.114.101.
    1. Phishing-host list fetched with the address
    2. Resolved to 199.193.114.101
    Brand
    Walmart
    Addresses
    199.193.114.101 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    Domain
    walmartcom.com
    Registered
    2010-10-31 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  3. facebook.com-marketplace-45657784.lefn.cl US · AS397423 · Tier.Net Technologies LLCFacebook
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    facebook.com-marketplace-45657784.lefn.cl
    First seen
    2026-11-04 13:01 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 38.18.230.11.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 38.18.230.11
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 11:59 UTC to 2027-02-02 11:59 UTC
    Logged 2026-11-04 12:57 UTC in IPng Networks Gouda2027h1, entry 314,485,936
    SHA-256 18996c2de3ceacde6536df61a25bb8b184cad3aa12003e9c9644459dfb67c82f
    Public key SHA-256 b6bc405c02077408e074f71efa4cd73bbd437b13c37acfb1cbe26553b6965462
    Brand
    Facebook
    Addresses
    38.18.230.11 · United States · AS397423 TIER-NET - Tier.Net Technologies LLC
    Domain
    lefn.cl
    MX
    Receives mail at mail.lefn.cl
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:03 UTC

    Suggest a correction

  4. podcasts.sberbankmobile.ru RU · AS49063 · DTLN Data Storage Center JSCSberbank
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    podcasts.sberbankmobile.ru
    First seen
    2026-11-04 12:57 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 87.242.79.60.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 87.242.79.60
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 11:42 UTC to 2027-02-02 11:42 UTC
    Logged 2026-11-04 12:41 UTC in Let's Encrypt Sycamore2027h1, entry 941,105,627
    SHA-256 a1490d72c0db82f7a0c466c959ba977ac7b67abd28074352fa1bf7519d921397
    Public key SHA-256 d7c69ad5e54f45bf227fad82fbe52e20a0948760d3df087ce085d9f8ed8a6f6f
    Brand
    Sberbank
    Addresses
    87.242.79.60 · Russia · AS49063 DTLN Data Storage Center JSC
    Domain
    sberbankmobile.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  5. conserto-de-iphone-ipad.com.br BR · AS53107 · EVEO S.A.Apple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 12 y ago
    DetailsHide
    Hostname
    conserto-de-iphone-ipad.com.br
    First seen
    2026-11-04 12:31 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 177.136.234.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 177.136.234.91
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-04 11:28 UTC to 2027-02-02 11:28 UTC
    Logged 2026-11-04 12:27 UTC in Google PlumbersArms2027h1, entry 608,714,682
    SHA-256 9773b6f229b0945ece1a2cab7f3c249aa3ab1193aafc49a9d5468c0a12e53415
    Public key SHA-256 2113a2f00239d3b38903403a8080598214eb36d7417ffcbcad58c08f16dc53d9
    Brand
    Apple
    Addresses
    177.136.234.91 · Brazil · AS53107 AS53107 - EVEO S.A.
    Domain
    conserto-de-iphone-ipad.com.br
    Registered
    2014-05-31
    MX
    Receives mail at conserto-de-iphone-ipad.com.br
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:11 UTC

    Suggest a correction

  6. www.customerservice-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    www.customerservice-linkedin.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 11:22 UTC to 2027-02-02 11:22 UTC
    Logged 2026-11-04 12:20 UTC in IPng Networks Gouda2027h1, entry 314,202,841
    SHA-256 96aa11dfaaf1c366ec7f99efe395a0ea4b60f4776b6474bdf89420281f354088
    Public key SHA-256 51ffc603efed73fa85a6fef957bc1aeee48beb4c255510665d5a5cb361842bc6
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    customerservice-linkedin.com
    Registered
    2026-09-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at customerservice-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  7. webdisk.customerservice-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    webdisk.customerservice-linkedin.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 11:22 UTC to 2027-02-02 11:22 UTC
    Logged 2026-11-04 12:20 UTC in IPng Networks Gouda2027h1, entry 314,202,841
    SHA-256 96aa11dfaaf1c366ec7f99efe395a0ea4b60f4776b6474bdf89420281f354088
    Public key SHA-256 51ffc603efed73fa85a6fef957bc1aeee48beb4c255510665d5a5cb361842bc6
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    customerservice-linkedin.com
    Registered
    2026-09-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at customerservice-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  8. webmail.customerservice-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    webmail.customerservice-linkedin.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 11:22 UTC to 2027-02-02 11:22 UTC
    Logged 2026-11-04 12:20 UTC in IPng Networks Gouda2027h1, entry 314,202,841
    SHA-256 96aa11dfaaf1c366ec7f99efe395a0ea4b60f4776b6474bdf89420281f354088
    Public key SHA-256 51ffc603efed73fa85a6fef957bc1aeee48beb4c255510665d5a5cb361842bc6
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    customerservice-linkedin.com
    Registered
    2026-09-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at customerservice-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  9. mail.customerservice-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    mail.customerservice-linkedin.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 11:22 UTC to 2027-02-02 11:22 UTC
    Logged 2026-11-04 12:20 UTC in IPng Networks Gouda2027h1, entry 314,202,841
    SHA-256 96aa11dfaaf1c366ec7f99efe395a0ea4b60f4776b6474bdf89420281f354088
    Public key SHA-256 51ffc603efed73fa85a6fef957bc1aeee48beb4c255510665d5a5cb361842bc6
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    customerservice-linkedin.com
    Registered
    2026-09-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at customerservice-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  10. cpanel.customerservice-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    cpanel.customerservice-linkedin.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 11:22 UTC to 2027-02-02 11:22 UTC
    Logged 2026-11-04 12:20 UTC in IPng Networks Gouda2027h1, entry 314,202,841
    SHA-256 96aa11dfaaf1c366ec7f99efe395a0ea4b60f4776b6474bdf89420281f354088
    Public key SHA-256 51ffc603efed73fa85a6fef957bc1aeee48beb4c255510665d5a5cb361842bc6
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    customerservice-linkedin.com
    Registered
    2026-09-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at customerservice-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  11. cpcalendars.customerservice-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    cpcalendars.customerservice-linkedin.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 11:22 UTC to 2027-02-02 11:22 UTC
    Logged 2026-11-04 12:20 UTC in IPng Networks Gouda2027h1, entry 314,202,841
    SHA-256 96aa11dfaaf1c366ec7f99efe395a0ea4b60f4776b6474bdf89420281f354088
    Public key SHA-256 51ffc603efed73fa85a6fef957bc1aeee48beb4c255510665d5a5cb361842bc6
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    customerservice-linkedin.com
    Registered
    2026-09-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at customerservice-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  12. cpcontacts.customerservice-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    cpcontacts.customerservice-linkedin.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 11:22 UTC to 2027-02-02 11:22 UTC
    Logged 2026-11-04 12:20 UTC in IPng Networks Gouda2027h1, entry 314,202,841
    SHA-256 96aa11dfaaf1c366ec7f99efe395a0ea4b60f4776b6474bdf89420281f354088
    Public key SHA-256 51ffc603efed73fa85a6fef957bc1aeee48beb4c255510665d5a5cb361842bc6
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    customerservice-linkedin.com
    Registered
    2026-09-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at customerservice-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  13. customerservice-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    customerservice-linkedin.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 11:22 UTC to 2027-02-02 11:22 UTC
    Logged 2026-11-04 12:20 UTC in IPng Networks Gouda2027h1, entry 314,202,841
    SHA-256 96aa11dfaaf1c366ec7f99efe395a0ea4b60f4776b6474bdf89420281f354088
    Public key SHA-256 51ffc603efed73fa85a6fef957bc1aeee48beb4c255510665d5a5cb361842bc6
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    customerservice-linkedin.com
    Registered
    2026-09-04 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at customerservice-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  14. cdek.internal.pay.avito.qiwbpchh9caly81t.rhxyvcq9vvts2ld9.r.mail.leankoala.com FR · AS200484 · SENDINBLUE-ASN Sendinblue S…Avito
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 11 y ago
    DetailsHide
    Hostname
    cdek.internal.pay.avito.qiwbpchh9caly81t.rhxyvcq9vvts2ld9.r.mail.leankoala.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.246.243.65.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 172.246.243.65
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 11:26 UTC to 2027-02-02 11:26 UTC
    Logged 2026-11-04 12:25 UTC in Geomys Tuscolo2027h1, entry 473,025,243
    SHA-256 5fde115f93076a7c723b1ee8ca1298ce6d09368d6045c0d6b38fee1212997644
    Public key SHA-256 54c0e86f843571fc4d4a0f9539d440ff6fd33dd91e057f5dc34bf8e054d87ab6
    Brand
    Avito
    Addresses
    172.246.243.65 · France · AS200484 SENDINBLUE-ASN Sendinblue SAS
    Domain
    leankoala.com
    Registered
    2016-03-15 · united-domains GmbH
    MX
    Receives mail at mx00.udag.de, mx01.udag.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  15. blablacar.login-yandex.qiwbpchh9caly81t.rhxyvcq9vvts2ld9.r.mail.leankoala.com FR · AS200484 · SENDINBLUE-ASN Sendinblue S…BlaBlaCar+1
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 11 y ago
    DetailsHide
    Hostname
    blablacar.login-yandex.qiwbpchh9caly81t.rhxyvcq9vvts2ld9.r.mail.leankoala.com
    First seen
    2026-11-04 12:27 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.246.243.65.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 172.246.243.65
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-04 11:24 UTC to 2027-02-02 11:24 UTC
    Logged 2026-11-04 12:22 UTC in Let's Encrypt Sycamore2027h1, entry 940,860,470
    SHA-256 25935d4ca951659d071027df4f21fa4d78a9d622fe7c79f7f4069809f5729bc1
    Public key SHA-256 a48ca5943e0e176499fa42b9aad2b7d0d63d4645abfd600f1499aa594889545d
    Brands
    BlaBlaCar, Yandex
    Addresses
    172.246.243.65 · France · AS200484 SENDINBLUE-ASN Sendinblue SAS
    Domain
    leankoala.com
    Registered
    2016-03-15 · united-domains GmbH
    MX
    Receives mail at mx00.udag.de, mx01.udag.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  16. www.sbermarket.0update.yandex.sber.prod2.hawkinswoodshop.com US · AS20473 · The Constant Company, LLC3 addressesYandex
    Phishing hostVultrAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantineRegistered 8 y ago
    DetailsHide
    Hostname
    www.sbermarket.0update.yandex.sber.prod2.hawkinswoodshop.com
    First seen
    2026-11-04 12:21 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.77.75.133.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.77.75.133
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 11:21 UTC to 2027-02-02 11:21 UTC
    Logged 2026-11-04 12:19 UTC in IPng Networks Halloumi2027h1, entry 361,186,490
    SHA-256 18c1bbec925fcf3e78360e8e68788d6f78038dd52dd38c90e65b6b213fad913f
    Public key SHA-256 e634ab1f3ef2e4df7154a3910f43b3f37d34efc799a4a028ca03415f6ebe7c5d
    Brand
    Yandex
    Addresses
    45.77.75.133 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    45.77.92.157 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    207.246.78.75 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    Vultr
    Vultr (45.77.75.133, 45.77.92.157, 207.246.78.75): a cloud provider. It rents servers and addresses to its customers.
    Domain
    hawkinswoodshop.com
    Registered
    2018-11-11 · NameSilo, LLC
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  17. sbermegamarket.98pochtabank.0update.yandex.sber.prod2.hawkinswoodshop.com US · AS20473 · The Constant Company, LLC3 addressesYandex
    Phishing hostVultrAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantineRegistered 8 y ago
    DetailsHide
    Hostname
    sbermegamarket.98pochtabank.0update.yandex.sber.prod2.hawkinswoodshop.com
    First seen
    2026-11-04 12:21 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.77.75.133.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.77.75.133
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 11:11 UTC to 2027-02-02 11:11 UTC
    Logged 2026-11-04 12:09 UTC in Google PlumbersArms2027h1, entry 608,483,369
    SHA-256 4474232725ea3c9e72fadfb989a20ab2774f1b7f355c43a98157ab3df65fa13a
    Public key SHA-256 73561f3c0a6230b883bad7fa5af55717738798a11e01ee44336cca2ed99251ab
    Brand
    Yandex
    Addresses
    45.77.75.133 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    45.77.92.157 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    207.246.78.75 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    Vultr
    Vultr (45.77.75.133, 45.77.92.157, 207.246.78.75): a cloud provider. It rents servers and addresses to its customers.
    Domain
    hawkinswoodshop.com
    Registered
    2018-11-11 · NameSilo, LLC
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  18. m.bitget-hub.cn HK · AS134175 · UNIT A17,9/F SILVERCORP INT…Bitget
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    m.bitget-hub.cn
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-05 07:32 UTC
    DNS
    Resolves · checked 2026-11-05 07:44 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 177.211.118.185.
    1. Resolved to 177.211.118.185
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Bitget
    Addresses
    177.211.118.185 · Hong Kong · AS134175 SH2206-AP - UNIT A17,9/F SILVERCORP INT'L TOWER 707-713 NATHAN RD
    Domain
    bitget-hub.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 07:27 UTC

    Suggest a correction

  19. mail.inv-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 8 d ago
    DetailsHide
    Hostname
    mail.inv-linkedin.com
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 11:07 UTC to 2027-02-02 11:07 UTC
    Logged 2026-11-04 12:05 UTC in Google ParcelYard2027h1, entry 607,999,723
    SHA-256 0d48123c1bd71c5d7b242e76d94957239ae92e078129ec4b9d72515b67484acc
    Public key SHA-256 dd72149fde5dfe3e5d1e737482d9d475a8a31020a73f6975ad2088ece1c9a281
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    inv-linkedin.com
    Registered
    2026-10-28 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at _dc-mx.32534fb664bd.inv-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  20. inv-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 8 d ago
    DetailsHide
    Hostname
    inv-linkedin.com
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 11:07 UTC to 2027-02-02 11:07 UTC
    Logged 2026-11-04 12:05 UTC in Google ParcelYard2027h1, entry 607,999,723
    SHA-256 0d48123c1bd71c5d7b242e76d94957239ae92e078129ec4b9d72515b67484acc
    Public key SHA-256 dd72149fde5dfe3e5d1e737482d9d475a8a31020a73f6975ad2088ece1c9a281
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    inv-linkedin.com
    Registered
    2026-10-28 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at _dc-mx.32534fb664bd.inv-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  21. dhl.nl.qas-benelux.edistrada.pl PL · AS20889 · A41-AS All for One Poland S…2 addressesDHL
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 15 y ago
    DetailsHide
    Hostname
    dhl.nl.qas-benelux.edistrada.pl
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.206.38.164.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.206.38.164
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-04 11:11 UTC to 2027-02-02 11:11 UTC
    Logged 2026-11-04 12:09 UTC in Google ParcelYard2027h1, entry 608,057,489
    SHA-256 1510099202e5255ad1328b806108beef6f4616d9c205da71188708a1c66b6d43
    Public key SHA-256 a6e9f713fb6aab10b5fbd0353cd2d7ecf740cc6d2c4daff62cb217bf9bda33b5
    Brand
    DHL
    Addresses
    91.206.38.164 · Poland · AS20889 A41-AS All for One Poland Sp. z o.o.
    91.206.38.179 · Poland · AS20889 A41-AS All for One Poland Sp. z o.o.
    Domain
    edistrada.pl
    Registered
    2011-09-15 · OVH SAS
    MX
    Receives mail at mail.edistrada.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 13:11 UTC

    Suggest a correction

  22. cpanel.inv-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 8 d ago
    DetailsHide
    Hostname
    cpanel.inv-linkedin.com
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 11:07 UTC to 2027-02-02 11:07 UTC
    Logged 2026-11-04 12:05 UTC in Google ParcelYard2027h1, entry 607,999,723
    SHA-256 0d48123c1bd71c5d7b242e76d94957239ae92e078129ec4b9d72515b67484acc
    Public key SHA-256 dd72149fde5dfe3e5d1e737482d9d475a8a31020a73f6975ad2088ece1c9a281
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    inv-linkedin.com
    Registered
    2026-10-28 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at _dc-mx.32534fb664bd.inv-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  23. cpcalendars.inv-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 8 d ago
    DetailsHide
    Hostname
    cpcalendars.inv-linkedin.com
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 11:07 UTC to 2027-02-02 11:07 UTC
    Logged 2026-11-04 12:05 UTC in Google ParcelYard2027h1, entry 607,999,723
    SHA-256 0d48123c1bd71c5d7b242e76d94957239ae92e078129ec4b9d72515b67484acc
    Public key SHA-256 dd72149fde5dfe3e5d1e737482d9d475a8a31020a73f6975ad2088ece1c9a281
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    inv-linkedin.com
    Registered
    2026-10-28 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at _dc-mx.32534fb664bd.inv-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  24. cpcontacts.inv-linkedin.com FR · AS16276 · OVH OVH SASLinkedIn
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 8 d ago
    DetailsHide
    Hostname
    cpcontacts.inv-linkedin.com
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.68.132.246.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.68.132.246
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 11:07 UTC to 2027-02-02 11:07 UTC
    Logged 2026-11-04 12:05 UTC in Google ParcelYard2027h1, entry 607,999,723
    SHA-256 0d48123c1bd71c5d7b242e76d94957239ae92e078129ec4b9d72515b67484acc
    Public key SHA-256 dd72149fde5dfe3e5d1e737482d9d475a8a31020a73f6975ad2088ece1c9a281
    Brand
    LinkedIn
    Addresses
    51.68.132.246 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.68.132.246): a cloud provider. It rents servers and addresses to its customers.
    Domain
    inv-linkedin.com
    Registered
    2026-10-28 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at _dc-mx.32534fb664bd.inv-linkedin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:12 UTC

    Suggest a correction

  25. bitget-hub.cn HK · AS134175 · UNIT A17,9/F SILVERCORP INT…Bitget
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    bitget-hub.cn
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-05 07:32 UTC
    DNS
    Resolves · checked 2026-11-05 07:44 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 177.211.118.185.
    1. Resolved to 177.211.118.185
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Bitget
    Addresses
    177.211.118.185 · Hong Kong · AS134175 SH2206-AP - UNIT A17,9/F SILVERCORP INT'L TOWER 707-713 NATHAN RD
    Domain
    bitget-hub.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 07:27 UTC

    Suggest a correction

  26. www.bitget-hub.cn HK · AS134175 · UNIT A17,9/F SILVERCORP INT…Bitget
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.bitget-hub.cn
    First seen
    2026-11-04 12:10 UTC
    First published
    2026-11-05 07:32 UTC
    DNS
    Resolves · checked 2026-11-05 07:44 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 177.211.118.185.
    1. Resolved to 177.211.118.185
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Bitget
    Addresses
    177.211.118.185 · Hong Kong · AS134175 SH2206-AP - UNIT A17,9/F SILVERCORP INT'L TOWER 707-713 NATHAN RD
    Domain
    bitget-hub.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 07:27 UTC

    Suggest a correction

  27. wwwryanair.com US · AS40244 · Turnkey Internet Inc.2 addressesRyanair
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 26 y ago
    DetailsHide
    Hostname
    wwwryanair.com
    First seen
    2026-11-04 12:02 UTC
    DNS
    Resolves · checked 2026-11-05 12:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 199.193.114.102.
    1. Phishing-host list fetched with the address
    2. Resolved to 199.193.114.102
    Brand
    Ryanair
    Addresses
    199.193.114.102 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    199.193.114.103 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    Domain
    wwwryanair.com
    Registered
    2000-08-16 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  28. wwwthetollroads.com NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addressesThe Toll Roads
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    wwwthetollroads.com
    First seen
    2026-11-04 12:02 UTC
    DNS
    Resolves · checked 2026-11-05 12:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 213.227.156.75.
    1. Phishing-host list fetched with the address
    2. Resolved to 213.227.156.75
    Brand
    The Toll Roads
    Addresses
    213.227.156.75 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    213.227.156.74 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    wwwthetollroads.com
    Registered
    2018-11-30 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  29. samsungicloud.com NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addressesSamsung
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    samsungicloud.com
    First seen
    2026-11-04 12:02 UTC
    DNS
    Resolves · checked 2026-11-05 12:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 37.48.110.47.
    1. Phishing-host list fetched with the address
    2. Resolved to 37.48.110.47
    Brand
    Samsung
    Addresses
    37.48.110.47 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    199.193.114.45 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    Domain
    samsungicloud.com
    Registered
    2018-10-05 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  30. clticards.com US · AS40244 · Turnkey Internet Inc.2 addressesCitiLookalike of citicards.com · similar-looking characters
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    clticards.com
    First seen
    2026-11-04 12:02 UTC
    DNS
    Resolves · checked 2026-11-05 12:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 199.193.114.43.
    1. Phishing-host list fetched with the address
    2. Resolved to 199.193.114.43
    Brand
    Citi (spelled like citicards.com with similar-looking characters)
    Addresses
    199.193.114.43 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    199.193.114.45 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    Domain
    clticards.com
    Registered
    2018-10-18 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 11:21 UTC

    Suggest a correction

  31. ledgerlive-ledgers.us US · AS53667 · FranTech Solutions2 addressesLedger
    Phishing hostSame certificateAddress hosted confirmed phishing in the last 48 h · Same certificate as www.ledgerlive-ledgers.us.trezor-suitetrezor.us, listed by MetaMask (under trezor-suitetrezor.us)MX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    ledgerlive-ledgers.us
    First seen
    2026-11-03 17:36 UTC
    First published
    2026-11-03 18:16 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    Same certificate
    Same certificate as www.ledgerlive-ledgers.us.trezor-suitetrezor.us: listed by MetaMask (under trezor-suitetrezor.us); on a phishing host at 198.251.89.144; a Trezor lookalike
    Hosting-alias name of www.ledgerlive-ledgers.us.trezor-suitetrezor.us
    Ledger appears in this hostname
    Resolved to 173.211.81.11, an address that hosted confirmed phishing
    2 of 3 domains on this certificate have their own listing evidence
    Certificate 7c744a70b61221e2… · 3 domains on it · first seen 2026-11-03 17:36 UTC
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-03 16:34 UTC to 2027-02-01 16:34 UTC
    Logged 2026-11-03 17:32 UTC in DigiCert Wyvern2027h1, entry 391,322,360
    SHA-256 7c744a70b61221e244d478de2c87fe7dfc4dd584ac6dde4157a0004b71d8cc6e
    Public key SHA-256 00b6cca3eb7c7bf5b6bd810eb332813abd07c79d23263904ae3f3a5d171b52af
    Brand
    Ledger
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    173.211.81.11 · United States · AS396356 LATITUDE-SH - Latitude.sh
    Domain
    ledgerlive-ledgers.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at ledgerlive-ledgers.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

Showing 501–531 of 531 hostnames.Back to the start
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources