Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-05 22:09 UTC
Certificate-log entries · 24 h
319.4M
from 84 distinct feeds
Unique certificates · 24 h
34.5M
each reviewed
Names resolved · 24 h
22.0M
16.2M with an address
Findings · 24 h
5,794
232 of 1,061 brands targeted

5,794 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. 6jk9sx.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    6jk9sx.hdiv8jy.com
    First seen
    2026-11-05 22:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-05 21:03 UTC to 2027-02-03 21:03 UTC
    Logged 2026-11-05 22:02 UTC in Google PlumbersArms2027h1, entry 633,658,222
    SHA-256 045c6e2ff240a83e27d198454e40309eef99ae0f3da5b7c4b36a2ae00e7b0e2e
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  2. bourcapitve-fr.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    bourcapitve-fr.live
    First seen
    2026-11-05 22:05 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 21:00 UTC to 2027-02-03 21:59 UTC
    Logged 2026-11-05 22:00 UTC in Google PlumbersArms2027h1, entry 633,634,255
    SHA-256 0c80217c9e7fdc5c643462b7cdbfcba516f62f18a155fc3789a5ac44a579d24e
    Public key SHA-256 c9fd71c6f3fafdecf575d6966ad2fffd2884eb40b2fe5ae6819dd3d94a00fb55
    Addresses
    104.21.5.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.174 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.5.193, 172.67.154.174): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bourcapitve-fr.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  3. coinbase-forestdd.netCoinbase
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    coinbase-forestdd.net
    First seen
    2026-11-05 22:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 21:05 UTC to 2027-02-03 21:05 UTC
    Logged 2026-11-05 22:04 UTC in Google ParcelYard2027h1, entry 633,293,158
    SHA-256 58cb98f43e587f337ac6be76b551006ff930c7711ed80fd74868a30fac842975
    Public key SHA-256 a657bfd07c55e5f3ab3098cedfa70f0c916fcbd5f55f1e1e892935221ab20831
    Brand
    Coinbase
    Domain
    coinbase-forestdd.net
    Registered
    2026-03-14 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  4. creaenaltura.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    creaenaltura.com
    First seen
    2026-11-05 22:05 UTC
    Listing
    CERT Polska listed it 2026-05-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 21:01 UTC to 2027-02-03 21:01 UTC
    Logged 2026-11-05 22:00 UTC in Google ParcelYard2027h1, entry 633,238,231
    SHA-256 5b4d7ef47dfc08a7d4324ca16baf18b0fd5bf4e52853392a0acd2c4a8cd1e2a5
    Public key SHA-256 c91785ba7e8a34f7fe0fbc34299cf06892e9ae84ac9da8b467095e04f2cef383
    Addresses
    104.21.66.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.201.134 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.62, 172.67.201.134): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    creaenaltura.com
    Registered
    2026-05-12 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  5. fi-ventures.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    fi-ventures.com
    First seen
    2026-11-05 22:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-05 21:02 UTC to 2027-02-03 22:00 UTC
    Logged 2026-11-05 22:02 UTC in Let's Encrypt Sycamore2027h1, entry 967,416,158
    SHA-256 5729e284d544ec8176748d29db7ed69c3f63f4d8d3dedbbbf71d36354de426ec
    Public key SHA-256 1e95740f9829f953817d08a55492e95211ff57050875f0f0e8d928279b906e37
    PhishDestroy
    Addresses
    104.21.48.93 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.48.93, 172.67.183.63): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fi-ventures.com
    Registered
    2026-04-20 · Cloudflare, Inc.
    MX
    Receives mail at route3.mx.cloudflare.net, route1.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  6. nextcloud.socialvisor.ru RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder socialvisor.ru, reported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    nextcloud.socialvisor.ru
    First seen
    2026-11-05 22:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing socialvisor.ru and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-05 21:05 UTC to 2027-02-03 21:05 UTC
    Logged 2026-11-05 22:03 UTC in DigiCert Sphinx2027h1, entry 371,954,343
    SHA-256 5299a53e850061c56a61e449cee16d7a6ae50f4d52267b27d36f0ef152ef3c2a
    Public key SHA-256 37aaebc55b75df60d02162238ac21a9843cb3002afba30a4305fe3c69f7cbe41
    PhishDestroy
    Addresses
    91.215.41.91 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (91.215.41.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    socialvisor.ru
    MX
    Receives mail at emx.mail.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  7. occasy-cutover-rehearsal.fi-ventures.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder fi-ventures.com, reported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    occasy-cutover-rehearsal.fi-ventures.com
    First seen
    2026-11-05 22:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing fi-ventures.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-05 21:02 UTC to 2027-02-03 22:00 UTC
    Logged 2026-11-05 22:02 UTC in Let's Encrypt Sycamore2027h1, entry 967,416,158
    SHA-256 5729e284d544ec8176748d29db7ed69c3f63f4d8d3dedbbbf71d36354de426ec
    Public key SHA-256 1e95740f9829f953817d08a55492e95211ff57050875f0f0e8d928279b906e37
    PhishDestroy
    Addresses
    104.21.48.93 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.48.93, 172.67.183.63): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fi-ventures.com
    Registered
    2026-04-20 · Cloudflare, Inc.
    MX
    Receives mail at route3.mx.cloudflare.net, route1.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  8. stellar-banking.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    stellar-banking.com
    First seen
    2026-11-05 22:05 UTC
    Listing
    CERT Polska listed it 2026-05-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 21:00 UTC to 2027-02-03 21:58 UTC
    Logged 2026-11-05 22:00 UTC in Google PlumbersArms2027h1, entry 633,631,535
    SHA-256 8df483d598f2a9a4e67320181a617a9c6adb64fdc69a2bcbdd7640b9e25c7130
    Public key SHA-256 a7c3587fe36158fd48614eb943ee50f03857fd5e7fefb3169bf1913c12ba10d1
    Addresses
    104.21.4.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.194 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.4.72, 172.67.131.194): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    stellar-banking.com
    Registered
    2025-12-04 · Porkbun LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  9. www.bvbqq.ezgateway.net US · AS13335 · Cloudflare, Inc.
    ListedCloudflareUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    www.bvbqq.ezgateway.net
    First seen
    2026-11-05 22:05 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-05 21:00 UTC to 2027-02-03 21:59 UTC
    Logged 2026-11-05 22:00 UTC in Google ParcelYard2027h1, entry 633,248,399
    SHA-256 1898c556cc435f412fa1a130ceccef7f0ee8f2a58a51f5cdc746bc56a14b9d19
    Public key SHA-256 a12c202d67fbea915cc4beb3f8286447089cb502aa5a638ace0514af1437d1bc
    Addresses
    172.67.165.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.67.165.35): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  10. www.service.zenavlico.cyou TJ · AS208885 · NFS-AS Noyobzoda Faridduni …
    ListedUnder zenavlico.cyou, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    www.service.zenavlico.cyou
    First seen
    2026-11-05 22:05 UTC
    Listing
    CERT Polska listed it 2026-05-25 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska, listing zenavlico.cyou and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2
    Valid 2026-11-05 00:00 UTC to 2027-02-03 23:59 UTC
    Logged 2026-11-05 22:03 UTC in Let's Encrypt Willow2027h1, entry 957,936,570
    SHA-256 3d93cc50df565f487709a02d05d72eaa2bd0cf6f9006314583e7f088c31f5c65
    Public key SHA-256 2ed08604afdcf3e7419e384207ff943be50a20bdd361197d91a8bb5028dcd6a3
    Addresses
    95.85.244.13 · Tajikistan · AS208885 NFS-AS Noyobzoda Faridduni Saidilhom
    Domain
    zenavlico.cyou
    Registered
    2026-01-26 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  11. aiyaphorm-de.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    aiyaphorm-de.live
    First seen
    2026-11-05 22:01 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:58 UTC to 2027-02-03 21:56 UTC
    Logged 2026-11-05 21:58 UTC in Google PlumbersArms2027h1, entry 633,612,207
    SHA-256 94dc4ceebf89fc80ba32a96b31e134b7be9f4becb6055c46700aa3a71a78729c
    Public key SHA-256 c4a45f25331962be351899f4ca1033519412361082965498c47f2724c46fa781
    Addresses
    104.21.48.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.48.31, 172.67.176.108): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aiyaphorm-de.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  12. apeaap.com.br BR · AS53107 · EVEO S.A.
    ReportedReported by PhishDestroyMX presentSPF -allDMARC quarantineRegistered 15 y ago
    DetailsHide
    Hostname
    apeaap.com.br
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-05 20:58 UTC to 2027-02-03 20:58 UTC
    Logged 2026-11-05 21:57 UTC in Let's Encrypt Sycamore2027h1, entry 967,334,406
    SHA-256 00757623c0cc9e851c8e8b78e291b1e7feea8fe5e58989bc32550dcff8a2105c
    Public key SHA-256 4f1c7dfeb847cafaf1d862115b815b48dad3ef619ab446f282f601ec7b6720af
    PhishDestroy
    Addresses
    177.104.174.36 · Brazil · AS53107 AS53107 - EVEO S.A.
    Domain
    apeaap.com.br
    Registered
    2012-04-12
    MX
    Receives mail at apeaap.com.br
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  13. bdag.club US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    bdag.club
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:59 UTC to 2027-02-03 21:57 UTC
    Logged 2026-11-05 21:59 UTC in DigiCert Wyvern2027h1, entry 421,238,977
    SHA-256 38577d695ea542e9fa5ecac31548901435565f486f62a47485bcab354873ca8d
    Public key SHA-256 f5dde1b3d4f4a0ad5231df68d0eebaf66caf5833e9f8a8c77a85aa8467aa1447
    PhishDestroy
    Addresses
    104.21.57.57 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.145 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.57.57, 172.67.159.145): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bdag.club
    MX
    Receives mail at _dc-mx.1b457224cf0c.bdag.club
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:06 UTC

    Suggest a correction

  14. biblioteksbladet.stage.io-ext.se BE · AS34762 · COMBELL-AS Combell NV
    ListedUnder io-ext.se, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    biblioteksbladet.stage.io-ext.se
    First seen
    2026-11-05 22:01 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask, listing io-ext.se and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-05 20:58 UTC to 2027-02-03 20:58 UTC
    Logged 2026-11-05 21:56 UTC in DigiCert Wyvern2027h1, entry 421,208,073
    SHA-256 1663c80a1fa1a416d77b602797ed03e092d31326d6d160c60d03c132aedf4298
    Public key SHA-256 435fb54ce1e4cfe5949d5bd22c436b45d945978bace4621d972e684aff3d9008
    Addresses
    188.208.37.75 · Belgium · AS34762 COMBELL-AS Combell NV
    Domain
    io-ext.se
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:03 UTC

    Suggest a correction

  15. birkekapithorn-de.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    birkekapithorn-de.live
    First seen
    2026-11-05 22:01 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:58 UTC to 2027-02-03 21:55 UTC
    Logged 2026-11-05 21:58 UTC in Google ParcelYard2027h1, entry 633,216,597
    SHA-256 701bfb8c08185b54e833637c6742f9e76c5824793638b8b8ef51e70e46faa982
    Public key SHA-256 bee7c7acbbee988070078a56bdefad0a67e4a1894f352f67b38e5b5ff60d5da6
    Addresses
    104.21.94.20 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.94.20, 172.67.218.101): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    birkekapithorn-de.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  16. boost.acctplugins.com KE · AS329278 · Truehost Cloud Limited
    ReportedUnder acctplugins.com, reported by PhishDestroyMX presentSPF ~allDMARC quarantineRegistered 21 mo ago
    DetailsHide
    Hostname
    boost.acctplugins.com
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing acctplugins.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-05 20:59 UTC to 2027-02-03 20:59 UTC
    Logged 2026-11-05 21:57 UTC in Google ParcelYard2027h1, entry 633,204,562
    SHA-256 1dc4f2859805cd4ab7c9b826675c10921345fb0ddccd57b03eabf5a03abef295
    Public key SHA-256 b53bd1709cbe9e3d68c6f294cf783521b524e554ff7b2f7a214bd93837e8ab4a
    PhishDestroy
    Addresses
    156.232.88.10 · Kenya · AS329278 Truehost Cloud Limited - Truehost Cloud Limited
    Domain
    acctplugins.com
    Registered
    2025-02-22 · TuringSign Inc. d/b/a Cosmotown
    MX
    Receives mail at acctplugins.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 06:50 UTC

    Suggest a correction

  17. hub-avalanche.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    hub-avalanche.com
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:59 UTC to 2027-02-03 21:57 UTC
    Logged 2026-11-05 21:59 UTC in Google ParcelYard2027h1, entry 633,225,555
    SHA-256 d059791be166ab920a02305a04dbb40f647826f4084678f978ecdc354f297204
    Public key SHA-256 68d8c28282cb277e747bf7f4ad201ac8f963908428eb3400c4dd413f08fa75bb
    PhishDestroy
    Addresses
    104.21.75.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.177.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.75.132, 172.67.177.72): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hub-avalanche.com
    Registered
    2026-01-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  18. iqyouxuantw.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    iqyouxuantw.shop
    First seen
    2026-11-05 22:01 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 13:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-05 00:00 UTC to 2027-02-03 12:05 UTC
    Logged 2026-11-05 21:56 UTC in Geomys Tuscolo2027h1, entry 492,435,009
    SHA-256 bacbd18b931f1b455c486cfa40e7010c1c38a6fc2fa06d9f842ce08963d0cd02
    Public key SHA-256 61864031a418c8ba08f19b2c6ccc1e0f13deffe60243950c3f856a86e827eef4
    Addresses
    104.21.59.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.211 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.59.228, 172.67.184.211): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    iqyouxuantw.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:06 UTC

    Suggest a correction

  19. kupikody.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 16 d ago
    DetailsHide
    Hostname
    kupikody.com
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-26 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-05 00:00 UTC to 2027-02-01 05:11 UTC
    Logged 2026-11-05 21:56 UTC in IPng Networks Halloumi2027h1, entry 379,270,608
    SHA-256 5acff9e3953ba5ff2bce3227b165a9a8dc3d8923cc56f1678434ea7b8f211315
    Public key SHA-256 acd25c45d6c7d6e36563807d2ee5be892907e2d91d7bedad9a758f7a1b8f587f
    PhishDestroy
    Addresses
    104.21.76.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.202.192 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.76.254, 172.67.202.192): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kupikody.com
    Registered
    2026-10-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  20. mail.apeaap.com.br BR · AS53107 · EVEO S.A.
    ReportedUnder apeaap.com.br, reported by PhishDestroyMX presentSPF -allDMARC quarantineRegistered 15 y ago
    DetailsHide
    Hostname
    mail.apeaap.com.br
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing apeaap.com.br and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-05 20:58 UTC to 2027-02-03 20:58 UTC
    Logged 2026-11-05 21:57 UTC in Let's Encrypt Sycamore2027h1, entry 967,334,406
    SHA-256 00757623c0cc9e851c8e8b78e291b1e7feea8fe5e58989bc32550dcff8a2105c
    Public key SHA-256 4f1c7dfeb847cafaf1d862115b815b48dad3ef619ab446f282f601ec7b6720af
    PhishDestroy
    Addresses
    177.104.174.36 · Brazil · AS53107 AS53107 - EVEO S.A.
    Domain
    apeaap.com.br
    Registered
    2012-04-12
    MX
    Receives mail at apeaap.com.br
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  21. nfltrump.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 25 d ago
    DetailsHide
    Hostname
    nfltrump.net
    First seen
    2026-11-05 22:01 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-05 00:00 UTC to 2027-02-01 06:25 UTC
    Logged 2026-11-05 21:59 UTC in DigiCert Sphinx2027h1, entry 371,912,582
    SHA-256 4f1783b765db47dee5b6d2314337c0251cbbf5fa35c63103439fcffca50d1574
    Public key SHA-256 a08a1e7be2a7f6bbc5f59be8c77b6002c762ef93c3cb9b0581313edd58b42f69
    Addresses
    104.21.55.100 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.55.100, 172.67.147.116): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nfltrump.net
    Registered
    2026-10-11 · SGADDRESS PTE. LTD.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  22. ravenfundmere.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ravenfundmere.live
    First seen
    2026-11-05 22:01 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:58 UTC to 2027-02-03 21:55 UTC
    Logged 2026-11-05 21:58 UTC in DigiCert Sphinx2027h1, entry 371,902,349
    SHA-256 ea7074ac32a7846aae2e9181dfab0324ce4d3496c3ac895617bfd2313c8c966b
    Public key SHA-256 3d4d11b397923df3a7221250dbbaa61a02be32145a43121aef1148d7056a1bcf
    Addresses
    104.21.34.46 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.197.235 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.34.46, 172.67.197.235): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ravenfundmere.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  23. sales-papertrade.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 16 d ago
    DetailsHide
    Hostname
    sales-papertrade.xyz
    First seen
    2026-11-05 22:01 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-05 00:00 UTC to 2027-02-03 13:09 UTC
    Logged 2026-11-05 21:57 UTC in Let's Encrypt Sycamore2027h1, entry 967,337,754
    SHA-256 29c2b554c467336e665a09d1067845523bc44a9b544dd4a33dcb87007325be7d
    Public key SHA-256 5700e60bb522dc24c19cd3a5a2f8b0742d48076bcc44352ab29004cc40fb6b4c
    Addresses
    104.21.19.40 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.19.40, 172.67.184.246): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sales-papertrade.xyz
    Registered
    2026-10-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  24. seekreward.live US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    seekreward.live
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-05 00:00 UTC to 2027-02-03 13:34 UTC
    Logged 2026-11-05 21:58 UTC in HARICA Selene2027h1, entry 56,422,283
    SHA-256 1114b412b1366d979d6c256e446e47307820ed3f5e5f9ef745b973b5752e7b27
    Public key SHA-256 014582e23498f6ef5a8ec52ed9d3749f3fd6ceb2fc1ad5c3053a24268f8a74cb
    PhishDestroy
    Addresses
    104.21.87.119 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.143.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.87.119, 172.67.143.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    seekreward.live
    Registered
    2026-01-22 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  25. voyanx.com US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    voyanx.com
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-05 21:00 UTC to 2027-02-03 20:59 UTC
    Logged 2026-11-05 21:58 UTC in Google ParcelYard2027h1, entry 633,216,754
    SHA-256 962905c6c1b546299874d59aacd0cc676c36fe27da0a48b361a3ff3c4965ec34
    Public key SHA-256 0ad80038bc0fc7404aa592a0d3eaa51fba2377d479ec40f802952fa0bcc9a984
    PhishDestroy
    Addresses
    35.157.26.135 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    63.176.8.218 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (35.157.26.135, 63.176.8.218): a cloud provider. It rents servers and addresses to its customers.
    Domain
    voyanx.com
    Registered
    2025-10-12 · GoDaddy.com, LLC
    MX
    Receives mail at smtp.secureserver.net, mailstore1.secureserver.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  26. wqcmvuod.xlfsipbk.dglooolb.abyivmzxo.hbrcidmq.zkmbyjrs.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    wqcmvuod.xlfsipbk.dglooolb.abyivmzxo.hbrcidmq.zkmbyjrs.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-05 22:01 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-05 20:57 UTC to 2027-02-03 20:57 UTC
    Logged 2026-11-05 21:56 UTC in Google ParcelYard2027h1, entry 633,186,600
    SHA-256 4e0ff4af99d1555736cf17ea54ef2eaf9cbaecd9d88caa1ede1136e0c93be245
    Public key SHA-256 93dd2f5397aaabb1beb337c282ab944e8eafba582f786baf221dcc9b5b7ad317
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  27. wqytdieq.zmmhjqva.jfoequlrn.kcmwpdeu.onvgwjec.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    wqytdieq.zmmhjqva.jfoequlrn.kcmwpdeu.onvgwjec.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-05 22:01 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:57 UTC to 2027-02-03 20:57 UTC
    Logged 2026-11-05 21:56 UTC in DigiCert Wyvern2027h1, entry 421,202,944
    SHA-256 45fbba2c8346a9cf371395c16470d2bfa905127d559ba940a3db1d18642d1ca7
    Public key SHA-256 36e70e312e66806fc6e6e593bbe7b44a68e106d9437ecdbbd7e4fa9b2866993a
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  28. wrb6pjn1fb6ykrpc.onvgwjec.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    wrb6pjn1fb6ykrpc.onvgwjec.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-05 22:01 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:57 UTC to 2027-02-03 20:57 UTC
    Logged 2026-11-05 21:56 UTC in IPng Networks Halloumi2027h1, entry 379,267,041
    SHA-256 8e7c8ee4b9c33f45a079367d9497b45fe8eebcb679a0e0f70f6b14b22a0811ae
    Public key SHA-256 2870f841cc2e4e6295f2ff8ce8437c260421bd26d55452ef06f9735c3160f5f8
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  29. wricnejh.hykfgdax.kldxqguc.elqsmaiy.qikgwrfz.csarxeio.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    wricnejh.hykfgdax.kldxqguc.elqsmaiy.qikgwrfz.csarxeio.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-05 22:01 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-05 20:57 UTC to 2027-02-03 20:57 UTC
    Logged 2026-11-05 21:56 UTC in Let's Encrypt Willow2027h1, entry 957,843,148
    SHA-256 63f8309ce2af3cd35d8ce6ca9a33720961d9620971affa18df1570f8c4742d22
    Public key SHA-256 763e13ee2655ed09aeb9a7e8d29ec280a8f10bf7123cc46d2922f28c2aa9fff5
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  30. wriflcovs.qozykmrg.xiwokslb.wviyzmqf.tomjzfci.tczglrpw.www.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    wriflcovs.qozykmrg.xiwokslb.wviyzmqf.tomjzfci.tczglrpw.www.gatewaylearning.ezgateway.net
    First seen
    2026-11-05 22:01 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-05 20:57 UTC to 2027-02-03 20:57 UTC
    Logged 2026-11-05 21:56 UTC in DigiCert Sphinx2027h1, entry 371,880,572
    SHA-256 47e0ab6fcc06840823d059287ba0901a7dd3591feab4f63cf79ee444a8763bc8
    Public key SHA-256 d8f97b7bdfbaea9826be354c4c2de9a4123bebeebc2abc7c4d3d0964b1603c68
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  31. wrivhdln.bnjxekgo.ftdawxky.qikgwrfz.csarxeio.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    wrivhdln.bnjxekgo.ftdawxky.qikgwrfz.csarxeio.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-05 22:01 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:57 UTC to 2027-02-03 20:57 UTC
    Logged 2026-11-05 21:56 UTC in Let's Encrypt Sycamore2027h1, entry 967,326,295
    SHA-256 9e888a5d07918954d2f76e52e5af8d41c21a27e83d431509a9cd432476c02dcc
    Public key SHA-256 fa7ec860404a28f40c5ff53acf5c620408cdd4607a6e02934075dafb35685827
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  32. wrmubzaj.dtnrgbov.jurbzaqfs.uotyckrw.nofbagcj.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    wrmubzaj.dtnrgbov.jurbzaqfs.uotyckrw.nofbagcj.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-05 22:01 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:57 UTC to 2027-02-03 20:57 UTC
    Logged 2026-11-05 21:56 UTC in IPng Networks Gouda2027h1, entry 327,942,853
    SHA-256 504d03038145cb752b8defd86a30cd1185738c1e1d5763a21dd9854c94f2f581
    Public key SHA-256 04746e34207fdc4dd117ddbc0b9dd6d3671b8e6529a756c64f21c42284dc16d9
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  33. wthq.cloud US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    wthq.cloud
    First seen
    2026-11-05 22:01 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 13:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-05 21:46 UTC to 2027-02-03 21:54 UTC
    Logged 2026-11-05 21:56 UTC in DigiCert Sphinx2027h1, entry 371,879,219
    SHA-256 2cfdcf29eb256bde3741372c342edde8076832fe625630b479cb5dcecfe87fac
    Public key SHA-256 b4223fd8c89860012bc8be90a4a9a550819705212ac2fc81189a8d667965b6ad
    Addresses
    104.21.51.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.181.40 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.139, 172.67.181.40): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wthq.cloud
    Registered
    2026-03-23 · Alibaba Cloud Computing Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  34. www.apeaap.com.br BR · AS53107 · EVEO S.A.
    ReportedUnder apeaap.com.br, reported by PhishDestroyMX presentSPF -allDMARC quarantineRegistered 15 y ago
    DetailsHide
    Hostname
    www.apeaap.com.br
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing apeaap.com.br and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-05 20:58 UTC to 2027-02-03 20:58 UTC
    Logged 2026-11-05 21:57 UTC in Let's Encrypt Sycamore2027h1, entry 967,334,406
    SHA-256 00757623c0cc9e851c8e8b78e291b1e7feea8fe5e58989bc32550dcff8a2105c
    Public key SHA-256 4f1c7dfeb847cafaf1d862115b815b48dad3ef619ab446f282f601ec7b6720af
    PhishDestroy
    Addresses
    177.104.174.36 · Brazil · AS53107 AS53107 - EVEO S.A.
    Domain
    apeaap.com.br
    Registered
    2012-04-12
    MX
    Receives mail at apeaap.com.br
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  35. www.boost.acctplugins.com KE · AS329278 · Truehost Cloud Limited
    ReportedUnder acctplugins.com, reported by PhishDestroyMX presentSPF ~allDMARC quarantineRegistered 21 mo ago
    DetailsHide
    Hostname
    www.boost.acctplugins.com
    First seen
    2026-11-05 22:01 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing acctplugins.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-05 20:59 UTC to 2027-02-03 20:59 UTC
    Logged 2026-11-05 21:57 UTC in Google ParcelYard2027h1, entry 633,204,562
    SHA-256 1dc4f2859805cd4ab7c9b826675c10921345fb0ddccd57b03eabf5a03abef295
    Public key SHA-256 b53bd1709cbe9e3d68c6f294cf783521b524e554ff7b2f7a214bd93837e8ab4a
    PhishDestroy
    Addresses
    156.232.88.10 · Kenya · AS329278 Truehost Cloud Limited - Truehost Cloud Limited
    Domain
    acctplugins.com
    Registered
    2025-02-22 · TuringSign Inc. d/b/a Cosmotown
    MX
    Receives mail at acctplugins.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 06:50 UTC

    Suggest a correction

  36. ytydf.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    ytydf.com
    First seen
    2026-11-05 22:01 UTC
    Listing
    CERT Polska listed it 2026-08-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:56 UTC to 2027-02-03 21:54 UTC
    Logged 2026-11-05 21:56 UTC in DigiCert Wyvern2027h1, entry 421,201,598
    SHA-256 c94c26081e8e0bff6d968c56581e86e259fcad2a8aec8e0443ffddc7542943b5
    Public key SHA-256 c08bc3c08710e5c8901862938816e587553e1d7276c0da29f7b345d24341a9f5
    Addresses
    104.21.2.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.2.77, 172.67.128.229): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ytydf.com
    Registered
    2026-04-15 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  37. capgiraffewaste.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    capgiraffewaste.com
    First seen
    2026-11-05 21:56 UTC
    Listing
    USOM listed it 2026-06-08 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-05 21:43 UTC to 2027-02-03 21:51 UTC
    Logged 2026-11-05 21:53 UTC in DigiCert Wyvern2027h1, entry 421,170,895
    SHA-256 b510799006150ae6220d8b1a233c4b3305a0b3ca9b7f9df06f9848a953ad03a8
    Public key SHA-256 d91de45250310ad040b6e78b40b182f4037b844fad43ea2ccc7830bc2c316d16
    Addresses
    104.21.75.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.75.107, 172.67.221.89): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    capgiraffewaste.com
    Registered
    2026-06-04 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  38. claimsolanex-ai.site US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    claimsolanex-ai.site
    First seen
    2026-11-05 21:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:51 UTC to 2027-02-03 21:50 UTC
    Logged 2026-11-05 21:51 UTC in Geomys Tuscolo2027h1, entry 492,393,890
    SHA-256 329e6ace17c928b6394c29c330dc286f93dc62f4378f26359a159339d078b61e
    Public key SHA-256 59934321355378765a874097603bfbba9632fa29a01efa65c806a3b896fd7dc3
    PhishDestroy
    Addresses
    104.21.71.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.170.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.91, 172.67.170.78): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    claimsolanex-ai.site
    Registered
    2025-11-16 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  39. https-stashpatrick.gl US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    https-stashpatrick.gl
    First seen
    2026-11-05 21:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-05 20:55 UTC to 2027-02-03 20:55 UTC
    Logged 2026-11-05 21:53 UTC in IPng Networks Gouda2027h1, entry 327,919,167
    SHA-256 36e854a86dc9dc0d0243c12ed50c4b81d1a15408d2a27f456659625743d3bddb
    Public key SHA-256 6df839dc0857da45dd64d3fbb5e6453e0709dfe8147ff4d7290415ea57dfc568
    PhishDestroy
    Addresses
    104.21.69.160 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.69.160, 172.67.210.89): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    https-stashpatrick.gl
    MX
    Receives mail at _dc-mx.e3e461634c14.https-stashpatrick.gl
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:01 UTC

    Suggest a correction

  40. metabase.socialvisor.ru RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder socialvisor.ru, reported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    metabase.socialvisor.ru
    First seen
    2026-11-05 21:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing socialvisor.ru and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-05 20:55 UTC to 2027-02-03 20:55 UTC
    Logged 2026-11-05 21:54 UTC in Google ParcelYard2027h1, entry 633,158,575
    SHA-256 134d6d78f83eea34ed3041f83328ebd5d58a9b29f09c00c92948a22647ce5304
    Public key SHA-256 dcb397cb01723407dd29c4688b8df5648dd84fc7fbc10a05e6ff347d21f18075
    PhishDestroy
    Addresses
    91.215.41.91 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (91.215.41.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    socialvisor.ru
    MX
    Receives mail at emx.mail.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  41. onrefinance.support US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    onrefinance.support
    First seen
    2026-11-05 21:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-05 21:45 UTC to 2027-02-03 21:53 UTC
    Logged 2026-11-05 21:55 UTC in DigiCert Sphinx2027h1, entry 371,872,362
    SHA-256 ca14e43804844cd82ba7aa4e1d1245628d9c10187a81a4e31abe43d02134bed0
    Public key SHA-256 f2cbf1eaeaf16bbc00bf4443a3fe46b885c07c37034746577f50b16a290f418d
    Addresses
    104.21.62.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.223.14 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.107, 172.67.223.14): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    onrefinance.support
    Registered
    2026-08-16 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  42. webhook.socialvisor.ru RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder socialvisor.ru, reported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    webhook.socialvisor.ru
    First seen
    2026-11-05 21:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing socialvisor.ru and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-05 20:55 UTC to 2027-02-03 20:55 UTC
    Logged 2026-11-05 21:54 UTC in Google ParcelYard2027h1, entry 633,158,575
    SHA-256 134d6d78f83eea34ed3041f83328ebd5d58a9b29f09c00c92948a22647ce5304
    Public key SHA-256 dcb397cb01723407dd29c4688b8df5648dd84fc7fbc10a05e6ff347d21f18075
    PhishDestroy
    Addresses
    91.215.41.91 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (91.215.41.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    socialvisor.ru
    MX
    Receives mail at emx.mail.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  43. www.elastic.zenavlico.cyou TJ · AS208885 · NFS-AS Noyobzoda Faridduni …
    ListedUnder zenavlico.cyou, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    www.elastic.zenavlico.cyou
    First seen
    2026-11-05 21:56 UTC
    Listing
    CERT Polska listed it 2026-05-25 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska, listing zenavlico.cyou and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-11-05 00:00 UTC to 2027-02-03 23:59 UTC
    Logged 2026-11-05 21:51 UTC in IPng Networks Halloumi2027h1, entry 379,217,190
    SHA-256 22084bc8fd9e085ea1a204912333bfaebf7ad4309c8575097a8845f43b3f2a21
    Public key SHA-256 91dc26d62a79d4614dc6bce5e72fa766fb5654544c3c669050707e984469729c
    Addresses
    95.85.244.13 · Tajikistan · AS208885 NFS-AS Noyobzoda Faridduni Saidilhom
    Domain
    zenavlico.cyou
    Registered
    2026-01-26 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  44. www.https-stashpatrick.gl US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder https-stashpatrick.gl, reported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.https-stashpatrick.gl
    First seen
    2026-11-05 21:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing https-stashpatrick.gl and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-05 20:55 UTC to 2027-02-03 20:55 UTC
    Logged 2026-11-05 21:53 UTC in IPng Networks Gouda2027h1, entry 327,919,167
    SHA-256 36e854a86dc9dc0d0243c12ed50c4b81d1a15408d2a27f456659625743d3bddb
    Public key SHA-256 6df839dc0857da45dd64d3fbb5e6453e0709dfe8147ff4d7290415ea57dfc568
    PhishDestroy
    Addresses
    104.21.69.160 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.69.160, 172.67.210.89): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    https-stashpatrick.gl
    MX
    Receives mail at _dc-mx.e3e461634c14.https-stashpatrick.gl
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:01 UTC

    Suggest a correction

  45. yielldbasis.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    yielldbasis.com
    First seen
    2026-11-05 21:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-05 21:45 UTC to 2027-02-03 21:53 UTC
    Logged 2026-11-05 21:55 UTC in DigiCert Sphinx2027h1, entry 371,873,173
    SHA-256 9e456a0d947e9495a3294a411d272fd28e279aec2be5d79cec30c314bf3771a7
    Public key SHA-256 17409fd9a9ac83394912797452a59bba9bb9629f078983768c7305384fcf5143
    Addresses
    104.21.56.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.56.197, 172.67.187.216): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    yielldbasis.com
    Registered
    2025-11-29 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  46. chat.devnet-v2.lightchain.ai US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder lightchain.ai, reported by PhishDestroyMX presentSPF -allDMARC policy noneRegistered 24 mo ago
    DetailsHide
    Hostname
    chat.devnet-v2.lightchain.ai
    First seen
    2026-11-05 21:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing lightchain.ai and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-05 20:49 UTC to 2027-02-03 20:49 UTC
    Logged 2026-11-05 21:47 UTC in Geomys Tuscolo2027h1, entry 492,350,922
    SHA-256 505b4aacd6fd56edfc3702f87bf4ee86c3b47b0fb816b1600aabdad8aeed427e
    Public key SHA-256 2a58718280bacd8611bac92a88cc5713fa9d68c385c212613e2c28077222ceca
    PhishDestroy
    Addresses
    216.150.1.65 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.65 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.65, 216.150.16.65): a cloud provider. It rents servers and addresses to its customers.
    Domain
    lightchain.ai
    Registered
    2024-11-21 · Name.com, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 09:49 UTC

    Suggest a correction

  47. dsv.com.abakotest.com.ar DE · AS24940 · HETZNER-AS Hetzner Online G…
    ReportedHetznerReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    dsv.com.abakotest.com.ar
    First seen
    2026-11-05 21:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-05 20:50 UTC to 2027-02-03 20:50 UTC
    Logged 2026-11-05 21:48 UTC in Let's Encrypt Willow2027h1, entry 957,745,671
    SHA-256 88798b43724f1aa17a0040bd9749eb681fc73d3572570a344d4b87671b5a7c2a
    Public key SHA-256 5173165d865e12998ab415f9c831815e2d2a6354971a27cbabdf85448c62ab24
    PhishDestroy
    Addresses
    148.251.239.20 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (148.251.239.20): a cloud provider. It rents servers and addresses to its customers.
    Domain
    abakotest.com.ar
    Registered
    2011-07-10
    MX
    Receives mail at abakotest.com.ar
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  48. firelight-s2.network US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    firelight-s2.network
    First seen
    2026-11-05 21:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 20:48 UTC to 2027-02-03 20:48 UTC
    Logged 2026-11-05 21:47 UTC in Google ParcelYard2027h1, entry 633,082,522
    SHA-256 4922abf1b9036a377498a8d991c6ba5ca7a1118d13dba251c632d9718dc06a5e
    Public key SHA-256 9376cc71552b52296dba4a6296f5a246577456ff6db9a9675a0a24a821c892cc
    Addresses
    104.21.37.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.203.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.37.38, 172.67.203.184): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    firelight-s2.network
    Registered
    2026-05-12 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  49. proyectos.quillacollo.gob.bo BO · AS27839 · Comteco Ltda
    ListedUnder quillacollo.gob.bo, listed by CERT PolskaMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    proyectos.quillacollo.gob.bo
    First seen
    2026-11-05 21:51 UTC
    Listing
    CERT Polska listed it 2026-08-26 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska, listing quillacollo.gob.bo and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:50 UTC to 2027-02-03 20:50 UTC
    Logged 2026-11-05 21:49 UTC in IPng Networks Halloumi2027h1, entry 379,202,836
    SHA-256 a4d67599e13af137e8bc9968dee9467623516c34465a97b67e964f1f90b3bdac
    Public key SHA-256 fbdf3c3b799f2b812af48d3efb28a958f3d7f4f231979672bc870304d719eff0
    Addresses
    200.58.81.35 · Bolivia · AS27839 AS27839 - Comteco Ltda
    Domain
    quillacollo.gob.bo
    MX
    Receives mail at mail.quillacollo.gob.bo
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 14:38 UTC

    Suggest a correction

  50. twilight-routes.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    twilight-routes.com
    First seen
    2026-11-05 21:51 UTC
    Listing
    CERT Polska listed it 2026-05-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:47 UTC to 2027-02-03 21:45 UTC
    Logged 2026-11-05 21:47 UTC in Google ParcelYard2027h1, entry 633,082,769
    SHA-256 bb0787036551da5d507dc4432ffa93645f40340ca37c678551823abfea29124f
    Public key SHA-256 935f71aabf2c34ad51769a0717ccc951ebfb1b01c19a7fb3b8883e7ee22c9f17
    Addresses
    104.21.33.23 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.56 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.23, 172.67.140.56): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    twilight-routes.com
    Registered
    2025-12-04 · Porkbun LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  51. i-saglkrnd.cfd US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    i-saglkrnd.cfd
    First seen
    2026-11-05 21:48 UTC
    Listing
    USOM listed it 2026-11-05 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 14:04 UTC to 2027-02-03 14:04 UTC
    Logged 2026-11-05 15:03 UTC in DigiCert Wyvern2027h1, entry 417,265,722
    SHA-256 43890d5ccf0f6cb8a54c580ce928acd8587b8b255a36547d752c8b21e8a5c132
    Public key SHA-256 a922ab17c54d65e5291b73eb1a00f4b3c98cae1c4b13fbeb7c301f6e0b7ee45a
    Addresses
    104.21.20.208 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.194.105 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:c269
    2606:4700:3035::6815:14d0
    Cloudflare
    Cloudflare (104.21.20.208, 172.67.194.105): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    i-saglkrnd.cfd
    Registered
    2026-11-05 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  52. malisorgula.org AU · AS154653 · ParkLogic Pty Ltd
    ListedParking page · ParkLogicListed by USOMMX presentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    malisorgula.org
    First seen
    2026-11-05 21:48 UTC
    Listing
    USOM listed it 2026-11-05 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-05 19:10 UTC to 2027-02-03 19:10 UTC
    Logged 2026-11-05 20:09 UTC in IPng Networks Halloumi2027h1, entry 378,326,907
    SHA-256 39ecf569f427e5dad6043c8fb3c2fbdcf6ed89894557a5bd4951faff1ab6cec0
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates malisorgula.org to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    malisorgula.org
    Registered
    2025-11-05 · NameSilo, LLC
    MX
    Receives mail at mail.eye-mail.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  53. maliyetrsorgu.org AU · AS154653 · ParkLogic Pty Ltd
    ListedParking page · ParkLogicListed by USOMMX presentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    maliyetrsorgu.org
    First seen
    2026-11-05 21:48 UTC
    Listing
    USOM listed it 2026-11-05 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-05 19:18 UTC to 2027-02-03 19:18 UTC
    Logged 2026-11-05 20:16 UTC in IPng Networks Gouda2027h1, entry 327,260,255
    SHA-256 82f93e90b0d75d83d82265fe8e5b51255257d10ed2f9ac309d89fc494cf2e45b
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates maliyetrsorgu.org to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    maliyetrsorgu.org
    Registered
    2025-11-05 · NameSilo, LLC
    MX
    Receives mail at mail.eye-mail.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  54. mehasrn.duckdns.org SC · AS403005 · Blatant
    ListedListed by USOM
    DetailsHide
    Hostname
    mehasrn.duckdns.org
    First seen
    2026-11-05 21:48 UTC
    Listing
    USOM listed it 2026-11-05 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-05 12:18 UTC to 2027-02-03 12:18 UTC
    Logged 2026-11-05 13:16 UTC in Google ParcelYard2027h1, entry 626,397,279
    SHA-256 cda2c412cf7769ba566b234b0466526ed7997677bb3250234ff33f2b674743fa
    Public key SHA-256 74a31d6db17739561ef35d6e4bdee34ac9602bc701bb6245d24bc0477c749375
    Addresses
    64.89.160.238 · Seychelles · AS403005 BLATANTHOST - Blatant

    Suggest a correction

  55. novixtra.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    novixtra.com
    First seen
    2026-11-05 21:48 UTC
    Listing
    USOM listed it 2026-11-05 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 07:02 UTC to 2027-02-02 08:00 UTC
    Logged 2026-11-04 08:02 UTC in IPng Networks Halloumi2027h1, entry 358,843,339
    SHA-256 564bd187cc92098ce3487dc62e6eec9f21d6536612e07d1033194f7986149f53
    Public key SHA-256 1c4f02aeb23a0680e977e9672da90295e7a534ed6071e91f346ffad6f1d3dd28
    Addresses
    104.21.78.14 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.214.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3037::6815:4e0e
    2606:4700:3037::ac43:d670
    Cloudflare
    Cloudflare (104.21.78.14, 172.67.214.112): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    novixtra.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:50 UTC

    Suggest a correction

  56. s536hh7e95253434.opik.net US · AS214036 · ULTAHOST-AS Ultahost, Inc.
    ListedListed by USOM
    DetailsHide
    Hostname
    s536hh7e95253434.opik.net
    First seen
    2026-11-05 21:48 UTC
    Listing
    USOM listed it 2026-11-05 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-05 11:59 UTC to 2027-02-03 11:59 UTC
    Logged 2026-11-05 12:58 UTC in IPng Networks Halloumi2027h1, entry 374,277,363
    SHA-256 bd6f5427acd549a7914699a383c8a6bbd236697ccd047d01b079ee1b3e4afb94
    Public key SHA-256 3326b666c3371f87d49c7b7e83d08c93a841eb00d0ce67851d55b97403ce7b5c
    Addresses
    159.100.19.243 · United States · AS214036 ULTAHOST-AS Ultahost, Inc.

    Suggest a correction

  57. www.findmy.house 153.52.255.582 addressesApple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    www.findmy.house
    First seen
    2026-11-05 21:47 UTC
    First published
    2026-11-01 21:34 UTC
    DNS
    Resolves · checked 2026-11-05 21:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 153.52.255.58.
    1. Phishing-host list fetched with the address
    2. Resolved to 153.52.255.58
    Brand
    Apple
    Addresses
    153.52.255.58
    69.46.46.123 · United States · AS400940 RAILWAY - Railway
    Domain
    findmy.house
    Registered
    2025-07-10 · Squarespace Domains II LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  58. api-doc.alpha-aml.com US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder alpha-aml.com, reported by PhishDestroyMX presentSPF -allDMARC policy noneRegistered 22 mo ago
    DetailsHide
    Hostname
    api-doc.alpha-aml.com
    First seen
    2026-11-05 21:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing alpha-aml.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-05 20:46 UTC to 2027-02-03 20:46 UTC
    Logged 2026-11-05 21:44 UTC in Let's Encrypt Willow2027h1, entry 957,689,917
    SHA-256 33b28c76582ffba68dfe46cda1e9ba1f773acdceea0e21dd997f52dcc1dd946d
    Public key SHA-256 f8053dcf73018921c453fe2da4cd7825972078f434c6532a6309b776c0376e9a
    PhishDestroy
    Addresses
    216.150.1.129 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.129 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.129, 216.150.16.129): a cloud provider. It rents servers and addresses to its customers.
    Domain
    alpha-aml.com
    Registered
    2025-01-19 · GoDaddy.com, LLC
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:13 UTC

    Suggest a correction

  59. bastion.socialvisor.ru RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder socialvisor.ru, reported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    bastion.socialvisor.ru
    First seen
    2026-11-05 21:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy, listing socialvisor.ru and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-05 20:45 UTC to 2027-02-03 20:45 UTC
    Logged 2026-11-05 21:43 UTC in DigiCert Wyvern2027h1, entry 421,071,119
    SHA-256 8a0cf3262ab14b2d8ed6c248a0a39462670fd136ddd0e95d4c86ad0babbde3b7
    Public key SHA-256 e89b69417e180680ae64ef32d553b080f500a4e1a8bf773bbb825eb44213e599
    PhishDestroy
    Addresses
    91.215.41.91 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (91.215.41.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    socialvisor.ru
    MX
    Receives mail at emx.mail.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  60. betxner.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    betxner.com
    First seen
    2026-11-05 21:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:42 UTC to 2027-02-03 21:41 UTC
    Logged 2026-11-05 21:42 UTC in IPng Networks Halloumi2027h1, entry 379,143,052
    SHA-256 227097feb61e4a551a54ddf990eaef0beccb0cd0bbdb1368608bde759fa960c3
    Public key SHA-256 cfb3887b44d31a153bc2e6f19060fca9852fc15c3c5ef5887e1d8cd2b4bf1569
    Addresses
    104.21.90.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.90.197, 172.67.160.219): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    betxner.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:50 UTC

    Suggest a correction

  61. governance-valantis.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 26 d ago
    DetailsHide
    Hostname
    governance-valantis.xyz
    First seen
    2026-11-05 21:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-05 00:00 UTC to 2027-02-03 00:05 UTC
    Logged 2026-11-05 21:42 UTC in Geomys Trastevere2027h1, entry 30,856,550
    SHA-256 67565c964aed132b8d1cac53be2f3584e9fc085c0f80e09447c7dbbe8b290a1b
    Public key SHA-256 550b6a9d448ff35a1d3e9ad77fb20ee11977a4c9c0fb32d0e37d2d416001eebb
    Addresses
    104.21.68.176 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.197.135 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.176, 172.67.197.135): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    governance-valantis.xyz
    Registered
    2026-10-10 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  62. legacybitfundex-fi.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    legacybitfundex-fi.live
    First seen
    2026-11-05 21:46 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-05 20:40 UTC to 2027-02-03 21:38 UTC
    Logged 2026-11-05 21:44 UTC in Sectigo Statue2027h1, entry 67,342,022
    SHA-256 376f425cb304e6a7041b34beae98dcdc6df3ff84eab17e4b0b741f335e76546c
    Public key SHA-256 5e2067f13c1441b801222c3050543b07b47e3a4d2c767b7c99bc9ddec3a3715e
    Addresses
    104.21.20.70 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.20.70, 172.67.191.221): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    legacybitfundex-fi.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  63. rimpebomba.store
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 19 d ago
    DetailsHide
    Hostname
    rimpebomba.store
    First seen
    2026-11-05 21:46 UTC
    Listing
    CERT Polska listed it 2026-10-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-05 00:00 UTC to 2027-02-03 12:48 UTC
    Logged 2026-11-05 21:42 UTC in Google PlumbersArms2027h1, entry 633,409,739
    SHA-256 17e2b83b62f0bd5ac3e9a46a546d3bb6ff3a92e06a870e4b79962382e1fdacd4
    Public key SHA-256 00d7f818c675b505216257fdebb3c59253e0062c87811f202f90fbab16bf4336
    Domain
    rimpebomba.store
    Registered
    2026-10-17 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  64. secureservice-network.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC quarantine
    DetailsHide
    Hostname
    secureservice-network.com
    First seen
    2026-11-05 21:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:45 UTC to 2027-02-03 21:42 UTC
    Logged 2026-11-05 21:45 UTC in DigiCert Sphinx2027h1, entry 371,785,628
    SHA-256 e29858268ea16bddaaf5c1e6462ed3e61d4989b35c355bf015ad9a8b03ab5e29
    Public key SHA-256 7deed15749604ddeba32eefa46bb068260d470d2d2a8671e6a0644cb1a877b57
    Addresses
    104.21.79.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.79.229, 172.67.149.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    secureservice-network.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 21:50 UTC

    Suggest a correction

  65. skelvurizont-ro.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    skelvurizont-ro.live
    First seen
    2026-11-05 21:46 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-05 21:32 UTC to 2027-02-03 21:40 UTC
    Logged 2026-11-05 21:42 UTC in Let's Encrypt Sycamore2027h1, entry 967,132,916
    SHA-256 22100ef916f5fe56b4ee8de473554b30b4bec6ac245c20fa7540f9426bc3e244
    Public key SHA-256 c065b5c792bede716a255ac302b08e5aad90f631de90c46675e0b88205e5821c
    Addresses
    104.21.30.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.52 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.30.243, 172.67.174.52): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    skelvurizont-ro.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  66. skrovendiq-pt.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    skrovendiq-pt.live
    First seen
    2026-11-05 21:46 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:42 UTC to 2027-02-03 21:41 UTC
    Logged 2026-11-05 21:42 UTC in IPng Networks Halloumi2027h1, entry 379,143,302
    SHA-256 212aa8e1c5a1828a5b3fddf7fc2f5a84fc646a64ecb5ee0bb35d7e3e1d3f2929
    Public key SHA-256 992d5ef87bd8e863efab97d8a4394e3f7409f3f2935db0cd0ce636a23f972679
    Addresses
    104.21.88.99 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.88.99, 172.67.176.77): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    skrovendiq-pt.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  67. thunes.qwid.io US · AS13335 · Cloudflare, Inc.3 addresses
    ListedCloudflareUnder qwid.io, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    thunes.qwid.io
    First seen
    2026-11-05 21:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask, listing qwid.io and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-05 20:43 UTC to 2027-02-03 20:43 UTC
    Logged 2026-11-05 21:41 UTC in Google PlumbersArms2027h1, entry 633,403,808
    SHA-256 93271e00f6a4191b8d979f9b4e62cb0039600c6bff34da6f5eafe4ec0208291a
    Public key SHA-256 4f40c29586b31e75fe6c815bd9ab288b012a95e484cf55a3ea3a66e15b7a185b
    Addresses
    104.26.8.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.26.9.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.70.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.26.8.67, 104.26.9.67, 172.67.70.89): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qwid.io
    Registered
    2021-12-02 · NameCheap, Inc.
    MX
    Receives mail at mx1.privateemail.com, mx2.privateemail.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 19:27 UTC

    Suggest a correction

  68. www.qhzci.ezgateway.net US · AS13335 · Cloudflare, Inc.
    ListedCloudflareUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    www.qhzci.ezgateway.net
    First seen
    2026-11-05 21:46 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:47 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:41 UTC to 2027-02-03 21:41 UTC
    Logged 2026-11-05 21:41 UTC in Let's Encrypt Sycamore2027h1, entry 967,119,043
    SHA-256 3d4316c9ef6647c9860d346c01cbf4a5952347f7cbc9701fe9dfe0142486e55c
    Public key SHA-256 00c85b285dd6ffe78ccd82c6844a2df8f4c83cb005c9b97ed219db9a6b9fb6b2
    Addresses
    172.67.165.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.67.165.35): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  69. icloudonline.com NL · AS49981 · WorldStream WorldStream B.V.2 addressesApple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    icloudonline.com
    First seen
    2026-11-05 21:46 UTC
    First published
    2026-10-29 21:37 UTC
    DNS
    Resolves · checked 2026-11-05 21:46 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.82.67.195.
    1. Phishing-host list fetched with the address
    2. Resolved to 45.82.67.195
    Brand
    Apple
    Addresses
    45.82.67.195 · Netherlands · AS49981 WorldStream WorldStream B.V.
    199.193.114.103 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    Domain
    icloudonline.com
    Registered
    2017-07-10 · Internet Domain Service BS Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  70. degenxcity.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    degenxcity.com
    First seen
    2026-11-05 21:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-05 21:27 UTC to 2027-02-03 21:35 UTC
    Logged 2026-11-05 21:37 UTC in DigiCert Wyvern2027h1, entry 421,000,983
    SHA-256 6f3c99921978c20ecf590d71abe743bb045d1e872240f8d586ad9cc86608eec5
    Public key SHA-256 4d7b845c7d7f2d158cd5047d3e58be26108319df2ab261e8fd5e02bfccf50081
    PhishDestroy
    Addresses
    104.21.79.52 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.79.52, 172.67.142.97): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    degenxcity.com
    Registered
    2026-07-07 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Receives mail at route3.mx.cloudflare.net, route2.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:45 UTC

    Suggest a correction

  71. en-ledgrlive-desktop.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    en-ledgrlive-desktop.pages.dev
    First seen
    2026-11-05 21:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:39 UTC to 2027-02-03 21:38 UTC
    Logged 2026-11-05 21:39 UTC in Google PlumbersArms2027h1, entry 633,370,822
    SHA-256 4f67bc01550c42a7501712209025522356d421b0ab33b01d3561654a5122e7b6
    Public key SHA-256 4100858919be00ff5ed0dfb81678c7c283832713e90fa55ac2b24110104f2351
    Addresses
    172.66.44.190 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.190, 172.66.47.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  72. ethers.fi US · AS16509 · Amazon.com, Inc.2 addresses
    ListedParking page · AfternicListed by MetaMaskMX absentSPF -allDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    ethers.fi
    First seen
    2026-11-05 21:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-05 21:37 UTC to 2027-05-22 21:37 UTC
    Logged 2026-11-05 21:37 UTC in Google Argon2027h1, entry 882,559,620
    SHA-256 03b99a694d838c929a9d39ddc85eebb349a0f22114f56ca7accbbb92479482dd
    Public key SHA-256 606c9d41572b74af040f0f07b8b66432a3ec822656035461510a6ed0a6c261ce
    Addresses
    13.248.169.48 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    76.223.54.146 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    Parking page · Afternic
    The registry delegates ethers.fi to Afternic’s nameservers, which answer for it. Afternic (13.248.169.48, 76.223.54.146): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ethers.fi
    Registered
    2026-10-28
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  73. grymmon-coren94-de.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    grymmon-coren94-de.live
    First seen
    2026-11-05 21:41 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-05 20:36 UTC to 2027-02-03 21:35 UTC
    Logged 2026-11-05 21:37 UTC in DigiCert Wyvern2027h1, entry 421,005,331
    SHA-256 ad0cc17bca8d1aab8b942ef445b43228f96ebb949935b6c243126a37a6c4cdbe
    Public key SHA-256 11a96b25e67f3690536e53d2c6ddaf88c3e0d34c9e932d2c67b063b842f2f0ba
    Addresses
    104.21.59.176 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.5 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.59.176, 172.67.182.5): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    grymmon-coren94-de.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  74. labcobalt.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    labcobalt.net
    First seen
    2026-11-05 21:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:40 UTC to 2027-02-03 21:39 UTC
    Logged 2026-11-05 21:40 UTC in Google ParcelYard2027h1, entry 632,994,340
    SHA-256 3c496f639091837f32614a66dd139642a89cab91d86e11948e65dbc86c2d999f
    Public key SHA-256 f23bf159fb13327d91732e322ad1f85b5f734a14eaa377a2b86b5b13bceadea4
    PhishDestroy
    Addresses
    104.21.64.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.12 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.48, 172.67.176.12): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    labcobalt.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:45 UTC

    Suggest a correction

  75. modalwa.com US · AS14061 · DigitalOcean, LLC
    ReportedDigitalOceanReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    modalwa.com
    First seen
    2026-11-05 21:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:40 UTC to 2027-02-03 21:38 UTC
    Logged 2026-11-05 21:40 UTC in DigiCert Wyvern2027h1, entry 421,036,089
    SHA-256 297091000e48104f94ded641d64c2ff2e05a91db6517f24806da7344b9077426
    Public key SHA-256 2d130959faba8eaf15c4b2d1493d19b1b743da5c2497dca6a3cad5240443323c
    PhishDestroy
    Addresses
    139.59.118.85 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (139.59.118.85): a cloud provider. It rents servers and addresses to its customers.
    Domain
    modalwa.com
    Registered
    2026-01-01 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:45 UTC

    Suggest a correction

  76. pickshot.app US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    pickshot.app
    First seen
    2026-11-05 21:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:39 UTC to 2027-02-03 21:39 UTC
    Logged 2026-11-05 21:39 UTC in Let's Encrypt Sycamore2027h1, entry 967,095,359
    SHA-256 04ddabbe044e5cb0d2c6f1db4b6d8069d8f1ec866fce2bea81a15413177cdf75
    Public key SHA-256 2ba38fd30c80a59eb78c45554100247eb0c1a4790471676f5a21c065af393d94
    Addresses
    104.21.65.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.20 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.213, 172.67.167.20): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pickshot.app
    Registered
    2026-05-12 · CloudFlare, Inc.
    MX
    Receives mail at route2.mx.cloudflare.net, route3.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 20:11 UTC

    Suggest a correction

  77. posteslara.com FR · AS16276 · OVH OVH SAS
    ReportedOVHReported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    posteslara.com
    First seen
    2026-11-05 21:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:37 UTC to 2027-02-03 20:37 UTC
    Logged 2026-11-05 21:36 UTC in Geomys Tuscolo2027h1, entry 492,247,855
    SHA-256 bffa9014e9c4b06d989128ff71620036ed0e4e5f6cf674010502e3e02ca9c405
    Public key SHA-256 baae050b13a3b4cb2b9c320fbdf37344d0f0c47c68ed79305500dd57f117025b
    PhishDestroy
    Addresses
    40.160.16.184 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (40.160.16.184): a cloud provider. It rents servers and addresses to its customers.
    Domain
    posteslara.com
    MX
    Receives mail at posteslara.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 21:45 UTC

    Suggest a correction

  78. siknport.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    siknport.com
    First seen
    2026-11-05 21:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-05 21:29 UTC to 2027-02-03 21:38 UTC
    Logged 2026-11-05 21:39 UTC in DigiCert Sphinx2027h1, entry 371,725,216
    SHA-256 80864706c3b8370b950b8e6313d706c22e8d589487f0629164fd830cf1fc9706
    Public key SHA-256 47cf7a4e95cc6f06d2da14bac6abc7de20e3e0a670e809b4d02f043179a67730
    PhishDestroy
    Addresses
    104.21.16.181 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.215.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.181, 172.67.215.63): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    siknport.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:45 UTC

    Suggest a correction

  79. suportechat1.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishTankMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    suportechat1.com
    First seen
    2026-11-05 21:41 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 21:50 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-05 00:00 UTC to 2027-02-03 07:29 UTC
    Logged 2026-11-05 21:40 UTC in Let's Encrypt Willow2027h1, entry 957,628,070
    SHA-256 d777503b1c67f33b1f22886277ad49302bdd5cd8654105e434a05614307127dc
    Public key SHA-256 71231c3f517a54b6f6e1084c57faa908f52c78d1a58f41abe3bbe66e1767a1de
    PhishTank
    PhishTank report #9549256
    Addresses
    104.21.49.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.157, 172.67.191.48): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    suportechat1.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:45 UTC

    Suggest a correction

  80. typedai.app US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    typedai.app
    First seen
    2026-11-05 21:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:39 UTC to 2027-02-03 20:39 UTC
    Logged 2026-11-05 21:37 UTC in Geomys Tuscolo2027h1, entry 492,263,260
    SHA-256 79618c204ad3dc908917eb1564a45148a2ad89bcbdc43e284d88cefdc2d26472
    Public key SHA-256 376de6c181a476cea25feb7de83702f306108dd34895a927c8050f38c7d3b343
    Addresses
    104.21.21.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.21.50, 172.67.196.107): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    typedai.app
    Registered
    2026-03-13 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  81. trezor-suit-web.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Trezor
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-suit-web.wasmer.app
    First seen
    2026-11-05 21:37 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-05 20:32 UTC to 2027-02-03 20:32 UTC
    Logged 2026-11-05 21:30 UTC in DigiCert Sphinx2027h1, entry 371,653,531
    SHA-256 49a64270af6fd09e44dd5d630d370978e66d1eff10ad82bc628f0ec49021a213
    Public key SHA-256 6acc190da2cf1d64e37cef490ca81b3021557ed92b3a2f464138c0765b19c3fb
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  82. badge-firelight.finance US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    badge-firelight.finance
    First seen
    2026-11-05 21:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:35 UTC to 2027-02-03 21:33 UTC
    Logged 2026-11-05 21:35 UTC in IPng Networks Gouda2027h1, entry 327,766,919
    SHA-256 1a9da40d36f58c1dc1990ed7f137ec071c14c0907ff28420f435acd5041e6d24
    Public key SHA-256 4c580cf1794b4826fc8313c20f33c902eebc23c51ab3f9f32df3b9791670c902
    Addresses
    104.21.77.231 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.145 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.77.231, 172.67.212.145): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    badge-firelight.finance
    Registered
    2026-09-07 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  83. discover--en-ledgr.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    discover--en-ledgr.pages.dev
    First seen
    2026-11-05 21:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:33 UTC to 2027-02-03 21:31 UTC
    Logged 2026-11-05 21:33 UTC in Google ParcelYard2027h1, entry 632,907,434
    SHA-256 0f1a2abcccff702e83f0bc93597388d5593767c5bd691b2ddc09b5e96a6039df
    Public key SHA-256 b2b6393398fe8d6b0f3b58d5bc142c621f82ea04af3fbf3fc9459ee326565061
    Addresses
    172.66.44.95 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.161 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.95, 172.66.47.161): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  84. doc-ledger-uss.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    doc-ledger-uss.pages.dev
    First seen
    2026-11-05 21:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:35 UTC to 2027-02-03 21:33 UTC
    Logged 2026-11-05 21:35 UTC in Let's Encrypt Sycamore2027h1, entry 967,034,565
    SHA-256 41e9a6bfa08cb1caa342aea286fa28f6ded120947cbfec1680c575cd554d1aa0
    Public key SHA-256 b40ee75abb52112281fa9515e740e33de45a48b8d11aa72486b98af1a2e42c1c
    Addresses
    172.66.44.109 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.109, 172.66.47.147): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  85. docs.ni-electrical.com GB · AS201738 · UFO-TECHNOLOGIES-LIMITED UF…
    ListedUnder ni-electrical.com, listed by CERT PolskaMX absentSPF -allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    docs.ni-electrical.com
    First seen
    2026-11-05 21:36 UTC
    Listing
    CERT Polska listed it 2026-06-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    CERT Polska, listing ni-electrical.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:35 UTC to 2027-02-03 20:35 UTC
    Logged 2026-11-05 21:34 UTC in DigiCert Wyvern2027h1, entry 420,976,055
    SHA-256 449cd6a96c6355b3e4b9815618c5b9b307d09893e144c0e3e3172f84b272a661
    Public key SHA-256 a58947cc43eeaa61900ca4b02721a3c3d222a051d6056ce6baabb7da113a862f
    Addresses
    109.238.86.5 · United Kingdom · AS201738 UFO-TECHNOLOGIES-LIMITED UFO TECHNOLOGIES LIMITED
    Domain
    ni-electrical.com
    Registered
    2022-01-02 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 14:38 UTC

    Suggest a correction

  86. dynamo-pass.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    dynamo-pass.com
    First seen
    2026-11-05 21:36 UTC
    Listing
    CERT Polska listed it 2026-05-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:33 UTC to 2027-02-03 21:32 UTC
    Logged 2026-11-05 21:33 UTC in Google PlumbersArms2027h1, entry 633,300,268
    SHA-256 99045171c9ff0a9d133b2b1d9f59b0cadc30bb3f3a4adb7a8d73113c2bfcc1c8
    Public key SHA-256 17f480676af7537459daf158eb6322e7cf27b1f65be77c33b5363de560349102
    Addresses
    104.21.85.105 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.204.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.85.105, 172.67.204.157): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    dynamo-pass.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:40 UTC

    Suggest a correction

  87. feimust.com US · AS18978 · Enzu IncJCB
    ListedListed by JPCERT/CC as imitating JCBMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    feimust.com
    First seen
    2026-11-05 21:36 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 14:10 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:32 UTC to 2027-02-03 20:32 UTC
    Logged 2026-11-05 21:31 UTC in IPng Networks Halloumi2027h1, entry 379,043,565
    SHA-256 6207e94897a9f797b7a5fa1a7b71ec4aecd9e4804c00686d71a2104ab5d6f722
    Public key SHA-256 beb3b39cdb6781c9d4884e6a202418aecc5b3d08dad02dafa4187485d0bf839a
    Brand
    JCB
    Addresses
    107.163.230.234 · United States · AS18978 ENZUINC-US - Enzu Inc
    Domain
    feimust.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:40 UTC

    Suggest a correction

  88. fzdik.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    fzdik.asia
    First seen
    2026-11-05 21:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 13:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-05 20:35 UTC to 2027-02-03 20:35 UTC
    Logged 2026-11-05 21:34 UTC in Google ParcelYard2027h1, entry 632,914,027
    SHA-256 9df3d90bf0c4494e1da2c28058786eb52938fb24ed027d91ab4b07227f68d517
    Public key SHA-256 d69c043198e44c8c88f2b7ebae61e7a763d210d940f7478c2f8df85478fbbccd
    Addresses
    104.21.18.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.71 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.18.251, 172.67.184.71): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fzdik.asia
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:40 UTC

    Suggest a correction

  89. magicdroper.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    magicdroper.com
    First seen
    2026-11-05 21:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-26 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-05 00:00 UTC to 2027-02-03 12:37 UTC
    Logged 2026-11-05 21:33 UTC in HARICA Selene2027h1, entry 56,410,018
    SHA-256 0d6329f035288bf2f4d2977912e62b4cc8ec0780e8734c6a2428ac34933c49a8
    Public key SHA-256 b301af3a4bb9225c5ded0b2e9630ecd4b14127d7412ed334672671d6ea1d18e5
    PhishDestroy
    Addresses
    104.21.47.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.88, 172.67.145.253): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    magicdroper.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:40 UTC

    Suggest a correction

  90. neutron-claim.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    neutron-claim.com
    First seen
    2026-11-05 21:36 UTC
    Listing
    CERT Polska listed it 2026-05-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:34 UTC to 2027-02-03 21:31 UTC
    Logged 2026-11-05 21:34 UTC in Geomys Tuscolo2027h1, entry 492,228,040
    SHA-256 517cb269afb1a54109918a66fc77aca0511668b233065a129d099d8f58b21de8
    Public key SHA-256 0934c9e0df78ea5757df403fd7c17e46ccc6cda45f4ca46d2e4b9d1ccf830227
    Addresses
    104.21.67.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.231 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.67.132, 172.67.176.231): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    neutron-claim.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:40 UTC

    Suggest a correction

  91. nssmo.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    nssmo.com
    First seen
    2026-11-05 21:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 13:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:31 UTC to 2027-02-03 21:29 UTC
    Logged 2026-11-05 21:31 UTC in Let's Encrypt Sycamore2027h1, entry 966,977,771
    SHA-256 dfc9482b4c4f9bedbddab01e9cd2b8730a69b702376967117bcaf1ac7a1472a3
    Public key SHA-256 a5b97e69960aace75f88941e2b55eb86eabc14bd4d81b1f6bf71dff2de6a6991
    Addresses
    104.21.53.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.219.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.216, 172.67.219.39): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nssmo.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:40 UTC

    Suggest a correction

  92. openivaimmm.com AU · AS154653 · ParkLogic Pty Ltd
    ListedParking page · ParkLogicListed by NPA 165 (finance and insurance)MX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    openivaimmm.com
    First seen
    2026-11-05 21:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 13:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 20:33 UTC to 2027-02-03 20:33 UTC
    Logged 2026-11-05 21:31 UTC in Let's Encrypt Sycamore2027h1, entry 966,982,291
    SHA-256 6c17bbf7d5693c1ab09f1ccee2c0387fb5e2802197a7d8bfa7f909c74537319f
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates openivaimmm.com to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    openivaimmm.com
    MX
    Receives mail at mail.eye-mail.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:40 UTC

    Suggest a correction

  93. proposal-telcoin.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    proposal-telcoin.xyz
    First seen
    2026-11-05 21:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:34 UTC to 2027-02-03 21:33 UTC
    Logged 2026-11-05 21:34 UTC in Google ParcelYard2027h1, entry 632,924,145
    SHA-256 9f3ece1229413e6fb02a3c923fd37f87f4843afcb452a37643fd5d2605aeb2e9
    Public key SHA-256 5bdb63cd9817c6ea87051d06589b8aa43802b0fef901568c688f8bcde7e0c9c0
    Addresses
    104.21.4.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.4.88, 172.67.131.224): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    proposal-telcoin.xyz
    Registered
    2026-11-05 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  94. streamflow-dapp.site US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    streamflow-dapp.site
    First seen
    2026-11-05 21:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:31 UTC to 2027-02-03 21:29 UTC
    Logged 2026-11-05 21:31 UTC in IPng Networks Halloumi2027h1, entry 379,045,067
    SHA-256 26bfd326f971ca2afab743ca582ffb573e76994608a7cd652bb88c528b004ac8
    Public key SHA-256 0b8cae45aacfece63658c4dc00c166895ac372e9649de3079489ad37956cff73
    Addresses
    104.21.80.194 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.153.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.80.194, 172.67.153.78): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    streamflow-dapp.site
    Registered
    2026-09-07 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  95. uvikelront-de.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    uvikelront-de.live
    First seen
    2026-11-05 21:36 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:32 UTC to 2027-02-03 21:31 UTC
    Logged 2026-11-05 21:32 UTC in DigiCert Wyvern2027h1, entry 420,965,224
    SHA-256 5635d52e612c3c5b15c945fce6585ebc2612544bac1c3a2ed0c114932aacb8d9
    Public key SHA-256 d8139ba9b7fddcf944366049e21f8f4a6e78fb17147ae183706fa59bd529ad00
    Addresses
    104.21.90.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.153.166 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.90.64, 172.67.153.166): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    uvikelront-de.live
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:40 UTC

    Suggest a correction

  96. github-hd.deno.net US · AS15329 · DenoGitHub
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    github-hd.deno.net
    First seen
    2026-11-05 21:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.67.170.170.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 69.67.170.170
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-05 20:25 UTC to 2027-02-03 20:25 UTC
    Logged 2026-11-05 21:24 UTC in IPng Networks Gouda2027h1, entry 327,680,730
    SHA-256 1aa15c7f1cd7472014e112290ef43c26bf9994b632c777f6c8682a828e29b433
    Public key SHA-256 91b9abe7ba8af5b94319cf017083858da72bbe7fd78a59bcaefe98135af54086
    Brand
    GitHub
    Addresses
    69.67.170.170 · United States · AS15329 DENO - Deno

    Suggest a correction

  97. 897362-cb.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    897362-cb.com
    First seen
    2026-11-05 21:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:25 UTC to 2027-02-03 21:22 UTC
    Logged 2026-11-05 21:25 UTC in Google ParcelYard2027h1, entry 632,808,471
    SHA-256 fd536b7bdd6415e9d489a1b48220e694fd8830aa5c23b4c36a559ee38b47bc2f
    Public key SHA-256 afe9e0ad4cc0c23255973c6e5127d639c97a6a4fbba48b9273aec45861716882
    Addresses
    104.21.2.133 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.2.133, 172.67.129.63): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    897362-cb.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:35 UTC

    Suggest a correction

  98. airdrops-xrptundra.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    airdrops-xrptundra.com
    First seen
    2026-11-05 21:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 20:30 UTC to 2027-02-03 20:29 UTC
    Logged 2026-11-05 21:28 UTC in Google PlumbersArms2027h1, entry 633,235,485
    SHA-256 2ce7737c7266b6c049d5f729ac00749f5385f8162992cd36c91618b6b62cf5e0
    Public key SHA-256 a87a8a5b6e669fd2275684b2205ad4e69ad1d105e0beb01f0ccd1f265134bdcf
    PhishDestroy
    Addresses
    104.21.54.162 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.54.162, 172.67.140.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    airdrops-xrptundra.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:35 UTC

    Suggest a correction

  99. allocation-laptoptoken.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    allocation-laptoptoken.com
    First seen
    2026-11-05 21:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 17:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:27 UTC to 2027-02-03 21:25 UTC
    Logged 2026-11-05 21:27 UTC in Google ParcelYard2027h1, entry 632,828,152
    SHA-256 18b366a88a8cf389e84aaa7d92aea10a7136fc8b0a14b0d8896ef43ea4423815
    Public key SHA-256 2cc40bd014c5c5404080c9550498e1c40911ef4e9ee0cbf4925cf925d6405ff7
    Addresses
    104.21.13.19 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.232 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.13.19, 172.67.167.232): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    allocation-laptoptoken.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:35 UTC

    Suggest a correction

  100. legacybitfundex-sv.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    legacybitfundex-sv.live
    First seen
    2026-11-05 21:31 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 21:18 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 20:26 UTC to 2027-02-03 21:25 UTC
    Logged 2026-11-05 21:27 UTC in Google PlumbersArms2027h1, entry 633,214,319
    SHA-256 f6225e640805ae15f1cdb92f1986b36bf9624ad5b26d14a644844368848bc624
    Public key SHA-256 6c7ab9d4d81a44e9333f37fbba068265f7399263e17312f91fa03ce3444fa048
    Addresses
    104.21.84.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.84.48, 172.67.186.143): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    legacybitfundex-sv.live
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 21:35 UTC

    Suggest a correction

Showing 1–100 of 5,794 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources