Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-07 14:26 UTC
Certificate-log entries · 24 h
321.2M
from 84 distinct feeds
Unique certificates · 24 h
31.5M
each reviewed
Names resolved · 24 h
20.3M
14.9M with an address
Findings · 24 h
6,046
212 of 1,061 brands targeted

6,046 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. a1menkuldegerler.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    a1menkuldegerler.com
    First seen
    2026-11-07 14:26 UTC
    Listing
    USOM listed it 2026-05-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 14:29 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:26 UTC to 2027-02-05 13:26 UTC
    Logged 2026-11-07 14:25 UTC in Google ParcelYard2027h1, entry 661,537,845
    SHA-256 d2897a9286605dd21bfd7be1d6f279e3de5c42053ca527b56405d9bc2a0fbbef
    Public key SHA-256 095e2bc9d309cff2e8e6d80220aef431dda13a85f806aaee8620faf8490c240c
    Addresses
    104.21.59.115 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.161 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.59.115, 172.67.175.161): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    a1menkuldegerler.com
    Registered
    2026-05-14 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  2. alvorixent.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    alvorixent.com
    First seen
    2026-11-07 14:26 UTC
    Listing
    CERT Polska listed it 2026-07-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:22 UTC to 2027-02-05 14:20 UTC
    Logged 2026-11-07 14:22 UTC in DigiCert Sphinx2027h1, entry 391,094,154
    SHA-256 437fe643e4e49ac5d4279845308c75dcc2310a6dbd863867a498a53bae9719ad
    Public key SHA-256 b04756903fe7e9b32a6c52e52bf9f0d74221de18e2aa8a8961c308c566e5f5dc
    Addresses
    104.21.46.135 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.139.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.46.135, 172.67.139.44): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    alvorixent.com
    Registered
    2026-07-12 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  3. barracudabar-pattaya.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishTankMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    barracudabar-pattaya.com
    First seen
    2026-11-07 14:26 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 14:32 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:23 UTC to 2027-02-05 14:21 UTC
    Logged 2026-11-07 14:23 UTC in Google ParcelYard2027h1, entry 661,517,864
    SHA-256 436b0800d6013abc411aea925270268d09aa82cada6961df6ecf248f44c3d063
    Public key SHA-256 37132e560672316a5830907694fc2968e3e1495885a7986a35a23fc63f679249
    PhishTank
    PhishTank report #9394748
    Addresses
    104.21.36.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.197.230 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.36.173, 172.67.197.230): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    barracudabar-pattaya.com
    Registered
    2025-11-25 · Metaregistrar BV
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  4. hyggeshopping.online US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC quarantineRegistered 6 mo ago
    DetailsHide
    Hostname
    hyggeshopping.online
    First seen
    2026-11-07 14:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:25 UTC to 2027-02-05 13:25 UTC
    Logged 2026-11-07 14:24 UTC in Google ParcelYard2027h1, entry 661,524,754
    SHA-256 1ca28a08d6bc35af313cb7294cddc019ce4af0455e7ec32a3a2d75077b4eed2d
    Public key SHA-256 abdb7811acb6636893eff2ed0a61711aba740fbee1e042b4aff463b828d5d626
    Addresses
    104.21.66.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.166.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.249, 172.67.166.138): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyggeshopping.online
    Registered
    2026-05-14 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  5. kgzvh.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    kgzvh.work
    First seen
    2026-11-07 14:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:23 UTC to 2027-02-05 13:23 UTC
    Logged 2026-11-07 14:22 UTC in Google PlumbersArms2027h1, entry 661,843,458
    SHA-256 163becf8f3a65169b9e33fa760eedc8133786a5bcb53c05a6b6e231e66a0ae6a
    Public key SHA-256 266444dfe115ef2eaffee755d68b10e735e59120bd99545cd1cd0aab74958330
    Addresses
    104.21.59.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.59.68, 172.67.217.153): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kgzvh.work
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  6. podozu-jisuji.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    podozu-jisuji.info
    First seen
    2026-11-07 14:26 UTC
    Listing
    CERT Polska listed it 2026-05-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:24 UTC to 2027-02-05 13:24 UTC
    Logged 2026-11-07 14:23 UTC in Google ParcelYard2027h1, entry 661,513,521
    SHA-256 1fd5c750d75d4d290b58624f1ad72d3f2addc2924559d1d576facfea2f9567ce
    Public key SHA-256 7e528ca59e8871fdad2f10d526c0d7b6523e6ed2b0428433d020efcef8ae0b95
    Addresses
    104.21.46.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.46.216, 172.67.142.221): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    podozu-jisuji.info
    Registered
    2026-05-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  7. portal-metamas-autth.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    portal-metamas-autth.pages.dev
    First seen
    2026-11-07 14:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:25 UTC to 2027-02-05 14:23 UTC
    Logged 2026-11-07 14:25 UTC in Google PlumbersArms2027h1, entry 661,872,576
    SHA-256 5532947b3c8490e1daad392fd79f19520f1e365bb4ce2bdaf0b70cdcb408ec8d
    Public key SHA-256 40e58214494bfdbda4c647cea77d5c3eda2033713410a7c7453e2314a2f1ad52
    Addresses
    172.66.44.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.78, 172.66.47.178): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  8. quaradoxtradersoft-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    quaradoxtradersoft-com.financecryptoworld.com
    First seen
    2026-11-07 14:26 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 13:25 UTC to 2027-02-05 14:23 UTC
    Logged 2026-11-07 14:25 UTC in Let's Encrypt Sycamore2027h1, entry 1,017,249,154
    SHA-256 6c9456485e8c240cd492cb29822f89ec50abc80ef20e386691273dc768607bac
    Public key SHA-256 41b6d7372bb7249326860e245adfbf709987a7710e6908fb0239220df3cb2083
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 17:12 UTC

    Suggest a correction

  9. solmix.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    solmix.org
    First seen
    2026-11-07 14:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:25 UTC to 2027-02-05 14:23 UTC
    Logged 2026-11-07 14:25 UTC in IPng Networks Halloumi2027h1, entry 400,119,874
    SHA-256 c6fd1692ebf3ee099b7f8412e2781dd0e221daecd617e07e6743a8e5b8a0a24f
    Public key SHA-256 d1bf68236c0873c2df6d9763eebe33104d36de0a16e05816c40523431fbaeac7
    PhishDestroy
    Addresses
    104.21.7.120 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.130.75 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.7.120, 172.67.130.75): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    solmix.org
    Registered
    2026-09-09 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  10. throughfuture.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    throughfuture.info
    First seen
    2026-11-07 14:26 UTC
    Listing
    CERT Polska listed it 2026-05-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:26 UTC to 2027-02-05 13:26 UTC
    Logged 2026-11-07 14:25 UTC in Geomys Tuscolo2027h1, entry 515,504,782
    SHA-256 115372817e0d5b468e03bf372caa960c83c34274e9dc85c67d76a87b6e28e379
    Public key SHA-256 553fd316cb593c0d72c19e7fda12c7b05918e57c726acaee8cb73f92ef4606dd
    Addresses
    104.21.45.179 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.45.179, 172.67.217.184): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    throughfuture.info
    Registered
    2026-05-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  11. wbwjy.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    wbwjy.work
    First seen
    2026-11-07 14:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:23 UTC to 2027-02-05 13:23 UTC
    Logged 2026-11-07 14:21 UTC in Google ParcelYard2027h1, entry 661,498,813
    SHA-256 02e6afe10c47da07ea980eeb80f350b9dab292a4f78b962690962e2d3402f33f
    Public key SHA-256 32952d776098f7fee4c99f116d5fcecf218b54d3a29d140988145ff45e66eb43
    Addresses
    104.21.28.110 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.223 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.28.110, 172.67.145.223): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wbwjy.work
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  12. www.growthlab-x.com US · AS53831 · Squarespace, Inc.4 addresses
    ListedSquarespaceUnder growthlab-x.com, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    www.growthlab-x.com
    First seen
    2026-11-07 14:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask, listing growthlab-x.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:24 UTC to 2027-02-05 13:24 UTC
    Logged 2026-11-07 14:23 UTC in Google PlumbersArms2027h1, entry 661,854,181
    SHA-256 4c80ae63ad1d78e4039d09736c1eb3dd4c3807a6355f44a95d33f424853799c7
    Public key SHA-256 7ebfb7e107958a207a7ed66786a50fa59127372441417420f611f6558e9e878f
    Addresses
    198.49.23.144 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.49.23.145 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.185.159.144 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.185.159.145 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    Squarespace
    Squarespace (198.49.23.144, 198.49.23.145, 198.185.159.144, 198.185.159.145): a site builder. It hosts pages for anyone who signs up.
    Domain
    growthlab-x.com
    Registered
    2026-05-16 · Squarespace Domains II LLC
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  13. zebec-io.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    zebec-io.vip
    First seen
    2026-11-07 14:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:24 UTC to 2027-02-05 14:21 UTC
    Logged 2026-11-07 14:24 UTC in IPng Networks Halloumi2027h1, entry 400,113,151
    SHA-256 d66e3c1f6e77e940c3408243ad2b90c81ca5d458ea24400976d001b02831ed12
    Public key SHA-256 4cc01711565a3e4dedadefb439a01493442e5b5905dc87a31a241bdfb34596f2
    Addresses
    104.21.37.194 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.37.194, 172.67.212.173): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zebec-io.vip
    Registered
    2026-09-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  14. ionosmail.com US · AS40244 · Turnkey Internet Inc.4 addressesIONOS
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    ionosmail.com
    First seen
    2026-11-07 14:24 UTC
    DNS
    Resolves · checked 2026-11-07 14:24 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 199.193.114.42.
    1. Phishing-host list fetched with the address
    2. Resolved to 199.193.114.42
    Brand
    IONOS
    Addresses
    199.193.114.42 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    37.48.110.48 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    199.193.114.46 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    213.227.156.75 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    ionosmail.com
    Registered
    2019-01-07 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:36 UTC

    Suggest a correction

  15. dyhrlsep.gmhbrwxt.puibagez.wtxvekru.pynljkrh.uevpygdb.smnqphzo.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    dyhrlsep.gmhbrwxt.puibagez.wtxvekru.pynljkrh.uevpygdb.smnqphzo.gatewaylearning.ezgateway.net
    First seen
    2026-11-07 14:21 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 14:29 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:16 UTC to 2027-02-05 13:16 UTC
    Logged 2026-11-07 14:15 UTC in Google PlumbersArms2027h1, entry 661,751,358
    SHA-256 306d2d7c302f6f258338e200085aa2577e31e9f16e170a93fbdd8dadfd4c5fe0
    Public key SHA-256 65e18e7aad591d5e72135dc8d23a9717f2f47f369e4e9039edbba3294c4ea5fc
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-06 17:12 UTC

    Suggest a correction

  16. ehcgy.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    ehcgy.work
    First seen
    2026-11-07 14:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:20 UTC to 2027-02-05 13:20 UTC
    Logged 2026-11-07 14:18 UTC in Google ParcelYard2027h1, entry 661,459,880
    SHA-256 42cac59d3713808d2bd3f47f572101495e55ee13031e49b894729426f3f0d63b
    Public key SHA-256 0b59649e969185d46f7b52d7163e2c9eb6f2c28b10d7174fbd1740778ef8b236
    Addresses
    104.21.42.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.162.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.42.143, 172.67.162.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ehcgy.work
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  17. exunovo.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    exunovo.xyz
    First seen
    2026-11-07 14:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:15 UTC to 2027-02-05 14:14 UTC
    Logged 2026-11-07 14:15 UTC in Geomys Tuscolo2027h1, entry 515,417,120
    SHA-256 2f1246c0ef25d1a551a07a4606e33a71fb56fa5a74821c1a98d710f8ae3b5789
    Public key SHA-256 b581e02b739feeb0864ab510ac3ce0b8bcc4642aaf8131157b48b6c38b774135
    Addresses
    104.21.73.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.73.242, 172.67.193.118): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exunovo.xyz
    Registered
    2026-09-09 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  18. gnavh.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    gnavh.work
    First seen
    2026-11-07 14:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:17 UTC to 2027-02-05 13:17 UTC
    Logged 2026-11-07 14:15 UTC in Google ParcelYard2027h1, entry 661,414,961
    SHA-256 68dcd620c90e89f5f73a75b310d58bca976d51335b61a24fa4bef540930c0000
    Public key SHA-256 80e0c931ce6af929dfe41d7f031fbfbf5050857d6124985bce1d4c8483a8233b
    Addresses
    104.21.84.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.194.43 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.84.147, 172.67.194.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gnavh.work
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  19. hitixa.digital US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    hitixa.digital
    First seen
    2026-11-07 14:21 UTC
    Listing
    CERT Polska listed it 2026-10-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:17 UTC to 2027-02-05 14:15 UTC
    Logged 2026-11-07 14:17 UTC in Geomys Tuscolo2027h1, entry 515,434,286
    SHA-256 38ea5492c184eeaf8bdfdc870c000e88e3477635548fb81a746a2a3718b1dd0c
    Public key SHA-256 009031e04089c29f5b770365f767705d398998636d959c79eaf49198e2e41824
    Addresses
    104.21.88.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.53 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.88.234, 172.67.154.53): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hitixa.digital
    Registered
    2026-09-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  20. ipfs.best-practice.se EU · AS1653 · Vetenskapsradet / SUNET2 addresses
    ReportedReported by PhishTankMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    ipfs.best-practice.se
    First seen
    2026-11-07 14:21 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 14:32 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-07 13:17 UTC to 2027-02-05 13:17 UTC
    Logged 2026-11-07 14:15 UTC in IPng Networks Halloumi2027h1, entry 400,029,904
    SHA-256 30861ec150b0ad7e14a3c96072bccc4bb310c38ca4682df37ca1cf76f04daa23
    Public key SHA-256 148f579f29243ecac0e52239111bf5257aa6c72211ed3fa496b5d16bd3827d00
    PhishTank
    PhishTank report #8133506
    Addresses
    193.11.118.5 · European Union · AS1653 SUNET - Vetenskapsradet / SUNET
    2001:6b0:30:1337:0:feed:babe:beef
    Domain
    best-practice.se
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:25 UTC

    Suggest a correction

  21. libertycrestfin.com US · AS32561 · Aquiryn LLC
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    libertycrestfin.com
    First seen
    2026-11-07 14:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 13:18 UTC to 2027-02-05 13:18 UTC
    Logged 2026-11-07 14:16 UTC in Google PlumbersArms2027h1, entry 661,769,193
    SHA-256 84330990da3d3760916cb1fdce78df02db798928430b6b40b17d95cb263f641b
    Public key SHA-256 ce2c7fb5e3a1c3640b6ae4e2da9d85ed21ac26c47a05c01039ae31da313a30e6
    PhishDestroy
    Addresses
    23.153.104.2 · United States · AS32561 AQUIRYN-LLC - Aquiryn LLC
    Domain
    libertycrestfin.com
    Registered
    2026-05-07 · TuringSign Inc. d/b/a Cosmotown
    MX
    Receives mail at libertycrestfin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  22. pdfparser-update.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    pdfparser-update.info
    First seen
    2026-11-07 14:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:18 UTC to 2027-02-05 14:15 UTC
    Logged 2026-11-07 14:18 UTC in DigiCert Wyvern2027h1, entry 442,347,853
    SHA-256 5723e09cf07371645132123d3c95314938d3208af4af18bb7f093aa8b6c65c79
    Public key SHA-256 cbd49c8c3d264ad6e10067fc43f4e6b13c9e4689f466f26a1d07c3134a009518
    Addresses
    104.21.33.136 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.190.29 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.136, 172.67.190.29): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pdfparser-update.info
    Registered
    2026-09-07 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  23. pheiravoltreksc.digital NL · AS62370 · Snel Snel.com B.V.
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    pheiravoltreksc.digital
    First seen
    2026-11-07 14:21 UTC
    First published
    2026-10-30 17:03 UTC
    Listing
    CERT Polska listed it 2026-07-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    DNS
    Resolves · checked 2026-11-06 17:13 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:18 UTC to 2027-02-05 13:18 UTC
    Logged 2026-11-07 14:16 UTC in Google PlumbersArms2027h1, entry 661,767,683
    SHA-256 68f07ed8279e2c1acac6b519041731dd796639449b6da743277eda609b276d73
    Public key SHA-256 94146a8f20f4afc0a06cdec6162eaff65b3654dbe88110a45690a1fb6d5d2d75
    PhishDestroy
    Addresses
    185.62.57.48 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    pheiravoltreksc.digital
    Registered
    2026-05-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:00 UTC

    Suggest a correction

  24. poly-preregister.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    poly-preregister.com
    First seen
    2026-11-07 14:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:17 UTC to 2027-02-05 13:17 UTC
    Logged 2026-11-07 14:16 UTC in Google PlumbersArms2027h1, entry 661,759,649
    SHA-256 225f1f80a56128d9df828c184e46e0e394107df801e2560caddddf8aca956088
    Public key SHA-256 8221141db51ce4569c55444e19a8c04032da5237f7eefa085b9a1c14fa55cf70
    Addresses
    104.21.91.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.87 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.158, 172.67.175.87): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    poly-preregister.com
    Registered
    2026-05-14 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  25. purstream.to US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    purstream.to
    First seen
    2026-11-07 14:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:18 UTC to 2027-02-05 14:16 UTC
    Logged 2026-11-07 14:18 UTC in Let's Encrypt Sycamore2027h1, entry 1,017,099,767
    SHA-256 a74fa4b1156f4c9fd8b3c83d754874cf0cc5487c65ce7ae54714a63e7f916dad
    Public key SHA-256 52d44af57735f8704b93077d2bd66f18b177f21d591a7df749cf830991f5c3e0
    PhishDestroy
    Addresses
    104.21.33.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.190.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.138, 172.67.190.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    purstream.to
    Registered
    2025-07-23 · NAMECHEAP
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  26. registration-laptoptoken.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    registration-laptoptoken.com
    First seen
    2026-11-07 14:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:19 UTC to 2027-02-05 14:18 UTC
    Logged 2026-11-07 14:19 UTC in IPng Networks Halloumi2027h1, entry 400,069,391
    SHA-256 de28fd981f9db9bad9fea7064e9a09f2af9493eb2cc252133403e8bfd7d0998f
    Public key SHA-256 108f91c07b388d8ef742f21939ebcab6426296891febd0c2227249842e573429
    Addresses
    104.21.68.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.197.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.182, 172.67.197.207): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    registration-laptoptoken.com
    Registered
    2026-09-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  27. worldcoin-operator.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC quarantineRegistered 10 mo ago
    DetailsHide
    Hostname
    worldcoin-operator.com
    First seen
    2026-11-07 14:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:17 UTC to 2027-02-05 14:16 UTC
    Logged 2026-11-07 14:17 UTC in Let's Encrypt Sycamore2027h1, entry 1,017,068,104
    SHA-256 6a22cfeaff0337abeac9974f56df9efd4eb0e794f0d069996a9bbcddbb05dd29
    Public key SHA-256 88760f1df9ec1dd630fd0189ed0195e5e49aa23713d5397fe2b934c4ac75af79
    Addresses
    104.21.65.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.58, 172.67.188.244): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    worldcoin-operator.com
    Registered
    2026-01-09 · Dynadot Inc
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  28. xuhjmbzd.yjsuoeng.jnvupmyq.pztcoqlu.ixyhmceu.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    xuhjmbzd.yjsuoeng.jnvupmyq.pztcoqlu.ixyhmceu.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-07 14:21 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 14:29 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:16 UTC to 2027-02-05 13:16 UTC
    Logged 2026-11-07 14:15 UTC in Google PlumbersArms2027h1, entry 661,751,869
    SHA-256 0c567e8664dc0891b4deb5ad566aafeb25f63e95e8a09e83a1d458b7713a8297
    Public key SHA-256 50b6ce15a69a0309e2435331f302955f8de2d11ac006db4f4ac01820d4df3b22
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-06 17:12 UTC

    Suggest a correction

  29. zyptorixappsolution-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    zyptorixappsolution-com.financecryptoworld.com
    First seen
    2026-11-07 14:21 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:17 UTC to 2027-02-05 14:17 UTC
    Logged 2026-11-07 14:17 UTC in DigiCert Wyvern2027h1, entry 442,342,265
    SHA-256 131d7219310d2ae9c6cc6912bec74aeff6077dc4874fb505823e8670fe396cd9
    Public key SHA-256 c28b95987308c61b3d4eea6e11582498eff492651c814c32c9ac2b4fec3d867b
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 17:12 UTC

    Suggest a correction

  30. www.instagram-spy.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…Instagram
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    www.instagram-spy.com
    First seen
    2026-11-07 14:18 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:07 UTC to 2027-02-05 13:07 UTC
    Logged 2026-11-07 14:06 UTC in Google ParcelYard2027h1, entry 661,303,194
    SHA-256 27c9684c069340594b93b7d1cea3bec33f3f18db7262cd232d5a019e42c47c33
    Public key SHA-256 31164476fc57a00dde4b71066c8810d408624b58bf87e44482c28785001fc9be
    Brand
    Instagram
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    instagram-spy.com
    Registered
    2026-08-16 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  31. instagram-spy.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…Instagram
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    instagram-spy.com
    First seen
    2026-11-07 14:18 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:07 UTC to 2027-02-05 13:07 UTC
    Logged 2026-11-07 14:06 UTC in Google ParcelYard2027h1, entry 661,303,194
    SHA-256 27c9684c069340594b93b7d1cea3bec33f3f18db7262cd232d5a019e42c47c33
    Public key SHA-256 31164476fc57a00dde4b71066c8810d408624b58bf87e44482c28785001fc9be
    Brand
    Instagram
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    instagram-spy.com
    Registered
    2026-08-16 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  32. app.oldschool.markets US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder oldschool.markets, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    app.oldschool.markets
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing oldschool.markets and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:12 UTC to 2027-02-05 13:12 UTC
    Logged 2026-11-07 14:10 UTC in Let's Encrypt Willow2027h1, entry 987,062,349
    SHA-256 25a202b51efc5d1ffbefb9fe9c14331be3c032d4c007aea2d637a218e934b157
    Public key SHA-256 b4ed2b90c3dcf761cce33ff7558591f26defd431802364c648f73f2a167b98b0
    PhishDestroy
    Addresses
    104.21.49.215 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.145 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.215, 172.67.193.145): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    oldschool.markets
    Registered
    2026-01-04 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:21 UTC

    Suggest a correction

  33. aprnw.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    aprnw.work
    First seen
    2026-11-07 14:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:14 UTC to 2027-02-05 13:14 UTC
    Logged 2026-11-07 14:13 UTC in Geomys Tuscolo2027h1, entry 515,393,114
    SHA-256 b76898c97a199a2cad3a67260b00205558c2da6fe5ec99255f04a1a7ec20c33e
    Public key SHA-256 bcf5d52601d5b2c21805aa1377c9020470d63ed139e0e25026dcbd8dc580e894
    Addresses
    104.21.26.19 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.135.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.26.19, 172.67.135.39): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aprnw.work
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  34. awytd.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    awytd.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    CERT Polska listed it 2026-05-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Let's Encrypt Willow2027h1, entry 987,057,455
    SHA-256 914aaa2fedad112acd88168df2d530760252ead60c8c8e4dd790b4d69b127577
    Public key SHA-256 b4bf8a503016d2e6f854dcb9b59601ac1e36d42b32acabb756c9b8e819343132
    Addresses
    104.21.66.140 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.204.133 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.140, 172.67.204.133): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    awytd.com
    Registered
    2026-05-14 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  35. cpanel.argentinaworldcup2026shop.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder argentinaworldcup2026shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    cpanel.argentinaworldcup2026shop.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing argentinaworldcup2026shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Google ParcelYard2027h1, entry 661,346,487
    SHA-256 837376e02e311c1c64998e171d4cc35401a505a7094bb473ccedfbb69c877353
    Public key SHA-256 f4147e5f05959ed829dbdf7d65e5f76b675b1104bd67685f436a4e233c0a6f91
    PhishDestroy
    Addresses
    104.21.10.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.168, 172.67.146.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    argentinaworldcup2026shop.com
    Registered
    2026-06-02 · EU Technology (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:23 UTC

    Suggest a correction

  36. cpcalendars.argentinaworldcup2026shop.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder argentinaworldcup2026shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    cpcalendars.argentinaworldcup2026shop.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing argentinaworldcup2026shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Google ParcelYard2027h1, entry 661,346,487
    SHA-256 837376e02e311c1c64998e171d4cc35401a505a7094bb473ccedfbb69c877353
    Public key SHA-256 f4147e5f05959ed829dbdf7d65e5f76b675b1104bd67685f436a4e233c0a6f91
    PhishDestroy
    Addresses
    104.21.10.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.168, 172.67.146.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    argentinaworldcup2026shop.com
    Registered
    2026-06-02 · EU Technology (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:23 UTC

    Suggest a correction

  37. cpcontacts.argentinaworldcup2026shop.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder argentinaworldcup2026shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    cpcontacts.argentinaworldcup2026shop.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing argentinaworldcup2026shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Google ParcelYard2027h1, entry 661,346,487
    SHA-256 837376e02e311c1c64998e171d4cc35401a505a7094bb473ccedfbb69c877353
    Public key SHA-256 f4147e5f05959ed829dbdf7d65e5f76b675b1104bd67685f436a4e233c0a6f91
    PhishDestroy
    Addresses
    104.21.10.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.168, 172.67.146.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    argentinaworldcup2026shop.com
    Registered
    2026-06-02 · EU Technology (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:23 UTC

    Suggest a correction

  38. eomunbss.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    eomunbss.xyz
    First seen
    2026-11-07 14:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:13 UTC to 2027-02-05 14:11 UTC
    Logged 2026-11-07 14:13 UTC in Geomys Tuscolo2027h1, entry 515,388,529
    SHA-256 9a04dffc317ac5585bd1136f8a98496938e4bda4a007ba6d393bb53bb7925d1b
    Public key SHA-256 2bbd1d7a9ab0ac3be0fe0adf976c62d3635e913f194248f004d92edfece2762f
    Addresses
    104.21.17.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.17.246, 172.67.178.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    eomunbss.xyz
    Registered
    2026-09-09 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  39. event-flarenetworks.xyz US · AS13335 · Cloudflare, Inc.4 addressesFlare Network
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    event-flarenetworks.xyz
    First seen
    2026-11-07 14:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:13 UTC to 2027-02-05 13:13 UTC
    Logged 2026-11-07 14:12 UTC in Geomys Tuscolo2027h1, entry 515,380,801
    SHA-256 5c02b4afa6dd1a6192200bf22d98a03abd63a8b8b5f420fdf563e76523b7f13f
    Public key SHA-256 0fb32e13a68b7470f4f18bb2693ec4aaa33cec58ab8313ae107287beadf513b3
    Brand
    Flare Network
    Addresses
    104.21.51.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b42a
    2606:4700:3037::6815:3376
    Cloudflare
    Cloudflare (104.21.51.118, 172.67.180.42): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    event-flarenetworks.xyz
    Registered
    2026-05-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:19 UTC

    Suggest a correction

  40. fcifu.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    fcifu.work
    First seen
    2026-11-07 14:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:14 UTC to 2027-02-05 13:14 UTC
    Logged 2026-11-07 14:12 UTC in Google ParcelYard2027h1, entry 661,375,478
    SHA-256 7e52fc1dff9ea9e482bc696fd23f7b191ef0a696691d7c48e51e1e97dd96b9d2
    Public key SHA-256 d141683a38778b4177f5600c54bb2a9a716c40c5748be777053b90e68b96f33f
    Addresses
    104.21.56.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.163 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.56.107, 172.67.184.163): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fcifu.work
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:20 UTC

    Suggest a correction

  41. hzxlkhf.com
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    hzxlkhf.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:13 UTC to 2027-02-05 14:12 UTC
    Logged 2026-11-07 14:13 UTC in DigiCert Wyvern2027h1, entry 442,303,228
    SHA-256 7a146274e6280714c9ba37db283696dcc40223fef3c1ecc40adc62270078c6a1
    Public key SHA-256 b628611960f78c5ebe6f83fc1a55e247ae8a35d39007eb0b45c67a8a9f63bc6c
    Domain
    hzxlkhf.com
    Registered
    2026-01-09 · Metaregistrar BV
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  42. idashopping.store
    ListedListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    idashopping.store
    First seen
    2026-11-07 14:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:11 UTC to 2027-02-05 14:07 UTC
    Logged 2026-11-07 14:11 UTC in DigiCert Wyvern2027h1, entry 442,282,106
    SHA-256 dee266544c42f55c7ae8ce6e87582de1704f5a6e7f37c25583a25fec78210a2e
    Public key SHA-256 c1d6469378b5614690163c9037964719ab659e3e853725b93a9346748574fb85
    Domain
    idashopping.store
    Registered
    2026-01-16 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  43. mail.argentinaworldcup2026shop.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder argentinaworldcup2026shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    mail.argentinaworldcup2026shop.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing argentinaworldcup2026shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Google ParcelYard2027h1, entry 661,346,487
    SHA-256 837376e02e311c1c64998e171d4cc35401a505a7094bb473ccedfbb69c877353
    Public key SHA-256 f4147e5f05959ed829dbdf7d65e5f76b675b1104bd67685f436a4e233c0a6f91
    PhishDestroy
    Addresses
    104.21.10.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.168, 172.67.146.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    argentinaworldcup2026shop.com
    Registered
    2026-06-02 · EU Technology (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:23 UTC

    Suggest a correction

  44. mfvyt.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    mfvyt.work
    First seen
    2026-11-07 14:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:14 UTC to 2027-02-05 13:14 UTC
    Logged 2026-11-07 14:13 UTC in Geomys Tuscolo2027h1, entry 515,390,216
    SHA-256 765b782ebb4594927cc6a16c0a6338df41aa7fd60972e96ff7edb7502ad19cce
    Public key SHA-256 0fedb92ff162cbe30e06d858af550dcfb9cd070553319a9809e70184cd024fe4
    Addresses
    104.21.69.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.19 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.69.247, 172.67.216.19): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mfvyt.work
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:20 UTC

    Suggest a correction

  45. openseaa.com US · AS14618 · Amazon.com, Inc.4 addresses
    ListedParking page · HugeDomainsListed by MetaMaskMX absentSPF -allDMARC missingRegistered today
    DetailsHide
    Hostname
    openseaa.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:14 UTC to 2027-02-05 13:14 UTC
    Logged 2026-11-07 14:13 UTC in Geomys Tuscolo2027h1, entry 515,388,668
    SHA-256 3077b66e77b93401bdc5f95b3435cb00c29190a7adb4f45f4ddabe7d98da6145
    Public key SHA-256 bd26fbffc6ebf31764f15da4567b64570cc946ad4bcfaf52ad4757104eba6ef0
    Addresses
    13.223.25.84 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    54.243.117.197 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    2600:1f18:4ae:c605:dd5d:b838:5816:d7fb
    2600:1f18:4ae:c606:78d4:4260:db4e:aeee
    Parking page · HugeDomains
    HugeDomains (13.223.25.84, 54.243.117.197): a parking service. It answers for names that are typically for sale or unused.
    Domain
    openseaa.com
    Registered
    2026-11-07 · DropCatch.com 1424 LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  46. tevekyros.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tevekyros.shop
    First seen
    2026-11-07 14:15 UTC
    Listing
    CERT Polska listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:13 UTC to 2027-02-05 13:13 UTC
    Logged 2026-11-07 14:12 UTC in DigiCert Wyvern2027h1, entry 442,291,462
    SHA-256 256b0432325fd9cfd17388f809de712c8464a68d44a8f5e5529e5c168ed677bc
    Public key SHA-256 8d1a4dc3fab69bd3532400477b367af888de2a8ee67330db7833787537946cb1
    Addresses
    104.21.89.202 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.41 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.89.202, 172.67.147.41): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevekyros.shop
    Registered
    2026-05-14 · Chengdu West Dimension Digital Technology Co., LTD
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  47. teveluxar.fit US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    teveluxar.fit
    First seen
    2026-11-07 14:15 UTC
    Listing
    CERT Polska listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:14 UTC to 2027-02-05 13:14 UTC
    Logged 2026-11-07 14:12 UTC in Google PlumbersArms2027h1, entry 661,715,876
    SHA-256 8fd8cfaa59751b3af4389517d3ec5847ae0272d8bb7eb349ff5c915310a5f841
    Public key SHA-256 4a853981e6dca78abcf1e16c8c0e8a98b76645eb9f4e632f74055700bd36c455
    Addresses
    104.21.49.241 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.241, 172.67.195.244): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    teveluxar.fit
    Registered
    2026-05-14 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  48. thebergsignal-gpt.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    thebergsignal-gpt.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    CERT Polska listed it 2026-09-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:12 UTC to 2027-02-05 14:10 UTC
    Logged 2026-11-07 14:12 UTC in IPng Networks Halloumi2027h1, entry 399,995,806
    SHA-256 0c17f320301941f1a3e81ce7c90de3df855157bc4c36cfc5ce10a66a426f5568
    Public key SHA-256 bbff217f2be1429ccb463583538843af13b1a13189742f69db929c4c4023d07d
    Addresses
    104.21.70.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.127 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.70.7, 172.67.217.127): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    thebergsignal-gpt.com
    Registered
    2026-09-09 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  49. thebergsignal-gpt.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    thebergsignal-gpt.org
    First seen
    2026-11-07 14:15 UTC
    Listing
    CERT Polska listed it 2026-09-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:12 UTC to 2027-02-05 14:10 UTC
    Logged 2026-11-07 14:12 UTC in Google ParcelYard2027h1, entry 661,371,066
    SHA-256 226d0d47988612ee4ab3ca3d3d9ad9020ef633779c1ce2dca9353d42778fad9e
    Public key SHA-256 03a890c1dba0f27761592cdf95958ca428fc7fa966fcb9ce8d3af642175f8458
    Addresses
    104.21.44.188 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.202.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.44.188, 172.67.202.225): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    thebergsignal-gpt.org
    Registered
    2026-09-09 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  50. vorleksy.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    vorleksy.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    USOM listed it 2026-06-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 14:29 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:13 UTC to 2027-02-05 13:13 UTC
    Logged 2026-11-07 14:12 UTC in IPng Networks Gouda2027h1, entry 344,244,085
    SHA-256 26f6adae51fb4129e16d32111d27bf54051c1f9907fa281ae57086e96de1eb76
    Public key SHA-256 98d5782ddfd845b485e26c95f3b2effab0d737ef000d629fa29a88044461ba59
    Addresses
    104.21.70.183 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.138.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.70.183, 172.67.138.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vorleksy.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:20 UTC

    Suggest a correction

  51. webdisk.argentinaworldcup2026shop.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder argentinaworldcup2026shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    webdisk.argentinaworldcup2026shop.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing argentinaworldcup2026shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Google ParcelYard2027h1, entry 661,346,487
    SHA-256 837376e02e311c1c64998e171d4cc35401a505a7094bb473ccedfbb69c877353
    Public key SHA-256 f4147e5f05959ed829dbdf7d65e5f76b675b1104bd67685f436a4e233c0a6f91
    PhishDestroy
    Addresses
    104.21.10.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.168, 172.67.146.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    argentinaworldcup2026shop.com
    Registered
    2026-06-02 · EU Technology (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:23 UTC

    Suggest a correction

  52. webmail.argentinaworldcup2026shop.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder argentinaworldcup2026shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    webmail.argentinaworldcup2026shop.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing argentinaworldcup2026shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Google ParcelYard2027h1, entry 661,346,487
    SHA-256 837376e02e311c1c64998e171d4cc35401a505a7094bb473ccedfbb69c877353
    Public key SHA-256 f4147e5f05959ed829dbdf7d65e5f76b675b1104bd67685f436a4e233c0a6f91
    PhishDestroy
    Addresses
    104.21.10.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.168, 172.67.146.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    argentinaworldcup2026shop.com
    Registered
    2026-06-02 · EU Technology (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:23 UTC

    Suggest a correction

  53. www.argentinaworldcup2026shop.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.argentinaworldcup2026shop.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Google ParcelYard2027h1, entry 661,346,487
    SHA-256 837376e02e311c1c64998e171d4cc35401a505a7094bb473ccedfbb69c877353
    Public key SHA-256 f4147e5f05959ed829dbdf7d65e5f76b675b1104bd67685f436a4e233c0a6f91
    PhishDestroy
    Addresses
    104.21.10.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.168, 172.67.146.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    argentinaworldcup2026shop.com
    Registered
    2026-06-02 · EU Technology (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:23 UTC

    Suggest a correction

  54. www.qrcode-free.com VG · AS40034 · Confluence Networks Inc
    ReportedParking page · Confluence NetworksUnder qrcode-free.com, reported by PhishDestroyMX absentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    www.qrcode-free.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing qrcode-free.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-11-07 00:00 UTC to 2027-02-05 23:59 UTC
    Logged 2026-11-07 14:14 UTC in Geomys Tuscolo2027h1, entry 515,407,211
    SHA-256 3f32f79a2208bc3db988ab5d86ab97b6148f75634ff99dfded4975ad3ecfa537
    Public key SHA-256 993fac94dbd4672fd35173a38231f602b3d596c8fca2c67f607d8810fedce7a8
    PhishDestroy
    Addresses
    208.91.197.46 · British Virgin Islands · AS40034 CONFLUENCE-NETWORK-INC - Confluence Networks Inc · Confluence Networks (parking page)
    Parking page · Confluence Networks
    Confluence Networks (208.91.197.46): a parking service. It answers for names that are typically for sale or unused.
    Domain
    qrcode-free.com
    Registered
    2025-11-02 · SNAPNAMES 80, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 12:16 UTC

    Suggest a correction

  55. xingxingmeiz.icu US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    xingxingmeiz.icu
    First seen
    2026-11-07 14:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:12 UTC to 2027-02-05 13:12 UTC
    Logged 2026-11-07 14:10 UTC in Google ParcelYard2027h1, entry 661,349,643
    SHA-256 388bb65ac6c66f7f9581ad5b4785ee432a9061509c92e72ab26a42d1d36fd85a
    Public key SHA-256 0851d5d9dc82647092d6bca07412f80c06ed840c72f57a69ecc5fad9b7507808
    Addresses
    104.21.65.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.194.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.234, 172.67.194.67): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xingxingmeiz.icu
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  56. xpybk.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    xpybk.com
    First seen
    2026-11-07 14:15 UTC
    Listing
    CERT Polska listed it 2026-05-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:13 UTC to 2027-02-05 13:13 UTC
    Logged 2026-11-07 14:11 UTC in Google PlumbersArms2027h1, entry 661,702,833
    SHA-256 82f37712090e48c0147e3f8fee9fa27a223f8d9eea709293fd4b3ee1b250384e
    Public key SHA-256 89bc9dc1d8c7ffbe574b08f4ed6dd8cf0034801600765f21474f9e40aa205442
    Addresses
    104.21.81.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.125 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.81.17, 172.67.137.125): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xpybk.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:20 UTC

    Suggest a correction

  57. xwxpt.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    xwxpt.net
    First seen
    2026-11-07 14:15 UTC
    Listing
    CERT Polska listed it 2026-05-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:10 UTC in Let's Encrypt Willow2027h1, entry 987,058,653
    SHA-256 91bff622a2597571e6d95318639455ad4da448616276ec2a36849693f567044c
    Public key SHA-256 e663b5c58aa32f22877ae4397612d30be2717dec49d6a25bc411bf4ed8ee3f82
    Addresses
    104.21.29.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.171.106 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.29.78, 172.67.171.106): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xwxpt.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:20 UTC

    Suggest a correction

  58. algo2uaxid.shop NL · AS62370 · Snel Snel.com B.V.
    ListedListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    algo2uaxid.shop
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-07-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:08 UTC to 2027-02-05 14:06 UTC
    Logged 2026-11-07 14:08 UTC in Let's Encrypt Sycamore2027h1, entry 1,016,832,702
    SHA-256 aa1aad40b05246bf6c1f69feacbeca0187349e206a2b6c338e3af37aac958eeb
    Public key SHA-256 648d5ec39f38b614e3807d44d689b20a569aee3bbfeb8338f5a37d09f657ccbd
    Addresses
    185.62.58.129 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    algo2uaxid.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:14 UTC

    Suggest a correction

  59. anvtasa.top US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by NPA 165 (e-commerce)MX absentSPF missingDMARC quarantineRegistered 12 mo ago
    DetailsHide
    Hostname
    anvtasa.top
    First seen
    2026-11-07 14:10 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-07 14:08 UTC to 2027-05-24 14:08 UTC
    Logged 2026-11-07 14:08 UTC in Sectigo Elephant2027h1, entry 764,454,785
    SHA-256 32c9c741ea75038ee55db5801df5ea27ad294615cca894ba906caf4a1d07b634
    Public key SHA-256 608f5eab9f060ea79b88896c8e2481f920c2d1bb621887195e68dcaff1de4650
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    anvtasa.top
    Registered
    2025-10-30 · GoDaddy.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  60. baliusdt.com US · AS22612 · Namecheap, Inc.
    ReportedNamecheapReported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    baliusdt.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV R36 · precertificate
    Valid 2026-11-07 00:00 UTC to 2027-05-23 23:59 UTC
    Logged 2026-11-07 14:07 UTC in Let's Encrypt Willow2027h1, entry 987,027,342
    SHA-256 4311bdb747210beb27e58f5abc21f0f719a0bb9d6d17703c1960d903a6e47966
    Public key SHA-256 16390406075806c463a2202ef14cc19b7d30834146b1176ee153c440096eefb0
    PhishDestroy
    Addresses
    209.74.67.39 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (209.74.67.39): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    baliusdt.com
    MX
    Receives mail at mx1-hosting.jellyfish.systems, mx2-hosting.jellyfish.systems, mx3-hosting.jellyfish.systems
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 14:14 UTC

    Suggest a correction

  61. bt.digiwebplatform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder digiwebplatform.com, listed by CERT PolskaMX presentMX on Spamhaus DROPSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    bt.digiwebplatform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing digiwebplatform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in Google PlumbersArms2027h1, entry 661,651,707
    SHA-256 0c868ea922c32ad0358c46bfa0879b631f33e2c9300056e842224d613a27aea8
    Public key SHA-256 a78d2391b16bf9a71d06810de18d9a88f078b9b0e35bf93c0747ee4da349a4b1
    Addresses
    104.21.81.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.158.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.81.85, 172.67.158.172): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    digiwebplatform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Receives mail at _dc-mx.912a68995319.digiwebplatform.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    MX listing
    Mail server _dc-mx.912a68995319.digiwebplatform.com at 86.54.25.112 is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-07 11:41 UTC

    Suggest a correction

  62. bt.official-platform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder official-platform.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    bt.official-platform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing official-platform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in Google PlumbersArms2027h1, entry 661,651,313
    SHA-256 1ef5d4c3b4d0adc0a4d384eb15a83bdc43087e6c3d4429622b758c49141efd70
    Public key SHA-256 e13187fe8375155b8d8e1eaea671d38ca115d82414fc6cb0ab222fc4c83cc6cd
    Addresses
    104.21.35.144 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.188 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.144, 172.67.175.188): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    official-platform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 21:34 UTC

    Suggest a correction

  63. bt.spot-site.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder spot-site.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    bt.spot-site.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing spot-site.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in IPng Networks Gouda2027h1, entry 344,213,538
    SHA-256 911e9e72c98e27be7428db40a5e163907d64e2bf5825e17bee7f4ba6826f33aa
    Public key SHA-256 efba0ee95b732a4977af50c6faf998ba6af91ca42b228b25855cc11879e25c10
    Addresses
    104.21.41.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.46 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.41.101, 172.67.164.46): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    spot-site.com
    Registered
    2026-04-16 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 04:34 UTC

    Suggest a correction

  64. bt.webaccessplatform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder webaccessplatform.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    bt.webaccessplatform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing webaccessplatform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in Let's Encrypt Willow2027h1, entry 987,023,555
    SHA-256 5c799fdad0203e9aabb74379edc3cb09eb6755fc2184e826d310934d1e36c087
    Public key SHA-256 3eb96395905012cb0dced6ec428284a827b6f5138b2af480638c373a7b8e927c
    Addresses
    104.21.6.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.139, 172.67.154.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    webaccessplatform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 12:50 UTC

    Suggest a correction

  65. cartiket.solteca.net US · AS29802 · HIVELOCITY, Inc.
    ListedUnder solteca.net, listed by MetaMaskMX absentSPF -allDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    cartiket.solteca.net
    First seen
    2026-11-07 14:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Listed
    MetaMask, listing solteca.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:06 UTC to 2027-02-05 13:06 UTC
    Logged 2026-11-07 14:05 UTC in Google ParcelYard2027h1, entry 661,286,170
    SHA-256 49ad3d0f7ff4e23cd92e9b2d37caec8f0de2897f8ba483f13524d5c27727ef1f
    Public key SHA-256 dac1c5f09b46b8f51108afb09a1519c504df83b612ae7a87808ca201121e1ad1
    Addresses
    178.236.183.98 · United States · AS29802 HVC-AS - HIVELOCITY, Inc.
    Domain
    solteca.net
    Registered
    2020-08-09 · Gandi SAS
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 00:41 UTC

    Suggest a correction

  66. electrohold.digiwebplatform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder digiwebplatform.com, listed by CERT PolskaMX presentMX on Spamhaus DROPSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    electrohold.digiwebplatform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing digiwebplatform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in Google PlumbersArms2027h1, entry 661,649,404
    SHA-256 14672d8896f5da04d0188feaad522d63d8d0d13109656ce4dc7dc28dfca7e151
    Public key SHA-256 45223b09be844c1312eb5039b12456b06ed19205e9536c8116004f1be300665d
    Addresses
    104.21.81.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.158.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.81.85, 172.67.158.172): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    digiwebplatform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Receives mail at _dc-mx.912a68995319.digiwebplatform.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    MX listing
    Mail server _dc-mx.912a68995319.digiwebplatform.com at 86.54.25.112 is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-07 11:41 UTC

    Suggest a correction

  67. electrohold.official-platform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder official-platform.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    electrohold.official-platform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing official-platform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in DigiCert Wyvern2027h1, entry 442,244,423
    SHA-256 aa517c19f01dde9441332b9761917110520bede421a2ee2ea5ea917b0d901c4d
    Public key SHA-256 28202137f95c4decda9e4ca76591a99437027229604c7909a22c0ef88939d1a8
    Addresses
    104.21.35.144 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.188 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.144, 172.67.175.188): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    official-platform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 21:34 UTC

    Suggest a correction

  68. electrohold.spot-site.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder spot-site.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    electrohold.spot-site.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing spot-site.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in Let's Encrypt Willow2027h1, entry 987,024,849
    SHA-256 24d9e18d4a69742b28cd00429642d8a013b006d9768eef61a6b01bf208a8f65b
    Public key SHA-256 2dfa5de44b39e996a76cc03dcb14c4fc156283817948ade40ecba9df1661ede2
    Addresses
    104.21.41.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.46 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.41.101, 172.67.164.46): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    spot-site.com
    Registered
    2026-04-16 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 04:34 UTC

    Suggest a correction

  69. electrohold.webaccessplatform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder webaccessplatform.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    electrohold.webaccessplatform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing webaccessplatform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in IPng Networks Gouda2027h1, entry 344,215,146
    SHA-256 0e1be27b7a223cea9e2b2b4d8a9afe4ae9983cc81b1dddcd226afdcdb3cd5f92
    Public key SHA-256 3c65696d6c9c1c1c234f3c5a7186f77856fdfd8c86911b3d55bb1b64369dc6af
    Addresses
    104.21.6.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.139, 172.67.154.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    webaccessplatform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 12:50 UTC

    Suggest a correction

  70. jacksonluwaile.icuprojects.online US · AS53667 · FranTech Solutions
    ReportedUnder icuprojects.online, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 57 d ago
    DetailsHide
    Hostname
    jacksonluwaile.icuprojects.online
    First seen
    2026-11-07 14:10 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-10-30 · still listed at the last successful feed check 2026-11-07 11:55 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-29 (4 days)
    Reported
    PhishDestroy, listing icuprojects.online and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:07 UTC to 2027-02-05 13:07 UTC
    Logged 2026-11-07 14:05 UTC in Google ParcelYard2027h1, entry 661,292,022
    SHA-256 28c886dca8a56fe9b529c6b953701106f65627d47e1ec104b1b41b1c676e4e85
    Public key SHA-256 35fa35144853eb9694faf1f2032586abc1506ec7fbc1de0eef05e05357fb3857
    PhishDestroy
    Addresses
    198.251.84.236 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    icuprojects.online
    Registered
    2026-09-11 · HOSTINGER operations, UAB
    MX
    Receives mail at mail.icuprojects.online
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:30 UTC

    Suggest a correction

  71. pfm.6jbs.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under 6jbs.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    pfm.6jbs.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask, listing 6jbs.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:07 UTC to 2027-02-05 13:07 UTC
    Logged 2026-11-07 14:06 UTC in Let's Encrypt Sycamore2027h1, entry 1,016,756,899
    SHA-256 203fdf31ab8dd8860397d9d3057c5530cea93a364bebc496025d6329cdd056f7
    Public key SHA-256 996b6779ae8e3603471cfa010b00e1c87c325502dc7972b1add60ed8d74ade2d
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    6jbs.com
    Registered
    2023-06-21 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 19:30 UTC

    Suggest a correction

  72. singpass.digiwebplatform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder digiwebplatform.com, listed by CERT PolskaMX presentMX on Spamhaus DROPSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    singpass.digiwebplatform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing digiwebplatform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in Google PlumbersArms2027h1, entry 661,649,360
    SHA-256 115b60ede745dfb4f061eaeeded56d5543a0c688a744f4437f37c5e407c65c95
    Public key SHA-256 e9f0875867bacd9e571ea0a68fcadb34332ce819b52f5fdfc35951fb7abe54b0
    Addresses
    104.21.81.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.158.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.81.85, 172.67.158.172): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    digiwebplatform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Receives mail at _dc-mx.912a68995319.digiwebplatform.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    MX listing
    Mail server _dc-mx.912a68995319.digiwebplatform.com at 86.54.25.112 is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-07 11:41 UTC

    Suggest a correction

  73. singpass.official-platform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder official-platform.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    singpass.official-platform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing official-platform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in Geomys Tuscolo2027h1, entry 515,335,080
    SHA-256 8d260676f931807797da8441d6afc5906a9e950ae66eaa20634e51302c3fabc7
    Public key SHA-256 22d85fc5e7ce4273c7c89a6d3dbf18eb4b977df2c6c6055a55ad1344b5ec146a
    Addresses
    104.21.35.144 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.188 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.144, 172.67.175.188): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    official-platform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 21:34 UTC

    Suggest a correction

  74. singpass.spot-site.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder spot-site.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    singpass.spot-site.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing spot-site.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:09 UTC to 2027-02-05 13:09 UTC
    Logged 2026-11-07 14:07 UTC in Let's Encrypt Willow2027h1, entry 987,026,981
    SHA-256 cb590ededaf0d2ca5b051d57f01b78dbe0c98587cb626041bfabb6de0a2893aa
    Public key SHA-256 1152dbc081c895c6b103c5b560fcb69a97b538930b7ff11feae48adfca47a16b
    Addresses
    104.21.41.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.46 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.41.101, 172.67.164.46): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    spot-site.com
    Registered
    2026-04-16 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 04:34 UTC

    Suggest a correction

  75. singpass.webaccessplatform.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder webaccessplatform.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    singpass.webaccessplatform.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska, listing webaccessplatform.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:07 UTC in Google PlumbersArms2027h1, entry 661,649,493
    SHA-256 0be76a3f81c7ace313031944c6d0275d3786f4e9a5cc79f43c0f8ed274b687dd
    Public key SHA-256 3058c1488710a88ce96fee1b1488833bc6261a4a40054a06f86105af24cf6a86
    Addresses
    104.21.6.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.139, 172.67.154.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    webaccessplatform.com
    Registered
    2026-04-16 · Dreamscape Networks International Pte Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 12:50 UTC

    Suggest a correction

  76. tynjk.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    tynjk.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    CERT Polska listed it 2026-05-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:10 UTC to 2027-02-05 13:10 UTC
    Logged 2026-11-07 14:08 UTC in IPng Networks Halloumi2027h1, entry 399,965,457
    SHA-256 dd574864329f091c7326dfb065fb86dc8230e190155ced40fa5998bf69161e64
    Public key SHA-256 9b9caf540f55391ef0f7ef4d362ab4b367788ebd01ba164eb846eadc9be73716
    Addresses
    104.21.78.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.219.19 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.78.90, 172.67.219.19): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tynjk.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:14 UTC

    Suggest a correction

  77. www.baliusdt.com US · AS22612 · Namecheap, Inc.
    ReportedNamecheapUnder baliusdt.com, reported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    www.baliusdt.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing baliusdt.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV R36 · precertificate
    Valid 2026-11-07 00:00 UTC to 2027-05-23 23:59 UTC
    Logged 2026-11-07 14:07 UTC in Let's Encrypt Willow2027h1, entry 987,027,342
    SHA-256 4311bdb747210beb27e58f5abc21f0f719a0bb9d6d17703c1960d903a6e47966
    Public key SHA-256 16390406075806c463a2202ef14cc19b7d30834146b1176ee153c440096eefb0
    PhishDestroy
    Addresses
    209.74.67.39 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (209.74.67.39): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    baliusdt.com
    MX
    Receives mail at mx1-hosting.jellyfish.systems, mx2-hosting.jellyfish.systems, mx3-hosting.jellyfish.systems
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 14:14 UTC

    Suggest a correction

  78. www.tweakelite.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder tweakelite.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    www.tweakelite.com
    First seen
    2026-11-07 14:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing tweakelite.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:11 UTC to 2027-02-05 13:11 UTC
    Logged 2026-11-07 14:09 UTC in Google ParcelYard2027h1, entry 661,339,423
    SHA-256 5d58025b7a0445f4105f05598bb61a367aeba2d517055497f70b27e69b5c2bdc
    Public key SHA-256 3adce31539f639ae29c1d44b1ae44510006b94eabbd6edfcf9d7b89835241d35
    PhishDestroy
    Addresses
    104.21.61.181 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.61.181, 172.67.212.158): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tweakelite.com
    Registered
    2021-04-11 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 07:26 UTC

    Suggest a correction

  79. xingxingmeiz.fun US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    xingxingmeiz.fun
    First seen
    2026-11-07 14:10 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:08 UTC to 2027-02-05 13:08 UTC
    Logged 2026-11-07 14:06 UTC in Let's Encrypt Sycamore2027h1, entry 1,016,778,811
    SHA-256 15d2820f43218d7f616bcc9e54dd24477d55d019ef0320f59e943e869d91060e
    Public key SHA-256 d6dc4a1c0b7a91c2334a62497d1aa67df51a489cf60592ada4ef306bf5e9c203
    Addresses
    104.21.5.136 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.133.127 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.5.136, 172.67.133.127): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xingxingmeiz.fun
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  80. yunyi.uk US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    yunyi.uk
    First seen
    2026-11-07 14:10 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 13:07 UTC to 2027-02-05 13:07 UTC
    Logged 2026-11-07 14:06 UTC in Google ParcelYard2027h1, entry 661,302,675
    SHA-256 4d6ec0cdc6561d10e05b4a7790644826e19df80f5b1ea109e3c605735c075170
    Public key SHA-256 0d98d25c7f2cd2be1218965480264827516a5a2b91d7fa93835ba227b600a088
    Addresses
    185.158.133.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (185.158.133.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    yunyi.uk
    Registered
    2026-05-14 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  81. www.trustwalletsupport.tech CY · AS47583 · AS-HOSTINGER Hostinger Inte…Trust Wallet
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 8 mo ago
    DetailsHide
    Hostname
    www.trustwalletsupport.tech
    First seen
    2026-11-07 14:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:06 UTC to 2027-02-05 13:06 UTC
    Logged 2026-11-07 14:05 UTC in Let's Encrypt Willow2027h1, entry 986,997,206
    SHA-256 8931ea551fbd8442552a74aa5e13b756aff5c8f7d3e5afe38c58d7da1dc70cad
    Public key SHA-256 b00734e7208eb4bf3e94cf62d7e2d6d5bdd459d33638dcc776a495c504ca8e8c
    Brand
    Trust Wallet
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    trustwalletsupport.tech
    Registered
    2026-03-03 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  82. trustwalletsupport.tech CY · AS47583 · AS-HOSTINGER Hostinger Inte…Trust Wallet
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 8 mo ago
    DetailsHide
    Hostname
    trustwalletsupport.tech
    First seen
    2026-11-07 14:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:06 UTC to 2027-02-05 13:06 UTC
    Logged 2026-11-07 14:05 UTC in Let's Encrypt Willow2027h1, entry 986,997,206
    SHA-256 8931ea551fbd8442552a74aa5e13b756aff5c8f7d3e5afe38c58d7da1dc70cad
    Public key SHA-256 b00734e7208eb4bf3e94cf62d7e2d6d5bdd459d33638dcc776a495c504ca8e8c
    Brand
    Trust Wallet
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    trustwalletsupport.tech
    Registered
    2026-03-03 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  83. spacex-mobile.de DE · AS24940 · HETZNER-AS Hetzner Online G…SpaceX
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC missing
    DetailsHide
    Hostname
    spacex-mobile.de
    First seen
    2026-11-07 14:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 144.76.59.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 144.76.59.138
    Certificate
    Issued by YR2
    Valid 2026-11-07 13:06 UTC to 2027-02-05 13:06 UTC
    Logged 2026-11-07 14:04 UTC in Google ParcelYard2027h1, entry 661,282,543
    SHA-256 d2cf8c4c7ffdb4b5df687d5ab6ed7c6e0d2ac452a824773c69fd8fa7a4990196
    Public key SHA-256 51608c3b67dc2d702d5414f2300b7360fe0ac5a45d2a496357506a4098cacd5f
    Brand
    SpaceX
    Addresses
    144.76.59.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (144.76.59.138): a cloud provider. It rents servers and addresses to its customers.
    Domain
    spacex-mobile.de
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  84. spacexmobile.de DE · AS24940 · HETZNER-AS Hetzner Online G…SpaceX
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC missing
    DetailsHide
    Hostname
    spacexmobile.de
    First seen
    2026-11-07 14:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 144.76.59.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 144.76.59.138
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-07 13:06 UTC to 2027-02-05 13:06 UTC
    Logged 2026-11-07 14:04 UTC in IPng Networks Halloumi2027h1, entry 399,935,286
    SHA-256 e3ab58d5f7cede7e4aef030e9d22f3a12dd24c500aa1cd25f47055067154d6cd
    Public key SHA-256 566e5697c602c237300ce775687e53c0854b6db8ecd3c907383e5e9a757a9993
    Brand
    SpaceX
    Addresses
    144.76.59.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (144.76.59.138): a cloud provider. It rents servers and addresses to its customers.
    Domain
    spacexmobile.de
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  85. blurapp.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    blurapp.net
    First seen
    2026-11-07 14:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:00 UTC to 2027-02-05 14:00 UTC
    Logged 2026-11-07 14:00 UTC in IPng Networks Halloumi2027h1, entry 399,900,509
    SHA-256 0c9bef2f14808fbaf0afb5f0a9fed548a755a746509699a1742b9b91dcd81b90
    Public key SHA-256 6151255cb1c6f2246fd00121f847c44a34a790aeb4064d7e032c99e15fa6157f
    PhishDestroy
    Addresses
    104.21.28.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.52 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.28.132, 172.67.146.52): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    blurapp.net
    Registered
    2025-01-27 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  86. cdn-stg.rapspoint.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder rapspoint.com, reported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 3 y ago
    DetailsHide
    Hostname
    cdn-stg.rapspoint.com
    First seen
    2026-11-07 14:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy, listing rapspoint.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 13:05 UTC to 2027-02-05 14:03 UTC
    Logged 2026-11-07 14:05 UTC in Let's Encrypt Sycamore2027h1, entry 1,016,735,017
    SHA-256 9b6f816d6837edaded8f5704eef3c6ff9927faefe21c5ca67de03b4e494734e1
    Public key SHA-256 dd52b3c5b00153e2b591a30e77cd571ca7f7bcc0fc223fb6c2d22ba5f0fdc046
    PhishDestroy
    Addresses
    104.21.44.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.22 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.44.49, 172.67.195.22): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rapspoint.com
    Registered
    2023-12-11 · HOSTINGER operations, UAB
    MX
    Receives mail at mx.rapsmajubersama.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-06 17:50 UTC

    Suggest a correction

  87. destoronexia.click NL · AS62370 · Snel Snel.com B.V.
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    destoronexia.click
    First seen
    2026-11-07 14:05 UTC
    Listing
    CERT Polska listed it 2026-07-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:03 UTC to 2027-02-05 13:03 UTC
    Logged 2026-11-07 14:02 UTC in Google PlumbersArms2027h1, entry 661,587,844
    SHA-256 38e363a482129c812ca2083fa502b8e91c84eca09ba0395f4e81f769923a0686
    Public key SHA-256 0655bf665728e561052e8f3b2f6293fde2ba66134039cdbd3c83df29933c1c27
    Addresses
    185.62.58.179 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    destoronexia.click
    Registered
    2026-05-14 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  88. hotitly.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    hotitly.shop
    First seen
    2026-11-07 14:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-07 13:54 UTC to 2027-02-05 14:03 UTC
    Logged 2026-11-07 14:04 UTC in DigiCert Wyvern2027h1, entry 442,224,268
    SHA-256 ea4449c10d9d273739549e557575495be237c8c8c09cc5de8a27d79fbdadf903
    Public key SHA-256 cd6058d8caa4468d597738bc32778b06fa2e925f9e807adfd4d3481d86bbcfa8
    Addresses
    104.21.67.212 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.181.95 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.67.212, 172.67.181.95): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hotitly.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  89. hvtcc.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    hvtcc.work
    First seen
    2026-11-07 14:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 13:01 UTC to 2027-02-05 13:01 UTC
    Logged 2026-11-07 14:00 UTC in Let's Encrypt Willow2027h1, entry 986,939,489
    SHA-256 586ca9bfb22ad1db8c6d3a2b272ab74475a619791735d2355ab81b09e07395bf
    Public key SHA-256 f27cb938e2efad4a64cc999c10fe8dca3a09cbf75bb8e4be10d32a266e499ee8
    Addresses
    104.21.10.36 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.36, 172.67.189.229): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hvtcc.work
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  90. kayundesigns.uk US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    kayundesigns.uk
    First seen
    2026-11-07 14:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:06 UTC to 2027-02-05 13:06 UTC
    Logged 2026-11-07 14:04 UTC in DigiCert Sphinx2027h1, entry 390,953,338
    SHA-256 9aba31637b6ae23203ebd07b0e3eec1324ca3749e5aa9eb0adc6934cdd2dc519
    Public key SHA-256 d58df7092a005fb0863ec5b5e1b29558245f426dbeedad3841a47c22fd827b4c
    Addresses
    185.158.133.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (185.158.133.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kayundesigns.uk
    Registered
    2026-05-14 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  91. longchamp-eu.com US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    longchamp-eu.com
    First seen
    2026-11-07 14:05 UTC
    Listing
    CERT Polska listed it 2026-05-08 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:03 UTC to 2027-02-05 13:03 UTC
    Logged 2026-11-07 14:01 UTC in Geomys Tuscolo2027h1, entry 515,282,561
    SHA-256 5e3eccbe2f7f11f01b20c6543e42abafb29fd95f7d4c7cbbde441d595744c394
    Public key SHA-256 b3064f61987aecb3dc40c261ab39f8e210221aa7b9dd139dab8706da4efe020b
    Addresses
    104.18.12.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.12.234): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    longchamp-eu.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  92. norqelaxisai.pro NL · AS62370 · Snel Snel.com B.V.
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    norqelaxisai.pro
    First seen
    2026-11-07 14:05 UTC
    Listing
    CERT Polska listed it 2026-07-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:01 UTC to 2027-02-05 13:59 UTC
    Logged 2026-11-07 14:01 UTC in IPng Networks Halloumi2027h1, entry 399,907,208
    SHA-256 0ff8bfdef21227b45c2500dee8e6983cba5a174d945895cd0c85b415cd24cd88
    Public key SHA-256 c4dd046accf22994a3cd790ab5adaed41807050ac991c4732399b2180aae3f6c
    Addresses
    185.62.58.179 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    norqelaxisai.pro
    Registered
    2026-07-12 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  93. secure-spacex.comSpaceX
    ListedListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    secure-spacex.com
    First seen
    2026-11-07 14:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 13:00 UTC to 2027-02-05 13:58 UTC
    Logged 2026-11-07 14:00 UTC in Let's Encrypt Sycamore2027h1, entry 1,016,628,841
    SHA-256 33cd239560838188047c7db3e6e6171f49ddc26101169f08708d6048db29ad8d
    Public key SHA-256 272abe112121a561651b22aa2b8b320c22420a4ba0df90175855f2a5510de9cb
    Brand
    SpaceX
    Domain
    secure-spacex.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  94. sgpxj.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    sgpxj.work
    First seen
    2026-11-07 14:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 13:03 UTC to 2027-02-05 13:03 UTC
    Logged 2026-11-07 14:02 UTC in IPng Networks Gouda2027h1, entry 344,189,162
    SHA-256 03e62025d15bc491d79d10309349a5bbfa34ac32c30804f26d162ac9050a0bdc
    Public key SHA-256 6de8356b1de529ca9f9a3607e5d6776c46da011744076c1e5c114170500b9720
    Addresses
    104.21.14.16 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.133.192 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.14.16, 172.67.133.192): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sgpxj.work
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:09 UTC

    Suggest a correction

  95. usdv.free.staging-site.org HK · AS9269 · Hong Kong Broadband Network…2 addresses
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    usdv.free.staging-site.org
    First seen
    2026-11-07 14:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 11:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-07 13:04 UTC to 2027-02-05 13:04 UTC
    Logged 2026-11-07 14:03 UTC in Geomys Tuscolo2027h1, entry 515,295,489
    SHA-256 4fc5c5dee89da337437c84d1f285e992f855a83e2556c503bdf494fb4fcd2ea9
    Public key SHA-256 9da9e36860c1440f89db120cb103038c5744dd6ac4ff817bc2ccddbb77bc4b5c
    PhishDestroy
    Addresses
    119.246.11.150 · Hong Kong · AS9269 HKBN-AS-AP - Hong Kong Broadband Network Ltd.
    2002:77f6:b96:1:be24:11ff:fe96:6628
    Domain
    staging-site.org
    Registered
    2024-05-23 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  96. www.charlesschwab.us.com US · AS22612 · Namecheap, Inc.Charles Schwab
    Phishing hostNamecheapAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    www.charlesschwab.us.com
    First seen
    2026-11-07 14:03 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 66.29.148.190.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 66.29.148.190
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-07 12:55 UTC to 2027-02-05 12:55 UTC
    Logged 2026-11-07 13:54 UTC in Let's Encrypt Sycamore2027h1, entry 1,016,494,352
    SHA-256 79b4136ae2263a676446204c2870a937d255d4a73994f75a14268b0e61ceefdf
    Public key SHA-256 da62db74d9e47bd6cf980e6b6f2389e103908fd2279fb498bd33b27cefde6cd8
    Brand
    Charles Schwab
    Addresses
    66.29.148.190 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (66.29.148.190): shared web hosting and domain registration. One address typically serves many customer sites.

    Suggest a correction

  97. charlesschwab.us.com US · AS22612 · Namecheap, Inc.Charles Schwab
    Phishing hostNamecheapAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    charlesschwab.us.com
    First seen
    2026-11-07 14:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 66.29.148.190.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 66.29.148.190
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-07 12:55 UTC to 2027-02-05 12:55 UTC
    Logged 2026-11-07 13:54 UTC in Let's Encrypt Sycamore2027h1, entry 1,016,494,352
    SHA-256 79b4136ae2263a676446204c2870a937d255d4a73994f75a14268b0e61ceefdf
    Public key SHA-256 da62db74d9e47bd6cf980e6b6f2389e103908fd2279fb498bd33b27cefde6cd8
    Brand
    Charles Schwab
    Addresses
    66.29.148.190 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (66.29.148.190): shared web hosting and domain registration. One address typically serves many customer sites.

    Suggest a correction

  98. breakthroughentrepreneurialecosystem.cryptopayment.xyz US · AS14061 · DigitalOcean, LLC
    ListedDigitalOceanUnder cryptopayment.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    breakthroughentrepreneurialecosystem.cryptopayment.xyz
    First seen
    2026-11-07 14:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 11:56 UTC
    Listed
    MetaMask, listing cryptopayment.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 13:01 UTC to 2027-02-05 13:01 UTC
    Logged 2026-11-07 13:59 UTC in IPng Networks Gouda2027h1, entry 344,177,418
    SHA-256 a7b2a49277401059256db0f8e1e2092c4a5f78b31d7e50728f66c108dece14f1
    Public key SHA-256 f2a665567bc882465f68bdcd95e6f11e9fc61d9cc75492d72d8a5bd17ba72546
    Addresses
    143.244.211.82 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (143.244.211.82): a cloud provider. It rents servers and addresses to its customers.
    Domain
    cryptopayment.xyz
    Registered
    2020-11-20 · Interstellar Registrar Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 17:12 UTC

    Suggest a correction

  99. fortefondeza-app.digital NL · AS62370 · Snel Snel.com B.V.
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    fortefondeza-app.digital
    First seen
    2026-11-07 14:00 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 12:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-07 13:48 UTC to 2027-02-05 13:57 UTC
    Logged 2026-11-07 13:58 UTC in DigiCert Sphinx2027h1, entry 390,921,084
    SHA-256 4cceabf66d0667654346339515ff161f010281c66d15dbd9da25b23f2f5f0d74
    Public key SHA-256 1b7cacc5dc91325cc2f91b35a5c555b19386750dad23d7725ce59de2cebf3b4d
    Addresses
    185.62.58.179 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    fortefondeza-app.digital
    Registered
    2026-07-12 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  100. liyue02.buzz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    liyue02.buzz
    First seen
    2026-11-07 14:00 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 12:58 UTC to 2027-02-05 12:58 UTC
    Logged 2026-11-07 13:57 UTC in Google PlumbersArms2027h1, entry 661,524,947
    SHA-256 b3338f97fcefc2bf22ecf40d9f9a75d66024307df32fb3977f3a4ebaf17f008e
    Public key SHA-256 9a752aad9c7485f627c0227538d7ed7500108904b5a3ff64b6a7f933973f682b
    Addresses
    104.21.19.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.19.184, 172.67.187.147): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    liyue02.buzz
    Registered
    2026-05-12 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

Showing 1–100 of 6,046 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources