Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-06 05:16 UTC
Certificate-log entries · 24 h
318.8M
from 84 distinct feeds
Unique certificates · 24 h
34.5M
each reviewed
Names resolved · 24 h
21.9M
16.1M with an address
Findings · 24 h
5,906
227 of 1,061 brands targeted

5,906 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. api.staging.max-ledger.live SG · AS63949 · Akamai Connected Cloud3 addresses
    ReportedAkamai LinodeParking page · ParkLogicUnder max-ledger.live, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    api.staging.max-ledger.live
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing max-ledger.live and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 04:12 UTC to 2027-02-04 04:12 UTC
    Logged 2026-11-06 05:10 UTC in Geomys Tuscolo2027h1, entry 496,318,908
    SHA-256 3b9cb470a1c473cb00bc1143d832d95af960bd9cbf5c47775f2b034ea6279c52
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    172.236.104.43 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.236.104.157 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.238.172.122 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.236.104.43, 172.236.104.157, 172.238.172.122): a cloud provider. It rents servers and addresses to its customers.
    Parking page · ParkLogic
    The registry delegates max-ledger.live to ParkLogic’s nameservers, which answer for it. ParkLogic: a parking service. It answers for names that are typically for sale or unused.
    Domain
    max-ledger.live
    Registered
    2025-10-13 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  2. captain.hashup.cc AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicUnder hashup.cc, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    captain.hashup.cc
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing hashup.cc and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 04:13 UTC to 2027-02-04 04:12 UTC
    Logged 2026-11-06 05:11 UTC in Let's Encrypt Sycamore2027h1, entry 972,676,128
    SHA-256 1b7929e9b2b7f767ca17e21ca0c2c4c0d3613432912d0632c2785dabcc7e2188
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.255 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates hashup.cc to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.255): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hashup.cc
    Registered
    2025-07-04 · NameCheap, Inc.
    MX
    Receives mail at mx156.hostedmxserver.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 14:22 UTC

    Suggest a correction

  3. com.policy.services.drive-icloud.com AU · AS154653 · ParkLogic Pty LtdApple
    ReportedParking page · ParkLogicUnder drive-icloud.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    com.policy.services.drive-icloud.com
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing drive-icloud.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-06 04:11 UTC to 2027-02-04 04:11 UTC
    Logged 2026-11-06 05:10 UTC in Geomys Tuscolo2027h1, entry 496,313,376
    SHA-256 15415c4f91496800abecc8242f3c592cfb6a8522ad7dd71ea6efa92727ea50e7
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Brand
    Apple
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates drive-icloud.com to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    drive-icloud.com
    Registered
    2025-09-30 · NameSilo, LLC
    MX
    Receives mail at mail.eye-mail.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  4. connectmodal-web3.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    connectmodal-web3.org
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:13 UTC to 2027-02-04 05:10 UTC
    Logged 2026-11-06 05:13 UTC in Google ParcelYard2027h1, entry 638,142,431
    SHA-256 a9727888b7db4df21498d29e4c2366b7ead90d0c137348d21b52408a62d80344
    Public key SHA-256 92960ed0fbf67b5e57d85d68df9cd930b5f0d80d39f593ce5b6d6a07c4429af9
    PhishDestroy
    Addresses
    104.21.72.133 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.33 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.72.133, 172.67.185.33): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    connectmodal-web3.org
    Registered
    2026-01-15 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  5. cpanel.business-su05webzoom.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under business-su05webzoom.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    cpanel.business-su05webzoom.com
    First seen
    2026-11-06 05:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing business-su05webzoom.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 04:14 UTC to 2027-02-04 04:14 UTC
    Logged 2026-11-06 05:12 UTC in DigiCert Sphinx2027h1, entry 375,355,773
    SHA-256 23465c3164daa772b0075033a2075d87d927c3ea68a5bb50e5bc7185d9a84da8
    Public key SHA-256 00996de6ba7bb5c7f5b52ec158b76fc17f95390f153bbf7a54f7afcdf5eb85e2
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    business-su05webzoom.com
    Registered
    2026-06-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 07:31 UTC

    Suggest a correction

  6. dapp-contract.top US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    dapp-contract.top
    First seen
    2026-11-06 05:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-06 04:11 UTC to 2027-02-04 04:11 UTC
    Logged 2026-11-06 05:10 UTC in DigiCert Wyvern2027h1, entry 425,035,805
    SHA-256 09118a5e2fd9908588da92ebad43b78f117ef8db34dbd338b55b0443114ee916
    Public key SHA-256 79db994cd8ffc29b6095dc0e1b9455daa4ad8f3cc75e4edab6573bf882e69217
    Addresses
    104.21.55.149 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.55.149, 172.67.149.39): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    dapp-contract.top
    Registered
    2026-03-14 · NameSilo,LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  7. dokploy.hashup.cc AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicUnder hashup.cc, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    dokploy.hashup.cc
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing hashup.cc and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-06 04:13 UTC to 2027-02-04 04:13 UTC
    Logged 2026-11-06 05:12 UTC in Google PlumbersArms2027h1, entry 638,516,324
    SHA-256 2be51e1e4100d4e6313d62814c6e691014f378f60b27f657ae57049ec4401964
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.255 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates hashup.cc to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.255): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hashup.cc
    Registered
    2025-07-04 · NameCheap, Inc.
    MX
    Receives mail at mx156.hostedmxserver.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 14:22 UTC

    Suggest a correction

  8. eobuwie.outlet-parfym.shop US · AS13335 · Cloudflare, Inc.2 addresseseobuwie
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    eobuwie.outlet-parfym.shop
    First seen
    2026-11-06 05:16 UTC
    Listing
    CERT Polska listed it 2026-09-08 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-06 04:12 UTC to 2027-02-04 05:11 UTC
    Logged 2026-11-06 05:12 UTC in DigiCert Sphinx2027h1, entry 375,355,388
    SHA-256 b669bb113b1a537bfc53fe22677e61c8ebae3e8470181fb671812cea10507c15
    Public key SHA-256 59b46f60a62c432f6efd73fc101b2c15ec8b3463f1e52380c211779adf916621
    Brand
    eobuwie
    Addresses
    104.21.20.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.20.66, 172.67.191.216): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    outlet-parfym.shop
    Registered
    2026-07-01 · GNAME.COM PTE. LTD.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  9. eqshf.online US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    eqshf.online
    First seen
    2026-11-06 05:16 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:11 UTC to 2027-02-04 05:10 UTC
    Logged 2026-11-06 05:11 UTC in Google PlumbersArms2027h1, entry 638,509,965
    SHA-256 451257a84a79f5f5e35285f368315708aeb93c6332c9571a6ed817f1652974d9
    Public key SHA-256 ec91d382b095666a5d0aa67fbbd4f0541df211ed44a71ef7c45f140a186e083b
    Addresses
    104.21.65.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.49, 172.67.140.168): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    eqshf.online
    Registered
    2025-11-15 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  10. exchanged.my CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ReportedHostingerReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    exchanged.my
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-06 04:16 UTC to 2027-02-04 04:16 UTC
    Logged 2026-11-06 05:15 UTC in Google PlumbersArms2027h1, entry 638,546,820
    SHA-256 32fd7efb08d50db2e8e95cc592120e388e507937b3331964dc9bf29bd867d838
    Public key SHA-256 6815ac809676163a88d5c5fc252fcc77539cfddf02797a15c2af1b0c537b5f12
    PhishDestroy
    Addresses
    194.163.45.50 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (194.163.45.50): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    exchanged.my
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  11. finansman-togg.com DE · AS47846 · SEDO-AS SEDO GmbH
    ListedParking page · SedoListed by USOMMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    finansman-togg.com
    First seen
    2026-11-06 05:16 UTC
    Listing
    USOM listed it 2026-08-07 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 05:19 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Encryption Everywhere DV TLS CA - G2 · precertificate
    Valid 2026-11-06 00:00 UTC to 2027-02-03 23:59 UTC
    Logged 2026-11-06 05:13 UTC in Let's Encrypt Willow2027h1, entry 963,044,740
    SHA-256 4595fde74db440d32574511134c7c87e84de9018a2515d6686e9764f0830822f
    Public key SHA-256 bd04f063081d91434b35eb2b6e635e7d902888d52c771fbe24bbb62dc73c861a
    Addresses
    91.195.240.94 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.94): a parking service. It answers for names that are typically for sale or unused.
    Domain
    finansman-togg.com
    Registered
    2026-08-06 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  12. home-us-e-xoss.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    home-us-e-xoss.pages.dev
    First seen
    2026-11-06 05:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:14 UTC to 2027-02-04 05:12 UTC
    Logged 2026-11-06 05:14 UTC in Let's Encrypt Willow2027h1, entry 963,053,420
    SHA-256 0878091bc0becb5beb83aa71419d6daf75709554023ba1a2bcb151800d231511
    Public key SHA-256 aa103b2a5d9fc5bb4859b8f08abd91a63e9410faa91922e4db4d8cd549852f0a
    Addresses
    172.66.44.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.109 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.147, 172.66.47.109): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  13. jetsobet.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    jetsobet.com
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:11 UTC to 2027-02-04 05:10 UTC
    Logged 2026-11-06 05:11 UTC in Let's Encrypt Willow2027h1, entry 963,025,550
    SHA-256 4971118c8bf0021a0df9e0d99a15869dda2fd2ebfa4a956da5e4e84bffb8f1e5
    Public key SHA-256 b7aba4517b3211ab18a3ce7a7ec1c79e74190abf96a5f6b27b9d53b6047b89bc
    PhishDestroy
    Addresses
    104.21.14.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.34 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.14.182, 172.67.160.34): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jetsobet.com
    Registered
    2025-12-22 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  14. kuveytumre.online US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    kuveytumre.online
    First seen
    2026-11-06 05:16 UTC
    Listing
    USOM listed it 2026-05-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 05:19 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-06 04:15 UTC to 2027-02-04 05:14 UTC
    Logged 2026-11-06 05:15 UTC in IPng Networks Gouda2027h1, entry 331,123,644
    SHA-256 e01229cc4668e11a5c9a5d6f99ba13fdf4e46e752072b6c3f38a680090bfac2a
    Public key SHA-256 9f49fa022d4ea8df1f2ad3a9759c489013d8608e31f0d246a192e28d74d215b0
    Addresses
    185.158.133.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (185.158.133.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kuveytumre.online
    Registered
    2026-05-12 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 12:06 UTC

    Suggest a correction

  15. migrate.linkvertise.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder linkvertise.com, reported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 12 y ago
    DetailsHide
    Hostname
    migrate.linkvertise.com
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing linkvertise.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:15 UTC to 2027-02-04 05:15 UTC
    Logged 2026-11-06 05:15 UTC in DigiCert Wyvern2027h1, entry 425,070,026
    SHA-256 4fceee76e47ea3e9a42d81a8cd138753629fe8ec22efb5bcf52fd514be6e563b
    Public key SHA-256 bb0045e95ab952ca73ee46bd2f9cbc841e47de29a4c2a9043115cac58f71ec48
    PhishDestroy
    Addresses
    104.18.0.75 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.18.1.75 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.0.75, 104.18.1.75): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    linkvertise.com
    Registered
    2015-03-22 · Cronon GmbH
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 14:38 UTC

    Suggest a correction

  16. old.ni-electrical.com GB · AS201738 · UFO-TECHNOLOGIES-LIMITED UF…
    ListedUnder ni-electrical.com, listed by CERT PolskaMX absentSPF -allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    old.ni-electrical.com
    First seen
    2026-11-06 05:16 UTC
    Listing
    CERT Polska listed it 2026-06-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    CERT Polska, listing ni-electrical.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-06 04:13 UTC to 2027-02-04 04:13 UTC
    Logged 2026-11-06 05:12 UTC in Google ParcelYard2027h1, entry 638,126,653
    SHA-256 256520595e6c4b6494abfd990184d5e70b8ed01920da75d4ca4a06fabde3cdb1
    Public key SHA-256 cf2fd7d288e4658ee98ce61b858e26f8e77a39d05e632ebcc77d273c7fbf545d
    Addresses
    109.238.86.5 · United Kingdom · AS201738 UFO-TECHNOLOGIES-LIMITED UFO TECHNOLOGIES LIMITED
    Domain
    ni-electrical.com
    Registered
    2022-01-02 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 14:38 UTC

    Suggest a correction

  17. rallyhollow.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    rallyhollow.com
    First seen
    2026-11-06 05:16 UTC
    Listing
    USOM listed it 2026-06-23 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 05:19 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 04:13 UTC to 2027-02-04 04:13 UTC
    Logged 2026-11-06 05:11 UTC in IPng Networks Halloumi2027h1, entry 382,884,909
    SHA-256 e5b893163d841a9451251855ce23840130e4c46e77d786871ff39e37fcd331e4
    Public key SHA-256 5d1722f0de2f638f642e477354f8d9f05706488011dda3be11049d4f545b7fa9
    Addresses
    104.21.72.230 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.155.169 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.72.230, 172.67.155.169): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rallyhollow.com
    Registered
    2026-03-14 · Metaregistrar BV
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  18. vip-rpc-bridge.slerf.tools US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder slerf.tools, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    vip-rpc-bridge.slerf.tools
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing slerf.tools and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-08 03:19 UTC to 2026-12-07 04:18 UTC
    Logged 2026-11-06 05:13 UTC in Let's Encrypt Sycamore2026h2, entry 1,068,039,168
    SHA-256 445377720a546c59d99917cfa8abbeace1c1006961ad277529a943c3d8433550
    Public key SHA-256 5a76cf1120bfdfb8ba6975984f2929dd669eb8b53b85ad9a08b674f8b6d9abc1
    PhishDestroy
    Addresses
    104.20.36.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.151.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.20.36.108, 172.66.151.250): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    slerf.tools
    Registered
    2024-03-24 · Cloudflare, Inc
    MX
    Receives mail at mx1.privateemail.com, mx2.privateemail.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  19. www.exchanged.my CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ReportedHostingerUnder exchanged.my, reported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.exchanged.my
    First seen
    2026-11-06 05:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing exchanged.my and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-06 04:16 UTC to 2027-02-04 04:16 UTC
    Logged 2026-11-06 05:15 UTC in Google PlumbersArms2027h1, entry 638,546,820
    SHA-256 32fd7efb08d50db2e8e95cc592120e388e507937b3331964dc9bf29bd867d838
    Public key SHA-256 6815ac809676163a88d5c5fc252fcc77539cfddf02797a15c2af1b0c537b5f12
    PhishDestroy
    Addresses
    194.163.45.50 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (194.163.45.50): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    exchanged.my
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  20. xrpl-distribution.live US · AS13335 · Cloudflare, Inc.2 addressesRipple (XRP)
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    xrpl-distribution.live
    First seen
    2026-11-06 05:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:12 UTC to 2027-02-04 05:11 UTC
    Logged 2026-11-06 05:12 UTC in IPng Networks Halloumi2027h1, entry 382,888,601
    SHA-256 db97801fa0655bae6f11959d2d1c4060551f2b611092f9058e3694733f3b1d58
    Public key SHA-256 f9ba35ea21cd4c8322c02ffb0e65c93f1717fef7d23b5db28f3d287456687ba2
    Brand
    Ripple (XRP)
    Addresses
    104.21.94.230 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.141.75 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.94.230, 172.67.141.75): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xrpl-distribution.live
    Registered
    2026-07-10 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  21. reklamy-w-google.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Google
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 6 y ago
    DetailsHide
    Hostname
    reklamy-w-google.pl
    First seen
    2026-11-06 05:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    Certificate
    Issued by YR2
    Valid 2026-11-06 04:09 UTC to 2027-02-04 04:09 UTC
    Logged 2026-11-06 05:08 UTC in Geomys Tuscolo2027h1, entry 496,293,553
    SHA-256 8ba2127d122102837ae7138df0e9d14dbad692cd69ea4bea4e680e4afe050259
    Public key SHA-256 2cc302b3bb6873811e388286baaaa79978ee242040942d1cf546b05da8f5d906
    Brand
    Google
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    reklamy-w-google.pl
    Registered
    2021-01-22 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  22. bonusgame-revo.win US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    bonusgame-revo.win
    First seen
    2026-11-06 05:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 04:08 UTC to 2027-02-04 04:08 UTC
    Logged 2026-11-06 05:07 UTC in IPng Networks Halloumi2027h1, entry 382,846,831
    SHA-256 4f3b75df24a4872d27c0d38959c6eb1f39c6a66bd18dad5c9434bc81512561f1
    Public key SHA-256 369fa0579aa5c58e93dec5672058359965894c5936898b1d7ea23019fedd1439
    PhishDestroy
    Addresses
    104.21.87.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.21 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.87.30, 172.67.140.21): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bonusgame-revo.win
    Registered
    2026-05-12 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  23. lekkirendovik.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    lekkirendovik.live
    First seen
    2026-11-06 05:10 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:06 UTC to 2027-02-04 05:05 UTC
    Logged 2026-11-06 05:06 UTC in Let's Encrypt Sycamore2027h1, entry 972,613,030
    SHA-256 599a549031d7367ecdd997f5194bb2df0f6f74cd8d28c1f07d6e20d74b311ab3
    Public key SHA-256 fc5c863c16bbd20f86817aa717c16a65cf105642f7642e35c6c396219d5b96b4
    Addresses
    104.21.37.162 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.37.162, 172.67.210.117): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lekkirendovik.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  24. pay.notepad-plus-plus-mac.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder notepad-plus-plus-mac.org, listed by MetaMaskMX absentSPF missingDMARC quarantineRegistered 8 mo ago
    DetailsHide
    Hostname
    pay.notepad-plus-plus-mac.org
    First seen
    2026-11-06 05:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing notepad-plus-plus-mac.org and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-06 05:10 UTC to 2027-05-23 05:10 UTC
    Logged 2026-11-06 05:10 UTC in GoDaddy Aquamarine2027h1, entry 186,564,151
    SHA-256 47b3b174bccd46b275f35cb1553b1ab40235fbdfe273bc496ba75658b9f937b7
    Public key SHA-256 e828250de0b24594e6ce291353df55059687175e6597c051aea9ca96452076fb
    Addresses
    104.21.85.61 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.203.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.85.61, 172.67.203.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    notepad-plus-plus-mac.org
    Registered
    2026-03-22 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 08:02 UTC

    Suggest a correction

  25. slcko.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    slcko.shop
    First seen
    2026-11-06 05:10 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:07 UTC to 2027-02-04 05:05 UTC
    Logged 2026-11-06 05:07 UTC in Google ParcelYard2027h1, entry 638,062,359
    SHA-256 a40a290f59d35ba62c343df00622532b2f3e00f4e46a5052fd3971f19e71eb71
    Public key SHA-256 f29151c4dc8bd8d34d14d2f82c6fd5a537c9ff54e9d84f6a868aa4198cf0c04a
    Addresses
    104.21.57.73 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.171 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.57.73, 172.67.189.171): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    slcko.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:13 UTC

    Suggest a correction

  26. www.jefarmingschoolinc.org US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesUnder jefarmingschoolinc.org, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    www.jefarmingschoolinc.org
    First seen
    2026-11-06 05:10 UTC
    Listing
    CERT Polska listed it 2026-10-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska, listing jefarmingschoolinc.org and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-06 05:09 UTC to 2027-05-23 05:09 UTC
    Logged 2026-11-06 05:10 UTC in GoDaddy Aquamarine2027h1, entry 186,563,791
    SHA-256 9e95be29e4722344142806be4fff2182a470dcd72137eb5dbbb9141c5b426e07
    Public key SHA-256 fc030179e54db8301dc33acda225e6cb6e19994649086ab61fe908376523b2d4
    Addresses
    15.197.172.60 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (15.197.172.60): a cloud provider. It rents servers and addresses to its customers.
    Domain
    jefarmingschoolinc.org
    Registered
    2025-11-04 · eNom, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  27. www.pay.notepad-plus-plus-mac.org
    ListedUnder notepad-plus-plus-mac.org, listed by MetaMaskMX absentSPF missingDMARC quarantineRegistered 8 mo ago
    DetailsHide
    Hostname
    www.pay.notepad-plus-plus-mac.org
    First seen
    2026-11-06 05:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing notepad-plus-plus-mac.org and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-06 05:10 UTC to 2027-05-23 05:10 UTC
    Logged 2026-11-06 05:10 UTC in GoDaddy Aquamarine2027h1, entry 186,564,151
    SHA-256 47b3b174bccd46b275f35cb1553b1ab40235fbdfe273bc496ba75658b9f937b7
    Public key SHA-256 e828250de0b24594e6ce291353df55059687175e6597c051aea9ca96452076fb
    Domain
    notepad-plus-plus-mac.org
    Registered
    2026-03-22 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 08:02 UTC

    Suggest a correction

  28. xinhezuo.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    xinhezuo.shop
    First seen
    2026-11-06 05:10 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:06 UTC to 2027-02-04 05:04 UTC
    Logged 2026-11-06 05:06 UTC in Let's Encrypt Sycamore2027h1, entry 972,613,229
    SHA-256 d1c8a86739697fb30af6d2a0a5f57ffb4531ab14ba687ddbb48563a95168d0b1
    Public key SHA-256 658d7090ac90b85e580a2e414a79ff5143194509915ec5c644459bb9728ed78c
    Addresses
    104.21.42.79 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.42.79, 172.67.159.63): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xinhezuo.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:13 UTC

    Suggest a correction

  29. info.myprotondrive.com FR · AS16276 · OVH OVH SASProton
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 21 mo ago
    DetailsHide
    Hostname
    info.myprotondrive.com
    First seen
    2026-11-06 05:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.255.139.193.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.255.139.193
    Certificate
    Issued by YR2
    Valid 2026-11-06 04:06 UTC to 2027-02-04 04:06 UTC
    Logged 2026-11-06 05:04 UTC in Google PlumbersArms2027h1, entry 638,417,330
    SHA-256 d3572c6b5c6336b32b5b4232d186140686936efd817d4dffd59b91bcb3019540
    Public key SHA-256 61b5adae85cf6d439e8a7ede7cf3c2653938b3b76b30405ff53fa1c3e3f0a9f6
    Brand
    Proton
    Addresses
    51.255.139.193 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.255.139.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    myprotondrive.com
    Registered
    2025-02-20 · Internet Domain Service BS Corp
    MX
    Receives mail at mail.myprotondrive.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  30. blaskfinthra.pl US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    blaskfinthra.pl
    First seen
    2026-11-06 05:05 UTC
    Listing
    CERT Polska listed it 2026-08-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 04:03 UTC to 2027-02-04 04:03 UTC
    Logged 2026-11-06 05:02 UTC in Google ParcelYard2027h1, entry 637,998,772
    SHA-256 6a15d313c3dc9ac38e781467cf00b72da33684fd99090ce50c65a8fa53d217db
    Public key SHA-256 a5968b17755e9a69506de204bbc2060c229eabbb88128dab9f99220ec1cc8692
    Addresses
    104.21.12.53 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.174 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.12.53, 172.67.193.174): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    blaskfinthra.pl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:08 UTC

    Suggest a correction

  31. gdyhq.website US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    gdyhq.website
    First seen
    2026-11-06 05:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 04:06 UTC to 2027-02-04 04:06 UTC
    Logged 2026-11-06 05:05 UTC in Google PlumbersArms2027h1, entry 638,421,641
    SHA-256 4e039ee5cad3375562b579f5b27796274c74e28e430496e4ba9b4142b783b592
    Public key SHA-256 91fbe165c22ea4b457274650d107724152e498ed2e39d935d897c1c7fd127057
    Addresses
    104.21.40.18 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.40.18, 172.67.174.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gdyhq.website
    Registered
    2026-03-15 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  32. guhdfsna.site US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    guhdfsna.site
    First seen
    2026-11-06 05:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-08 03:43 UTC to 2026-12-07 04:41 UTC
    Logged 2026-11-06 05:01 UTC in Let's Encrypt Willow2026h2, entry 1,024,951,019
    SHA-256 b2068d4639ad29f2408a7726455da849b05ffc59a7cbd8efcca76da75483648e
    Public key SHA-256 a5f73a2d63d98149872c3e12a45278b6b088df7dad9c449e10139650b0fe0fed
    Addresses
    104.21.16.5 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.162 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.5, 172.67.165.162): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    guhdfsna.site
    Registered
    2026-09-08 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  33. login.webonlinemicrosoftpdf.sbs US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder webonlinemicrosoftpdf.sbs, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    login.webonlinemicrosoftpdf.sbs
    First seen
    2026-11-06 05:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing webonlinemicrosoftpdf.sbs and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-18 08:41 UTC to 2026-12-17 09:41 UTC
    Logged 2026-11-06 04:59 UTC in TrustAsia log2026a, entry 3,023,011,807
    SHA-256 a17a714fc64eb4c48eb1ead52a451d1e82582db3cc9bad93852278a0e3395145
    Public key SHA-256 617085320811dd0e93640f44871596ec7556997c874575b4087ac0d9bd834fcb
    Addresses
    104.21.61.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:d927
    2606:4700:3035::6815:3df4
    Cloudflare
    Cloudflare (104.21.61.244, 172.67.217.39): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    webonlinemicrosoftpdf.sbs
    Registered
    2026-09-07 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  34. radiance-ash.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    radiance-ash.com
    First seen
    2026-11-06 05:05 UTC
    Listing
    CERT Polska listed it 2026-05-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:00 UTC to 2027-02-04 04:57 UTC
    Logged 2026-11-06 05:00 UTC in Google PlumbersArms2027h1, entry 638,360,152
    SHA-256 4c1428c3bdce566c070372ff81b4d50df07b88e035def28c7e9db1950e1733b5
    Public key SHA-256 468d5b9cf5fedba31e93f3627015bf2625a2683cee4f9ec917846354ee491cf1
    Addresses
    104.21.35.75 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.215.222 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.75, 172.67.215.222): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    radiance-ash.com
    Registered
    2025-12-04 · Porkbun LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  35. rugmark.app US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    rugmark.app
    First seen
    2026-11-06 05:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:03 UTC to 2027-02-04 05:01 UTC
    Logged 2026-11-06 05:03 UTC in Let's Encrypt Sycamore2027h1, entry 972,554,300
    SHA-256 6efac7a5a0fddc705c51194c1002c1826be93c3e81c8b7ee7d6db2200777579b
    Public key SHA-256 eb478a7d857da1681633769c007d1fb91173134e6d795cb5c3492b36bd1d9380
    PhishDestroy
    Addresses
    104.21.23.194 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.23.194, 172.67.212.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rugmark.app
    Registered
    2025-11-15 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  36. shadowswap.fun US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesReported by PhishDestroyMX absentSPF missingDMARC quarantineRegistered 12 mo ago
    DetailsHide
    Hostname
    shadowswap.fun
    First seen
    2026-11-06 05:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-06 05:00 UTC to 2027-05-23 05:00 UTC
    Logged 2026-11-06 05:00 UTC in Google Argon2027h1, entry 887,798,311
    SHA-256 dccaf2fbc2d91e41e562483fa998c25fba32c0511ad1174a76047a83f75c7e8e
    Public key SHA-256 902597bc3cf370d8bed029bd32a8910569fc65c0daf2ca04fd2e6df9f2b5eefe
    PhishDestroy
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    shadowswap.fun
    Registered
    2025-10-31 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  37. stoneshopping.shop
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    stoneshopping.shop
    First seen
    2026-11-06 05:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:00 UTC to 2027-02-04 04:59 UTC
    Logged 2026-11-06 05:00 UTC in Geomys Tuscolo2027h1, entry 496,220,219
    SHA-256 236a2fbf55e671e32211da2ac02d5f4c1a27c6fcd1c79a2041e56e255fcf1e11
    Public key SHA-256 02e00cd648ed85e1060a4e1dfe71493e27eacc797ddfce0862e531f2d215799a
    Domain
    stoneshopping.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:08 UTC

    Suggest a correction

  38. sunkunshopping.shop
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    sunkunshopping.shop
    First seen
    2026-11-06 05:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 04:00 UTC to 2027-02-04 04:59 UTC
    Logged 2026-11-06 05:01 UTC in Let's Encrypt Sycamore2027h1, entry 972,511,978
    SHA-256 5c1f46a24d71e30c82607f39b9c5a458d76e13812b273d034019cf2b3936dbdf
    Public key SHA-256 610684e04688306dd8c57517f222d5fd0d73c8574b61b53822ff000fb4700819
    Domain
    sunkunshopping.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:08 UTC

    Suggest a correction

  39. vote-firelight.co US · AS13335 · Cloudflare, Inc.2 addressesFirelight
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    vote-firelight.co
    First seen
    2026-11-06 05:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 04:05 UTC to 2027-02-04 04:05 UTC
    Logged 2026-11-06 05:03 UTC in Let's Encrypt Sycamore2027h1, entry 972,559,915
    SHA-256 62f0296593da7630a9af281d805e0f613f7801a1df59eeaa6186e2ff5518c6f5
    Public key SHA-256 49434f9f8e560c0ecd52add17d59d13ef6747046786a59c603e97cfc5cb4d45a
    Brand
    Firelight
    Addresses
    104.21.10.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.162.196 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.94, 172.67.162.196): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vote-firelight.co
    Registered
    2026-05-12 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  40. www.heritage-ledger.com US · AS53831 · Squarespace, Inc.4 addresses
    ListedSquarespaceUnder heritage-ledger.com, listed by MetaMaskMX presentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.heritage-ledger.com
    First seen
    2026-11-06 05:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing heritage-ledger.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-06 04:02 UTC to 2027-02-04 04:02 UTC
    Logged 2026-11-06 05:01 UTC in Let's Encrypt Sycamore2027h1, entry 972,519,097
    SHA-256 3f3f3c1335131cc7b8bf8f2508125b67f3e669f7968f4c36144073fe4c484af8
    Public key SHA-256 071ea895600cbaef3371dab29d5bee70e59ad8eaeea5ee32e1e879891d885ba3
    Addresses
    198.49.23.144 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.49.23.145 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.185.159.144 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.185.159.145 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    Squarespace
    Squarespace (198.49.23.144, 198.49.23.145, 198.185.159.144, 198.185.159.145): a site builder. It hosts pages for anyone who signs up.
    Domain
    heritage-ledger.com
    Registered
    2026-05-14 · Squarespace Domains LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 12:07 UTC

    Suggest a correction

  41. epicgameshelp.com NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addressesEpic Games
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    epicgameshelp.com
    First seen
    2026-11-06 05:02 UTC
    DNS
    Resolves · checked 2026-11-06 05:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 213.227.156.75.
    1. Phishing-host list fetched with the address
    2. Resolved to 213.227.156.75
    Brand
    Epic Games
    Addresses
    213.227.156.75 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    199.193.114.43 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    Domain
    epicgameshelp.com
    Registered
    2018-03-19 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

  42. samsung-compressors.com US · AS40244 · Turnkey Internet Inc.2 addressesSamsung
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    samsung-compressors.com
    First seen
    2026-11-06 05:02 UTC
    DNS
    Resolves · checked 2026-11-06 05:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 199.193.114.46.
    1. Phishing-host list fetched with the address
    2. Resolved to 199.193.114.46
    Brand
    Samsung
    Addresses
    199.193.114.46 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    199.193.114.45 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    Domain
    samsung-compressors.com
    Registered
    2018-10-29 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

  43. amiblocks.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ReportedHostingerReported by PhishDestroyMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    amiblocks.com
    First seen
    2026-11-06 05:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 04:00 UTC to 2027-02-04 04:00 UTC
    Logged 2026-11-06 04:58 UTC in IPng Networks Halloumi2027h1, entry 382,773,827
    SHA-256 52d46b51010ca126a7d6a541267c3895859ccc06e835d40616e0d44d2b2ad190
    Public key SHA-256 651b663359914cfce21c792848b609af452ee351f0e050056b36049b2a9fdaba
    PhishDestroy
    Addresses
    157.173.208.188 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    2a02:4780:2b:1638:0:290f:5417:2
    Hostinger
    Hostinger (157.173.208.188): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    amiblocks.com
    MX
    Receives mail at smtp.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:02 UTC

    Suggest a correction

  44. portal-claudersfun.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    portal-claudersfun.xyz
    First seen
    2026-11-06 05:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-06 04:00 UTC to 2027-02-04 04:00 UTC
    Logged 2026-11-06 04:58 UTC in Google PlumbersArms2027h1, entry 638,341,936
    SHA-256 47c86007801db9474e2d9a2d0352d14a722bd255b44fc5197d69047e1e1c03f6
    Public key SHA-256 9e060f1abc210e7955af881a04c72ef1c94e06bf64a91d145dc4d51c66a65aca
    Addresses
    104.21.29.52 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.171.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.29.52, 172.67.171.94): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    portal-claudersfun.xyz
    Registered
    2026-05-12 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  45. solv-allocations.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    solv-allocations.xyz
    First seen
    2026-11-06 05:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 04:01 UTC to 2027-02-04 04:01 UTC
    Logged 2026-11-06 04:59 UTC in Geomys Tuscolo2027h1, entry 496,211,528
    SHA-256 4231d7916126084af6a535675e33613d059c363b2f91bc95e8c043b79dec8233
    Public key SHA-256 4a4b5f4034dccbbfeea4de57721d382b141c3569085acefe2c58e576bf37ee73
    Addresses
    104.21.70.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.70.237, 172.67.140.122): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    solv-allocations.xyz
    Registered
    2026-05-12 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  46. webonlinemicrosoftpdf.sbs US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    webonlinemicrosoftpdf.sbs
    First seen
    2026-11-06 05:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:59 UTC to 2027-02-04 04:58 UTC
    Logged 2026-11-06 04:59 UTC in DigiCert Wyvern2027h1, entry 424,935,818
    SHA-256 0895a7d7cac3fb6c6716847ede2e61baece4214f94b8b60bfdc7770803e8154b
    Public key SHA-256 3195387eafdd965017de0502182b8584250d88de4ea1fdf882f0d88d32b1f963
    Addresses
    104.21.61.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:d927
    2606:4700:3035::6815:3df4
    Cloudflare
    Cloudflare (104.21.61.244, 172.67.217.39): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    webonlinemicrosoftpdf.sbs
    Registered
    2026-09-07 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  47. www.amiblocks.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ReportedHostingerReported by PhishDestroyMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.amiblocks.com
    First seen
    2026-11-06 05:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 04:00 UTC to 2027-02-04 04:00 UTC
    Logged 2026-11-06 04:58 UTC in IPng Networks Halloumi2027h1, entry 382,773,827
    SHA-256 52d46b51010ca126a7d6a541267c3895859ccc06e835d40616e0d44d2b2ad190
    Public key SHA-256 651b663359914cfce21c792848b609af452ee351f0e050056b36049b2a9fdaba
    PhishDestroy
    Addresses
    157.173.208.188 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    2a02:4780:2b:1638:0:290f:5417:2
    Hostinger
    Hostinger (157.173.208.188): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    amiblocks.com
    MX
    Receives mail at smtp.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:02 UTC

    Suggest a correction

  48. www.netbox.crypto-polis.org RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD2 addresses
    ReportedDDoS-GuardUnder crypto-polis.org, reported by PhishDestroyMX presentSPF -allDMARC policy noneRegistered 7 y ago
    DetailsHide
    Hostname
    www.netbox.crypto-polis.org
    First seen
    2026-11-06 05:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing crypto-polis.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-06 04:00 UTC to 2027-02-04 04:00 UTC
    Logged 2026-11-06 04:59 UTC in Geomys Tuscolo2027h1, entry 496,205,406
    SHA-256 448dd03c818e65fab2efe31b924ec36d2108526e6380060e2feae3a373e27762
    Public key SHA-256 23db7aa7ac8998551a1412d4e824c8bc78f160f9be31c59d5f4efa7b4cac7d8a
    PhishDestroy
    Addresses
    185.178.208.132 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    185.178.208.182 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.132, 185.178.208.182): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    crypto-polis.org
    Registered
    2019-12-20 · Internet Domain Service BS Corp
    MX
    Receives mail at mx.yandex.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-06 00:38 UTC

    Suggest a correction

  49. xrshib.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    xrshib.info
    First seen
    2026-11-06 05:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:59 UTC to 2027-02-04 03:59 UTC
    Logged 2026-11-06 04:57 UTC in DigiCert Wyvern2027h1, entry 424,913,712
    SHA-256 17285102dfa1941859268958e6cf60ad0552076ecfe1156018482cfb25acdc3f
    Public key SHA-256 890fa6f13bae16f885ad3eb6ee26143324b068928798e68b02250e7fba342d56
    Addresses
    104.21.64.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.55 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.178, 172.67.187.55): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xrshib.info
    Registered
    2026-05-12 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  50. 9pay.youla.www.www.sber.www.sber.prod2.hawkinswoodshop.com US · AS20473 · The Constant Company, LLC3 addressesYoula
    Phishing hostVultrAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantineRegistered 8 y ago
    DetailsHide
    Hostname
    9pay.youla.www.www.sber.www.sber.prod2.hawkinswoodshop.com
    First seen
    2026-11-06 04:56 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.77.75.133.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.77.75.133
    Certificate
    Issued by YE2
    Valid 2026-11-06 03:57 UTC to 2027-02-04 03:57 UTC
    Logged 2026-11-06 04:56 UTC in Google PlumbersArms2027h1, entry 638,312,468
    SHA-256 52c1cf48e12a28bb5e7ddd561b9a3a778e61248e56e477c98326ff45e5df7f7b
    Public key SHA-256 63bafb5c54c784998704cf3a4cb6446cf07e44a7a65e59adce877d861e61347e
    Brand
    Youla
    Addresses
    45.77.75.133 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    45.77.92.157 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    207.246.78.75 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    Vultr
    Vultr (45.77.75.133, 45.77.92.157, 207.246.78.75): a cloud provider. It rents servers and addresses to its customers.
    Domain
    hawkinswoodshop.com
    Registered
    2018-11-11 · NameSilo, LLC
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 20:47 UTC

    Suggest a correction

  51. apiim-whatappp.hl.cn US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    apiim-whatappp.hl.cn
    First seen
    2026-11-06 04:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-08 03:08 UTC to 2026-12-07 04:07 UTC
    Logged 2026-11-06 04:53 UTC in DigiCert Wyvern2026h2, entry 2,207,360,703
    SHA-256 30b2c38e283d4852f2885ed6eb44420c840bff41ea49087f93271351b514f73c
    Public key SHA-256 67e5617a638497e65286df4eaba82f9563e8e220a826329a8857352ff5ca4d17
    PhishDestroy
    Addresses
    104.21.80.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.87 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.80.25, 172.67.173.87): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    apiim-whatappp.hl.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:57 UTC

    Suggest a correction

  52. chrysarin.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    chrysarin.live
    First seen
    2026-11-06 04:56 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-08 01:30 UTC to 2026-12-07 02:30 UTC
    Logged 2026-11-06 04:52 UTC in IPng Networks Halloumi2026h2a, entry 1,288,685,984
    SHA-256 4828be4caca946879ccbf960388aed3a2661b5382c008af55b1e55680f8ffec5
    Public key SHA-256 ef36077ef44d80d331189157599050327681ad8d71fd0237e1dd51dde99a1299
    Addresses
    104.21.18.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.200 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.18.173, 172.67.182.200): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    chrysarin.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  53. general-ledger-system.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    general-ledger-system.pages.dev
    First seen
    2026-11-06 04:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:56 UTC to 2027-02-04 04:54 UTC
    Logged 2026-11-06 04:56 UTC in DigiCert Sphinx2027h1, entry 375,216,336
    SHA-256 fd13ebfa7ac74939df5bcbac5af1b9a7cec6ce6f9596e27c08ee3210ee6037ad
    Public key SHA-256 d736bed80a193e8f89a463d37437ce64f696c4124d25af75afe93108badfd713
    Addresses
    172.66.45.32 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.45.32, 172.66.46.224): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  54. getflashbtc.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    getflashbtc.com
    First seen
    2026-11-06 04:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:53 UTC to 2027-02-04 03:53 UTC
    Logged 2026-11-06 04:51 UTC in Let's Encrypt Willow2027h1, entry 962,782,207
    SHA-256 8f8d23a430127092394176612ecbea02ea703ee75f1710810b7985e43bf5a589
    Public key SHA-256 f615121305735eca4fa47daea5b67fc49afae871685a135f3dde13137af9004b
    PhishDestroy
    Addresses
    104.21.93.54 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.204.155 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.93.54, 172.67.204.155): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    getflashbtc.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:57 UTC

    Suggest a correction

  55. mimajbetgirisic.icu US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    mimajbetgirisic.icu
    First seen
    2026-11-06 04:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-06 03:52 UTC to 2027-02-04 04:49 UTC
    Logged 2026-11-06 04:52 UTC in DigiCert Wyvern2027h1, entry 424,864,838
    SHA-256 c067e887d21a925684d99bf12fe8f7b24c25f1821576167de2c93fc677e8e723
    Public key SHA-256 503e45fbb362313bac9dfa3787ac0d4c66c775c71251bb8303ba12946a4be370
    PhishDestroy
    Addresses
    104.21.68.28 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.28, 172.67.185.122): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mimajbetgirisic.icu
    Registered
    2026-07-11 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  56. mq0e74.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    mq0e74.hdiv8jy.com
    First seen
    2026-11-06 04:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:57 UTC to 2027-02-04 03:57 UTC
    Logged 2026-11-06 04:56 UTC in Geomys Tuscolo2027h1, entry 496,182,237
    SHA-256 09dbedf963862bc2a294da3f92dff7f0976dd0220068074b207c92d013201ec9
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 17:12 UTC

    Suggest a correction

  57. tgqkf.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    tgqkf.com
    First seen
    2026-11-06 04:56 UTC
    Listing
    CERT Polska listed it 2026-05-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:56 UTC to 2027-02-04 03:56 UTC
    Logged 2026-11-06 04:54 UTC in Let's Encrypt Willow2027h1, entry 962,813,780
    SHA-256 6ee7df04dbc876de9fc389e4838f087a612e1d5e224d2708ca502bc82a1a0368
    Public key SHA-256 5f8c5e95c6459071638a7b8d03e51ed6fdc54294b9baa9241d237fec82e4d034
    Addresses
    104.21.84.69 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.202 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.84.69, 172.67.187.202): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tgqkf.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:57 UTC

    Suggest a correction

  58. the-rainbet-au-com.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    the-rainbet-au-com.pages.dev
    First seen
    2026-11-06 04:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:52 UTC to 2027-02-04 04:51 UTC
    Logged 2026-11-06 04:52 UTC in DigiCert Wyvern2027h1, entry 424,867,907
    SHA-256 8787a81de06009af3e17c31a1b79ae76f4ba3a2fddf1b299948e4357da5c82a4
    Public key SHA-256 64dc7ff6fa6f5016d196d52ddd26732fe1e30a07377468b4f43b742c53231451
    Addresses
    172.66.44.124 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.124, 172.66.47.132): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  59. www-asterde.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    www-asterde.com
    First seen
    2026-11-06 04:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:51 UTC to 2027-02-04 04:50 UTC
    Logged 2026-11-06 04:51 UTC in IPng Networks Gouda2027h1, entry 330,951,278
    SHA-256 d10e82429b90a0813cecb58f3bf2f6a61918dcf2b7f5912f0e6f0196a8b0af41
    Public key SHA-256 a36f6cd2cc336fee7b48a236a95e2ef4060c8410762b65420a4b3a29f87a151c
    PhishDestroy
    Addresses
    104.21.3.144 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.130.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.3.144, 172.67.130.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    www-asterde.com
    Registered
    2025-11-16 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:57 UTC

    Suggest a correction

  60. www.alert-photo.us US · AS26042 · FiberState, LLC
    ListedUnder alert-photo.us, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.alert-photo.us
    First seen
    2026-11-06 04:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing alert-photo.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-06 03:54 UTC to 2027-02-04 03:54 UTC
    Logged 2026-11-06 04:53 UTC in Google PlumbersArms2027h1, entry 638,285,041
    SHA-256 7cfcea3dc763b20b5c322d0145360bddb94bda81cca80fcaeeca65d09a604114
    Public key SHA-256 57f07255384ed201615a71c7cd602a9849b45d45f0dd044e290ec214ad58d8f0
    Addresses
    206.168.149.74 · United States · AS26042 FIBERSTATE - FiberState, LLC
    Domain
    alert-photo.us
    Registered
    2026-08-29 · Sav.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 07:05 UTC

    Suggest a correction

  61. www.xpj7968.com US · AS62468 · VpsQuan L.L.C.
    ReportedUnder xpj7968.com, reported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.xpj7968.com
    First seen
    2026-11-06 04:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing xpj7968.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-06 03:53 UTC to 2027-02-04 03:53 UTC
    Logged 2026-11-06 04:51 UTC in Google ParcelYard2027h1, entry 637,886,826
    SHA-256 1a19920cc1a924e0f7e8c78ed28fbec26c6f8cc1a04ee78c3ecfc4e2c4021bae
    Public key SHA-256 4739adf2e8b64dfb62e4cccf5ed2b76f20eb4b58343d9ae91d46b541eee20206
    PhishDestroy
    Addresses
    82.109.252.22 · United States · AS62468 HKCLOUDX - VpsQuan L.L.C.
    Domain
    xpj7968.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:57 UTC

    Suggest a correction

  62. xpj7968.com US · AS62468 · VpsQuan L.L.C.
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    xpj7968.com
    First seen
    2026-11-06 04:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-06 03:53 UTC to 2027-02-04 03:53 UTC
    Logged 2026-11-06 04:51 UTC in Google ParcelYard2027h1, entry 637,886,826
    SHA-256 1a19920cc1a924e0f7e8c78ed28fbec26c6f8cc1a04ee78c3ecfc4e2c4021bae
    Public key SHA-256 4739adf2e8b64dfb62e4cccf5ed2b76f20eb4b58343d9ae91d46b541eee20206
    PhishDestroy
    Addresses
    82.109.252.22 · United States · AS62468 HKCLOUDX - VpsQuan L.L.C.
    Domain
    xpj7968.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:57 UTC

    Suggest a correction

  63. www.allianz-france-real-estate-invest.com FR · AS16276 · OVH OVH SASAllianz
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    www.allianz-france-real-estate-invest.com
    First seen
    2026-11-06 04:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 188.165.53.185.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 188.165.53.185
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:50 UTC to 2027-02-04 03:50 UTC
    Logged 2026-11-06 04:48 UTC in Google ParcelYard2027h1, entry 637,858,111
    SHA-256 5dd3c58161d8b4c81b0c7b004984d197f9bed82d1d209474f35e33a21b979545
    Public key SHA-256 f1f0aea6a10150f296cbc422c22d7e0b39a879e8ff69fae5d5c065b38d462a8e
    Brand
    Allianz
    Addresses
    188.165.53.185 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (188.165.53.185): a cloud provider. It rents servers and addresses to its customers.
    Domain
    allianz-france-real-estate-invest.com
    MX
    Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:42 UTC

    Suggest a correction

  64. e32.sberbankmobile.ru RU · AS49063 · DTLN Data Storage Center JSCSberbank
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    e32.sberbankmobile.ru
    First seen
    2026-11-06 04:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 87.242.79.60.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 87.242.79.60
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:49 UTC to 2027-02-04 03:49 UTC
    Logged 2026-11-06 04:47 UTC in Google PlumbersArms2027h1, entry 638,233,731
    SHA-256 2486c9e062394e6f5349e7ad657e3c18f09007c712520464ad1ef48d5beb1459
    Public key SHA-256 5f6c86c252b1b864c87b86ddc09da7d2a6c8944be8c50b6255d3d500327a6a7b
    Brand
    Sberbank
    Addresses
    87.242.79.60 · Russia · AS49063 DTLN Data Storage Center JSC
    Domain
    sberbankmobile.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:22 UTC

    Suggest a correction

  65. 765889-crypto.com US · AS13335 · Cloudflare, Inc.4 addressesCrypto.com
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    765889-crypto.com
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:47 UTC to 2027-02-04 04:46 UTC
    Logged 2026-11-06 04:47 UTC in Let's Encrypt Sycamore2027h1, entry 972,363,282
    SHA-256 e6c9cb1efa0a0608f3b00ddeb4c497178f65366aa88d178774f2bd88d45c652a
    Public key SHA-256 fa86d5645f9a6f8da8fa87539f8512ac815094ce971358d2a341eb164a378ce5
    Brand
    Crypto.com
    Addresses
    104.21.36.70 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.133 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:bc85
    2606:4700:3031::6815:2446
    Cloudflare
    Cloudflare (104.21.36.70, 172.67.188.133): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    765889-crypto.com
    Registered
    2026-07-10 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:09 UTC

    Suggest a correction

  66. artistamp.it IT · AS31034 · ARUBA-ASN Aruba S.p.A.
    ReportedReported by PhishTankMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    artistamp.it
    First seen
    2026-11-06 04:51 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-06 05:22 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Actalis Domain Validated TLS Server RSA CA 2025 · precertificate
    Valid 2026-11-06 04:37 UTC to 2027-05-24 04:37 UTC
    Logged 2026-11-06 04:47 UTC in DigiCert Wyvern2027h1, entry 424,843,414
    SHA-256 a6518e3bae74c7e45d64b983c6ca1be74d059668ac2dd80d9197bb16c9066733
    Public key SHA-256 21ac2c6eee6e04378074c95bdb9daee62a2312070619b5758ddcf7a9e1aa96aa
    PhishTank
    PhishTank report #9367361
    Addresses
    89.46.109.59 · Italy · AS31034 ARUBA-ASN Aruba S.p.A.
    Domain
    artistamp.it
    MX
    Receives mail at mx.artistamp.it
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  67. ftp.quantum-securechain.com US · AS53667 · FranTech Solutions
    ListedUnder quantum-securechain.com, listed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    ftp.quantum-securechain.com
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing quantum-securechain.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:48 UTC to 2027-02-04 03:48 UTC
    Logged 2026-11-06 04:47 UTC in DigiCert Sphinx2027h1, entry 375,161,702
    SHA-256 f0b3e10793ed7cd7fd7cc2c359bbd6d0c8f49881ebbcd86d2b43b897e3d1be7d
    Public key SHA-256 f8c48633825445cb7c9a7642c7b3181234ba5ec4fe6a7524e56243a17c0ce222
    Addresses
    198.251.89.229 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    quantum-securechain.com
    MX
    Receives mail at mail.quantum-securechain.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  68. kurz-link.de DE · AS24940 · HETZNER-AS Hetzner Online G…
    ReportedHetznerReported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    kurz-link.de
    First seen
    2026-11-06 04:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-06 05:22 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-06 03:50 UTC to 2027-02-04 03:50 UTC
    Logged 2026-11-06 04:49 UTC in Geomys Tuscolo2027h1, entry 496,120,407
    SHA-256 461dc062d29a3daa05cd4c35126b21d8fe81e9f5100a8e2f8d11bdef17c93250
    Public key SHA-256 11055f53b919de614b62d48cc29f5b0b15a6d2410ae017644c2f6fc83b43fc78
    PhishDestroy
    Addresses
    88.198.194.71 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (88.198.194.71): a cloud provider. It rents servers and addresses to its customers.
    Domain
    kurz-link.de
    MX
    Receives mail at mx1.a-mazing.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  69. lobianagci.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    lobianagci.live
    First seen
    2026-11-06 04:51 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-08 00:08 UTC to 2026-12-07 01:08 UTC
    Logged 2026-11-06 04:47 UTC in DigiCert Wyvern2026h2, entry 2,207,353,667
    SHA-256 752d4ac8989d7e0c168c28ab57a1b10f5ccae87da428d00f67a767334bbceaaf
    Public key SHA-256 468f5427bfa25a6f1379cf83e801cd5c172d522430385393e77197fa7fbf2368
    Addresses
    104.21.76.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.190.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.76.62, 172.67.190.86): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lobianagci.live
    Registered
    2026-07-10 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  70. mail.quantum-securechain.com US · AS53667 · FranTech Solutions
    ListedUnder quantum-securechain.com, listed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    mail.quantum-securechain.com
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing quantum-securechain.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:48 UTC to 2027-02-04 03:48 UTC
    Logged 2026-11-06 04:47 UTC in DigiCert Sphinx2027h1, entry 375,161,702
    SHA-256 f0b3e10793ed7cd7fd7cc2c359bbd6d0c8f49881ebbcd86d2b43b897e3d1be7d
    Public key SHA-256 f8c48633825445cb7c9a7642c7b3181234ba5ec4fe6a7524e56243a17c0ce222
    Addresses
    198.251.89.229 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    quantum-securechain.com
    MX
    Receives mail at mail.quantum-securechain.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  71. migrate-waronvsd1.live US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    migrate-waronvsd1.live
    First seen
    2026-11-06 04:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:51 UTC to 2027-02-04 03:51 UTC
    Logged 2026-11-06 04:50 UTC in Geomys Tuscolo2027h1, entry 496,128,115
    SHA-256 0836254ace1baa1d9a8cde528c2a905aeb267f06db615053d75e47c1dd9e1643
    Public key SHA-256 c005d414e9bcad975a3214237b5dceab65316d0305e239cae0a9a83406e6efe8
    PhishDestroy
    Addresses
    104.21.11.29 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.23 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.11.29, 172.67.165.23): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    migrate-waronvsd1.live
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  72. papertrade.events US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    papertrade.events
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-06 03:50 UTC to 2027-02-04 03:50 UTC
    Logged 2026-11-06 04:49 UTC in IPng Networks Halloumi2027h1, entry 382,703,550
    SHA-256 54deac109c8f82940b308b94e4a50eac3c1c25e288982d4f3546701db5764ea6
    Public key SHA-256 abd3748bf59ee45eb63502b68a9096300ef38a8126a8fea8f7fe0e45b189a1e2
    Addresses
    104.21.13.167 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.200.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.13.167, 172.67.200.213): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    papertrade.events
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  73. phondawind.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    phondawind.live
    First seen
    2026-11-06 04:51 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:46 UTC to 2027-02-04 04:44 UTC
    Logged 2026-11-06 04:46 UTC in Google ParcelYard2027h1, entry 637,834,323
    SHA-256 750f2f7ea23f368a443852d68351a9e19955fc1b8d91d120237318726a3f2e0d
    Public key SHA-256 717ab51ac9c3bc8faa7dfbca4c42f66d4383b00c2339a5f267a34a1291c51938
    Addresses
    104.21.60.75 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.60.75, 172.67.193.219): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    phondawind.live
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  74. pop.quantum-securechain.com US · AS53667 · FranTech Solutions
    ListedUnder quantum-securechain.com, listed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    pop.quantum-securechain.com
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing quantum-securechain.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:48 UTC to 2027-02-04 03:48 UTC
    Logged 2026-11-06 04:47 UTC in DigiCert Sphinx2027h1, entry 375,161,702
    SHA-256 f0b3e10793ed7cd7fd7cc2c359bbd6d0c8f49881ebbcd86d2b43b897e3d1be7d
    Public key SHA-256 f8c48633825445cb7c9a7642c7b3181234ba5ec4fe6a7524e56243a17c0ce222
    Addresses
    198.251.89.229 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    quantum-securechain.com
    MX
    Receives mail at mail.quantum-securechain.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  75. quantum-securechain.com US · AS53667 · FranTech Solutions
    ListedListed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    quantum-securechain.com
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:48 UTC to 2027-02-04 03:48 UTC
    Logged 2026-11-06 04:47 UTC in DigiCert Sphinx2027h1, entry 375,161,702
    SHA-256 f0b3e10793ed7cd7fd7cc2c359bbd6d0c8f49881ebbcd86d2b43b897e3d1be7d
    Public key SHA-256 f8c48633825445cb7c9a7642c7b3181234ba5ec4fe6a7524e56243a17c0ce222
    Addresses
    198.251.89.229 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    quantum-securechain.com
    MX
    Receives mail at mail.quantum-securechain.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  76. smtp.quantum-securechain.com US · AS53667 · FranTech Solutions
    ListedUnder quantum-securechain.com, listed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    smtp.quantum-securechain.com
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing quantum-securechain.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:48 UTC to 2027-02-04 03:48 UTC
    Logged 2026-11-06 04:47 UTC in DigiCert Sphinx2027h1, entry 375,161,702
    SHA-256 f0b3e10793ed7cd7fd7cc2c359bbd6d0c8f49881ebbcd86d2b43b897e3d1be7d
    Public key SHA-256 f8c48633825445cb7c9a7642c7b3181234ba5ec4fe6a7524e56243a17c0ce222
    Addresses
    198.251.89.229 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    quantum-securechain.com
    MX
    Receives mail at mail.quantum-securechain.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  77. stats.zenavlico.cyou TJ · AS208885 · NFS-AS Noyobzoda Faridduni …
    ListedUnder zenavlico.cyou, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    stats.zenavlico.cyou
    First seen
    2026-11-06 04:51 UTC
    Listing
    CERT Polska listed it 2026-05-25 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska, listing zenavlico.cyou and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-11-06 00:00 UTC to 2027-02-04 23:59 UTC
    Logged 2026-11-06 04:48 UTC in IPng Networks Halloumi2027h1, entry 382,697,098
    SHA-256 6572ee27f82c560456ac1139568c131423c824087396d54b564b011b3e97fa23
    Public key SHA-256 f88c6296605604e24bf0b89d3dc10db9f340f603152a3da8673e03d62a246c87
    Addresses
    95.85.244.13 · Tajikistan · AS208885 NFS-AS Noyobzoda Faridduni Saidilhom
    Domain
    zenavlico.cyou
    Registered
    2026-01-26 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  78. supyb.website US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    supyb.website
    First seen
    2026-11-06 04:51 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:49 UTC to 2027-02-04 03:49 UTC
    Logged 2026-11-06 04:48 UTC in IPng Networks Halloumi2027h1, entry 382,698,174
    SHA-256 c16be8e4cd6ed34913dd230979e6ceb27374d5701b2d0652a4a98000a355c0e3
    Public key SHA-256 d9f79d30235b5ea76ed96449b210024faaf4838dde2b8d6d973a7d2e468febf9
    Addresses
    104.21.39.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.39.254, 172.67.172.214): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    supyb.website
    Registered
    2026-03-15 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  79. www.kurz-link.de DE · AS24940 · HETZNER-AS Hetzner Online G…
    ReportedHetznerUnder kurz-link.de, reported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    www.kurz-link.de
    First seen
    2026-11-06 04:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing kurz-link.de and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-06 03:50 UTC to 2027-02-04 03:50 UTC
    Logged 2026-11-06 04:49 UTC in Geomys Tuscolo2027h1, entry 496,120,407
    SHA-256 461dc062d29a3daa05cd4c35126b21d8fe81e9f5100a8e2f8d11bdef17c93250
    Public key SHA-256 11055f53b919de614b62d48cc29f5b0b15a6d2410ae017644c2f6fc83b43fc78
    PhishDestroy
    Addresses
    88.198.194.71 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (88.198.194.71): a cloud provider. It rents servers and addresses to its customers.
    Domain
    kurz-link.de
    MX
    Receives mail at mx1.a-mazing.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  80. www.quantum-securechain.com US · AS53667 · FranTech Solutions
    ListedUnder quantum-securechain.com, listed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.quantum-securechain.com
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing quantum-securechain.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:48 UTC to 2027-02-04 03:48 UTC
    Logged 2026-11-06 04:47 UTC in DigiCert Sphinx2027h1, entry 375,161,702
    SHA-256 f0b3e10793ed7cd7fd7cc2c359bbd6d0c8f49881ebbcd86d2b43b897e3d1be7d
    Public key SHA-256 f8c48633825445cb7c9a7642c7b3181234ba5ec4fe6a7524e56243a17c0ce222
    Addresses
    198.251.89.229 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    quantum-securechain.com
    MX
    Receives mail at mail.quantum-securechain.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  81. www.webhook.crypto-polis.org RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD2 addresses
    ReportedDDoS-GuardUnder crypto-polis.org, reported by PhishDestroyMX presentSPF -allDMARC policy noneRegistered 7 y ago
    DetailsHide
    Hostname
    www.webhook.crypto-polis.org
    First seen
    2026-11-06 04:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing crypto-polis.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-06 03:51 UTC to 2027-02-04 03:51 UTC
    Logged 2026-11-06 04:50 UTC in Google PlumbersArms2027h1, entry 638,259,676
    SHA-256 27027d6e092b24e7adcfa18ac1ef5e8ea249a0f9f7a927e7fb376c5e8717fc3d
    Public key SHA-256 ed1bf9372b3649fdfe90ac5bed1eb5f3904fc9021be80992d9cb18f919955ef5
    PhishDestroy
    Addresses
    185.178.208.132 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    185.178.208.182 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.132, 185.178.208.182): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    crypto-polis.org
    Registered
    2019-12-20 · Internet Domain Service BS Corp
    MX
    Receives mail at mx.yandex.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-06 00:38 UTC

    Suggest a correction

  82. zazerfiosuiri.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    zazerfiosuiri.com
    First seen
    2026-11-06 04:51 UTC
    Listing
    CERT Polska listed it 2026-05-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:52 UTC to 2027-02-04 03:52 UTC
    Logged 2026-11-06 04:51 UTC in Google ParcelYard2027h1, entry 637,881,437
    SHA-256 bc702750551b6bd897991005c6435e88077a335888f54386dd24772ead046be8
    Public key SHA-256 2427570118e0fb0d9e8bba1fa679ef15128f768eed04c2c2136c781effae1692
    Addresses
    104.21.18.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.81 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.18.142, 172.67.182.81): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zazerfiosuiri.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:52 UTC

    Suggest a correction

  83. zebec.foundation US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    zebec.foundation
    First seen
    2026-11-06 04:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:49 UTC to 2027-02-04 03:49 UTC
    Logged 2026-11-06 04:48 UTC in Google PlumbersArms2027h1, entry 638,237,165
    SHA-256 c66c38db2e67dfafff16f33585c0400c8052b0f332218ad57e104d9e38d9ceb3
    Public key SHA-256 05e862a15b21093360f0a66aa2c44b4d60383801d9d8004e95738388f5232a39
    Addresses
    104.21.13.135 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.132.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.13.135, 172.67.132.224): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zebec.foundation
    Registered
    2026-05-12 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  84. caravan.aaterrainc.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder aaterrainc.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 25 d ago
    DetailsHide
    Hostname
    caravan.aaterrainc.com
    First seen
    2026-11-06 04:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing aaterrainc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-06 03:43 UTC to 2027-02-04 03:43 UTC
    Logged 2026-11-06 04:41 UTC in Google ParcelYard2027h1, entry 637,784,850
    SHA-256 4cca3bb122218439c86107cf8a54bf61300ae458aec4f63afbc62ae0ec08c05d
    Public key SHA-256 317bd605dd3c542795bb352122385297ad74aab446b02fd0f98d47edba7a43dd
    Addresses
    104.21.47.167 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.171.174 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.167, 172.67.171.174): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aaterrainc.com
    Registered
    2026-10-12 · Cloudflare, Inc.
    MX
    Receives mail at route3.mx.cloudflare.net, route1.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 22:15 UTC

    Suggest a correction

  85. cfgehfs.yoga US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    cfgehfs.yoga
    First seen
    2026-11-06 04:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:43 UTC to 2027-02-04 04:42 UTC
    Logged 2026-11-06 04:43 UTC in DigiCert Wyvern2027h1, entry 424,807,562
    SHA-256 07ad1b7bb889a6cb73e442570c838d282220c0b7e1e5d79ee5c4c3604fc0646a
    Public key SHA-256 e9efe2b381b4468b33a58c4fd5613cdbe3d4aeb58b304908604aedfc2e0dfe0c
    Addresses
    104.21.15.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.84 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.15.173, 172.67.163.84): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cfgehfs.yoga
    Registered
    2026-09-08 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  86. decodeqr.com FI · AS202053 · UPCLOUD UpCloud Ltd2 addresses
    ReportedReported by PhishDestroyMX absentSPF missingDMARC policy none
    DetailsHide
    Hostname
    decodeqr.com
    First seen
    2026-11-06 04:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:44 UTC to 2027-02-04 03:44 UTC
    Logged 2026-11-06 04:43 UTC in Let's Encrypt Willow2027h1, entry 962,690,372
    SHA-256 36f88296a27097a83a3cb4175c00abde724b09aff4f4251467cd304269880f3d
    Public key SHA-256 f2380e08f680941ba3081e71415e328bae13b6f5766e908e551d5769ce189389
    PhishDestroy
    Addresses
    94.237.96.16 · Finland · AS202053 UPCLOUD UpCloud Ltd
    2a04:3542:1000:910:7469:c4ff:fe2b:7518
    Domain
    decodeqr.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-06 04:47 UTC

    Suggest a correction

  87. gonoodlenetwork.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    gonoodlenetwork.com
    First seen
    2026-11-06 04:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-08 00:34 UTC to 2026-12-07 01:33 UTC
    Logged 2026-11-06 04:45 UTC in DigiCert Wyvern2026h2, entry 2,207,351,305
    SHA-256 c9c6a883f9ec353b25b8f0409b9ee03da28f515eaf15e96c5e73e2ae13eea552
    Public key SHA-256 2340ee1370b73e7c90b831f39149b49dff33eb48acbdcbe27feefe56cea7c98d
    PhishDestroy
    Addresses
    104.21.39.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.123 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.39.251, 172.67.172.123): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gonoodlenetwork.com
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-06 04:47 UTC

    Suggest a correction

  88. hotfix.kingdom-dmc.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder kingdom-dmc.com, listed by MetaMaskMX presentSPF all omittedDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    hotfix.kingdom-dmc.com
    First seen
    2026-11-06 04:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask, listing kingdom-dmc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-06 03:43 UTC to 2027-02-04 03:43 UTC
    Logged 2026-11-06 04:41 UTC in Google ParcelYard2027h1, entry 637,783,152
    SHA-256 0acc4a527112f5aef53abcbc43e4a7eec15ac15233545795fac8b244af261e7c
    Public key SHA-256 d787c36edf78a75d8828fc0a8ee4d7230ee89d7d624d2f14db669bd87d7a644f
    Addresses
    185.215.4.42 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.215.4.42): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kingdom-dmc.com
    Registered
    2022-12-16 · NameSilo, LLC
    MX
    Receives mail at mail.kingdom-dmc.com
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 03:09 UTC

    Suggest a correction

  89. qai-engine-com.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    qai-engine-com.pages.dev
    First seen
    2026-11-06 04:46 UTC
    Listing
    CERT Polska listed it 2026-09-24 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-06 00:00 UTC to 2027-02-03 09:53 UTC
    Logged 2026-11-06 04:44 UTC in Geomys Tuscolo2027h1, entry 496,077,951
    SHA-256 7e7d4124fd5d30e782afffc57587a72e54b6d258268b2339785a72ca2bf96719
    Public key SHA-256 bf10b71b70af0a4d20dbb56e3a41604ebdeac585e6b984661994e37d64ceff6a
    Addresses
    172.66.45.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.45.7, 172.66.46.249): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  90. vdygd.website US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    vdygd.website
    First seen
    2026-11-06 04:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-06 03:45 UTC to 2027-02-04 03:45 UTC
    Logged 2026-11-06 04:44 UTC in Google PlumbersArms2027h1, entry 638,195,394
    SHA-256 184be3dde82e59771fd42256171c996157c91d573bed806079c5b9ca3e870031
    Public key SHA-256 ded7de3fe20ba4f98f139ff27e6c6be2349425f284cf1de496a3cb21e1b20496
    Addresses
    104.21.89.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.89.50, 172.67.137.207): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vdygd.website
    Registered
    2026-03-15 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  91. wxypu.website US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    wxypu.website
    First seen
    2026-11-06 04:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-06 03:45 UTC to 2027-02-04 03:45 UTC
    Logged 2026-11-06 04:44 UTC in IPng Networks Gouda2027h1, entry 330,901,772
    SHA-256 824e6f6957ace07b611e1085e547a686ccec16592c86d7e98e0d76c3ba7e51fa
    Public key SHA-256 5b29b9c5746e6f4c196e66ad402428c505e9381cd9996822e8e87a0b83d6e71e
    Addresses
    104.21.23.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.23.62, 172.67.209.116): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wxypu.website
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:47 UTC

    Suggest a correction

  92. xhfgqwe.buzz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    xhfgqwe.buzz
    First seen
    2026-11-06 04:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:45 UTC to 2027-02-04 04:44 UTC
    Logged 2026-11-06 04:45 UTC in Geomys Tuscolo2027h1, entry 496,088,315
    SHA-256 be994bf6f14b11c6e8580f00d07a7e5f890d539e5c4d2470108ac0f3baa9cb18
    Public key SHA-256 9f3e0d982274a3a6098705e1a0ed8093ae5865c8dbfd00ec1e76733176434b1f
    Addresses
    104.21.36.106 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.192.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.36.106, 172.67.192.147): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xhfgqwe.buzz
    Registered
    2026-09-08 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  93. www.iphone-generation.fr FR · AS50474 · O2SWITCH O2SWITCH SASApple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 10 y ago
    DetailsHide
    Hostname
    www.iphone-generation.fr
    First seen
    2026-11-06 04:43 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.154.138.205.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.154.138.205
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-06 03:35 UTC to 2027-02-04 03:34 UTC
    Logged 2026-11-06 04:33 UTC in DigiCert Wyvern2027h1, entry 424,716,693
    SHA-256 ad01b51aecc4cf3cd3ad56bd466b71370d81ce997210148751bacd635a853fd1
    Public key SHA-256 e32093bd7f557478ee9edd73d3e975b15c54cf2571bb389c3044e85995f6c523
    Brand
    Apple
    Addresses
    185.154.138.205 · France · AS50474 O2SWITCH O2SWITCH SAS
    Domain
    iphone-generation.fr
    Registered
    2017-02-03 · NETIM
    MX
    Receives mail at mail.iphone-generation.fr
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  94. iphone-generation.fr FR · AS50474 · O2SWITCH O2SWITCH SASApple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 10 y ago
    DetailsHide
    Hostname
    iphone-generation.fr
    First seen
    2026-11-06 04:43 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.154.138.205.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.154.138.205
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-06 03:35 UTC to 2027-02-04 03:34 UTC
    Logged 2026-11-06 04:33 UTC in DigiCert Wyvern2027h1, entry 424,716,693
    SHA-256 ad01b51aecc4cf3cd3ad56bd466b71370d81ce997210148751bacd635a853fd1
    Public key SHA-256 e32093bd7f557478ee9edd73d3e975b15c54cf2571bb389c3044e85995f6c523
    Brand
    Apple
    Addresses
    185.154.138.205 · France · AS50474 O2SWITCH O2SWITCH SAS
    Domain
    iphone-generation.fr
    Registered
    2017-02-03 · NETIM
    MX
    Receives mail at mail.iphone-generation.fr
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

  95. artcircle.royalcollege.lk US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder royalcollege.lk, reported by PhishDestroyMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    artcircle.royalcollege.lk
    First seen
    2026-11-06 04:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-28 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Reported
    PhishDestroy, listing royalcollege.lk and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-06 03:41 UTC to 2027-02-04 03:41 UTC
    Logged 2026-11-06 04:39 UTC in IPng Networks Gouda2027h1, entry 330,873,572
    SHA-256 8eb29f5a71033d824146514959ccdbc74be6baa4cd470eecf443d64fd661b203
    Public key SHA-256 6bcb94b2a7d3867692a3ddd96424c56784adbff3dcd2d9b5f143c7b06f818119
    PhishDestroy
    Addresses
    64.29.17.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.198.79.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (64.29.17.1, 216.198.79.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    royalcollege.lk
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:27 UTC

    Suggest a correction

  96. dexscreenerboost.com US · AS399629 · BL Networks
    ListedListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    dexscreenerboost.com
    First seen
    2026-11-06 04:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-06 03:41 UTC to 2027-02-04 03:41 UTC
    Logged 2026-11-06 04:39 UTC in Google PlumbersArms2027h1, entry 638,149,251
    SHA-256 2b4a9fd3fb2432b7e7de6bfcc226c630dcc60969354f4c9ba804398988cf2dd1
    Public key SHA-256 b00049f33bf63b4f821fbd7ce255f3e09b4adf93156bcfa69f6bca1628ee7cdd
    Addresses
    64.111.93.27 · United States · AS399629 BLNWX - BL Networks
    Domain
    dexscreenerboost.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:42 UTC

    Suggest a correction

  97. facebook-verify-business.com DE · AS47846 · SEDO-AS SEDO GmbHFacebook
    ListedParking page · SedoListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    facebook-verify-business.com
    First seen
    2026-11-06 04:41 UTC
    Listing
    CERT Polska listed it 2026-06-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    PhishDestroy: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Encryption Everywhere DV TLS CA - G2 · precertificate
    Valid 2026-11-06 00:00 UTC to 2027-02-03 23:59 UTC
    Logged 2026-11-06 04:39 UTC in Let's Encrypt Willow2027h1, entry 962,648,525
    SHA-256 e4ea4555c829e04759ad413bf6ead767e3aca6035be5853af975ffcba13e4115
    Public key SHA-256 6b737fd3a2479508e63b3280c7808c906a1e6bdd15607c8b38e34a9d20a837d0
    Brand
    Facebook
    Addresses
    91.195.240.94 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.94): a parking service. It answers for names that are typically for sale or unused.
    Domain
    facebook-verify-business.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:42 UTC

    Suggest a correction

  98. finzavelle-de.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    finzavelle-de.live
    First seen
    2026-11-06 04:41 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 03:19 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:40 UTC to 2027-02-04 04:39 UTC
    Logged 2026-11-06 04:40 UTC in Let's Encrypt Sycamore2027h1, entry 972,286,174
    SHA-256 7ad1ce50ab483c065a035dfac749089ccdcb0651f237e0859ba8e1cbffdfef9b
    Public key SHA-256 2b601d29ba379e017b0b56937b9c9599b9599d061a81c0e6214b4eac2341f1a9
    Addresses
    104.21.80.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.152.181 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.80.178, 172.67.152.181): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    finzavelle-de.live
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:42 UTC

    Suggest a correction

  99. ipasbdhj.top US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    ipasbdhj.top
    First seen
    2026-11-06 04:41 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-06 01:33 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-10-15 17:42 UTC to 2027-01-13 18:41 UTC
    Logged 2026-11-06 04:37 UTC in Sectigo Monument2027h1, entry 70,324,918
    SHA-256 8dccaf6e54b1003a0ac94ef732593fad0b9fadd98ed2b06705d6c35eba909032
    Public key SHA-256 1bef882cade73a78519d4281db6cbcd166e1c688ceceab986f3a576e8882946e
    Addresses
    104.21.7.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.130.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.7.153, 172.67.130.82): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ipasbdhj.top
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 04:42 UTC

    Suggest a correction

  100. lidof.fi US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    lidof.fi
    First seen
    2026-11-06 04:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    PhishDestroy: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 23:52 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-06 03:36 UTC to 2027-02-04 04:33 UTC
    Logged 2026-11-06 04:36 UTC in Google PlumbersArms2027h1, entry 638,104,809
    SHA-256 bade1d501823f117b17433fbd83cfebaa4268efd829bbae547a3e4a229494d2d
    Public key SHA-256 63a113f763b590b953254da30168b8b83d0cea1b66adbe24a7248ee7968d27e1
    Addresses
    104.21.80.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.80.13, 172.67.172.148): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lidof.fi
    Registered
    2026-05-26
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 05:24 UTC

    Suggest a correction

Showing 1–100 of 5,906 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources