Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-07 21:16 UTC
Certificate-log entries · 24 h
314.7M
from 84 distinct feeds
Unique certificates · 24 h
30.7M
each reviewed
Names resolved · 24 h
19.7M
14.5M with an address
Findings · 24 h
6,086
213 of 1,061 brands targeted

6,086 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. cekiliskampanyasi.online SC · AS403005 · Blatant
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    cekiliskampanyasi.online
    First seen
    2026-11-07 21:15 UTC
    Listing
    USOM listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:14 UTC to 2027-02-05 20:13 UTC
    Logged 2026-11-07 21:12 UTC in Geomys Tuscolo2027h1, entry 519,352,897
    SHA-256 620198a4868e70c3867af28650f8bdd575a453d82a1c41d82a09392360b3a5aa
    Public key SHA-256 e1580542d767e2d2173fff7229462dd913869dc49b96fe71e3b8f8e45ccfd5f3
    Addresses
    64.89.160.49 · Seychelles · AS403005 BLATANTHOST - Blatant
    Domain
    cekiliskampanyasi.online
    Registered
    2026-09-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  2. europeancryptounionplatform.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    europeancryptounionplatform.com
    First seen
    2026-11-07 21:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-04 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 20:15 UTC to 2027-02-05 20:15 UTC
    Logged 2026-11-07 21:14 UTC in Google ParcelYard2027h1, entry 666,483,952
    SHA-256 2936c3fa338ca1f6a72963f5bf06360ca29d1734da35fdc8fecfe43edfb9066e
    Public key SHA-256 eb98f5b04ef61311977b6251a6b756bd808ff5b918eb64e00cff996554ec8c06
    Addresses
    104.21.92.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.55 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:5c94
    2606:4700:3035::ac43:c337
    Cloudflare
    Cloudflare (104.21.92.148, 172.67.195.55): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    europeancryptounionplatform.com
    Registered
    2026-05-14 · Realtime Register B.V.
    MX
    Receives mail at _dc-mx.dda0c4047525.europeancryptounionplatform.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  3. ferro-protocol.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    ferro-protocol.com
    First seen
    2026-11-07 21:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:16 UTC to 2027-02-05 20:16 UTC
    Logged 2026-11-07 21:15 UTC in DigiCert Wyvern2027h1, entry 445,910,538
    SHA-256 c93e090ebc721db395778190cccce95f6828f0dbbd1070fd758f4a01f829bb96
    Public key SHA-256 e6d98958c48ed2bf9b1b202ad0b5eab9dcbff1b192df0e9be239fbd63003eee7
    Addresses
    104.21.35.41 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.46 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:d52e
    2606:4700:3037::6815:2329
    Cloudflare
    Cloudflare (104.21.35.41, 172.67.213.46): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ferro-protocol.com
    Registered
    2026-04-09 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  4. institutoaliancadobem.org
    ReportedReported by PhishDestroyMX presentSPF all omittedDMARC missingRegistered today
    DetailsHide
    Hostname
    institutoaliancadobem.org
    First seen
    2026-11-07 21:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:12 UTC to 2027-02-05 20:12 UTC
    Logged 2026-11-07 21:11 UTC in Let's Encrypt Sycamore2027h1, entry 1,026,359,734
    SHA-256 9ac8dfb4c48c94d0a7a8b8df543b8d8dc8e90fd94440c6a31efa77f2cd9341a0
    Public key SHA-256 6ce00572e33ea3bf2433a14a1b5d380a591f1b1b4279475cf40be17bdf267952
    PhishDestroy
    Domain
    institutoaliancadobem.org
    Registered
    2026-11-07 · Cloudflare, Inc.
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  5. kampanyali-cekilisin.online SC · AS403005 · Blatant
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    kampanyali-cekilisin.online
    First seen
    2026-11-07 21:15 UTC
    Listing
    USOM listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:12 UTC to 2027-02-05 20:12 UTC
    Logged 2026-11-07 21:10 UTC in DigiCert Sphinx2027h1, entry 394,246,425
    SHA-256 600e1899c308ec4e046578f060650146d7f90379c6da22c38b03aca8a44a431d
    Public key SHA-256 8b02e2cb2d4776f983bef58a65d59346dacec3b96d3a0af21db2b31d3c2f41e4
    Addresses
    64.89.160.49 · Seychelles · AS403005 BLATANTHOST - Blatant
    Domain
    kampanyali-cekilisin.online
    Registered
    2026-09-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  6. sponsorlu-cekilis-kura.online SC · AS403005 · Blatant
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    sponsorlu-cekilis-kura.online
    First seen
    2026-11-07 21:15 UTC
    Listing
    USOM listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:13 UTC to 2027-02-05 21:12 UTC
    Logged 2026-11-07 21:13 UTC in Let's Encrypt Willow2027h1, entry 992,061,343
    SHA-256 ec465db135b7a48458feb13b4d0596f2678c3de1e6aa64e99d526942b1109453
    Public key SHA-256 51c3562b36d5226896a6665e5521366055117e02cc3a175ac00ab4c12d05c99e
    Addresses
    64.89.160.46 · Seychelles · AS403005 BLATANTHOST - Blatant
    Domain
    sponsorlu-cekilis-kura.online
    Registered
    2026-09-09 · Unstoppable Domains, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  7. www.exchangeio.ink US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder exchangeio.ink, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.exchangeio.ink
    First seen
    2026-11-07 21:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing exchangeio.ink and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 20:10 UTC to 2027-02-05 21:07 UTC
    Logged 2026-11-07 21:10 UTC in Let's Encrypt Willow2027h1, entry 992,025,151
    SHA-256 5efb8e07bac63f9d71b437387fe3bb0a241359f575e37e83685e17dceb681d90
    Public key SHA-256 bbb2b5cab9f76b1b2944cb096dea88e1553bca04b5078426efa201901f5f33d6
    Addresses
    104.21.39.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:27fd
    2606:4700:3036::ac43:acd5
    Cloudflare
    Cloudflare (104.21.39.253, 172.67.172.213): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exchangeio.ink
    Registered
    2026-05-14 · NameMart Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  8. aeroxyz.click US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    aeroxyz.click
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:08 UTC to 2027-02-05 21:06 UTC
    Logged 2026-11-07 21:08 UTC in IPng Networks Halloumi2027h1, entry 403,586,030
    SHA-256 5f278ea634d4c69bdfa603e7e64d64b968d776c149b83b9213d1f51922fa0c25
    Public key SHA-256 883475fc9e7069fce5e8a9811254b364cc3b5cd84e2e60463b0629b09844cbcf
    Addresses
    104.21.53.73 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.96 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.73, 172.67.210.96): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aeroxyz.click
    Registered
    2026-09-09 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  9. brokerfarm.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    brokerfarm.live
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:06 UTC to 2027-02-05 21:04 UTC
    Logged 2026-11-07 21:06 UTC in Google PlumbersArms2027h1, entry 666,707,964
    SHA-256 7b61fd1c9afa83e7aaf14e1e5d8085bcc751b69edc87e6497318d5a0402b7172
    Public key SHA-256 0c5255b8126b9436bd1c1a7d8a701ad58423d181178897b5501815aec54a9087
    Addresses
    104.21.27.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.169.201 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.27.225, 172.67.169.201): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    brokerfarm.live
    Registered
    2026-09-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  10. cashcat-robinhd.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    cashcat-robinhd.xyz
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-09 19:22 UTC to 2026-12-08 20:21 UTC
    Logged 2026-11-07 21:08 UTC in DigiCert Wyvern2026h2, entry 2,210,849,802
    SHA-256 1b4ce6ba064cd962cff0d05cc3278bdefe530a415fc735e2f4a406a8c79d33fd
    Public key SHA-256 fd9e4899db9a4e9f027f7da3a7d8879ed5efc6f5cd16efbf4f86e54d5ae1a909
    Addresses
    104.21.60.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.203.144 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.60.251, 172.67.203.144): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cashcat-robinhd.xyz
    Registered
    2026-07-12 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  11. claim-pixelcoin.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    claim-pixelcoin.cc
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 20:10 UTC to 2027-02-05 20:10 UTC
    Logged 2026-11-07 21:09 UTC in Google PlumbersArms2027h1, entry 666,745,968
    SHA-256 e849bc6db74c701a7ee67daed5e35580debb168ff6ff83d5a89c6ba46213bf0c
    Public key SHA-256 86f1a42179bf4b944a72cdd410bf86813493c204c1456d837dc394f568d01278
    Addresses
    104.21.68.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.51 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.225, 172.67.199.51): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    claim-pixelcoin.cc
    Registered
    2026-05-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:14 UTC

    Suggest a correction

  12. cumbregananciosoftware.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    cumbregananciosoftware.com
    First seen
    2026-11-07 21:10 UTC
    Listing
    CERT Polska listed it 2026-09-23 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:08 UTC to 2027-02-05 21:07 UTC
    Logged 2026-11-07 21:08 UTC in Google PlumbersArms2027h1, entry 666,730,542
    SHA-256 5b6fbf6c634f9cd9f0c7972ff6654883043a2548a96da0b0a516575977836e82
    Public key SHA-256 52d01398fb574b5a31d7e5a80ee926c6eb548358de6eeb8f41d3e3c54d6e31d0
    Addresses
    104.21.53.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.100 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.62, 172.67.209.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cumbregananciosoftware.com
    Registered
    2026-02-22 · MainReg Inc.
    MX
    Receives mail at mail.cumbregananciosoftware.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  13. dan.wallet-us.app DE · AS210558 · services-1337-gmbh 1337 Ser…
    ListedUnder wallet-us.app, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    dan.wallet-us.app
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing wallet-us.app and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 20:07 UTC to 2027-02-05 20:07 UTC
    Logged 2026-11-07 21:06 UTC in Google ParcelYard2027h1, entry 666,373,416
    SHA-256 c07b6a7e35da2b9f7ad365b0137ba7be7adb544dfca81ad527219571f8c97bb4
    Public key SHA-256 68453e9238985a7f4f6efd67963917ebf8010209993497be86784e5f8f23ff8d
    Addresses
    185.241.208.171 · Germany · AS210558 services-1337-gmbh 1337 Services GmbH
    Domain
    wallet-us.app
    Registered
    2026-09-08 · OwnRegistrar Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 03:00 UTC

    Suggest a correction

  14. dev.nextcloud.hfelge.de DE · AS24940 · HETZNER-AS Hetzner Online G…
    ListedHetznerUnder hfelge.de, listed by MetaMaskMX presentSPF missingDMARC quarantine
    DetailsHide
    Hostname
    dev.nextcloud.hfelge.de
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing hfelge.de and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 20:07 UTC to 2027-02-05 20:07 UTC
    Logged 2026-11-07 21:06 UTC in Google PlumbersArms2027h1, entry 666,705,370
    SHA-256 19035a32510e7eaff3798d17b2155de5b8eaad5fd7465968983c1940244ae9fd
    Public key SHA-256 932acd3c35243f8a96f1794751f18cd6a2333bb4f632d921f8d50c634aa94951
    Addresses
    95.216.215.161 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (95.216.215.161): a cloud provider. It rents servers and addresses to its customers.
    Domain
    hfelge.de
    MX
    Receives mail at mx03.secure-mailgate.com, mx04.secure-mailgate.com
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-07 20:13 UTC

    Suggest a correction

  15. exchangeio.ink US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    exchangeio.ink
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 20:08 UTC to 2027-02-05 21:05 UTC
    Logged 2026-11-07 21:08 UTC in Google PlumbersArms2027h1, entry 666,734,780
    SHA-256 0f2dcf78c040c82013727f97d30642bf92dadace987d0f3708480316c75f2faa
    Public key SHA-256 7c6dbda78ec53df65ef4345a61b0b8d5a9fd7e5634ad97639312cbb2c3a5b9dd
    Addresses
    104.21.39.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.39.253, 172.67.172.213): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exchangeio.ink
    Registered
    2026-05-14 · NameMart Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  16. exchangeio.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    exchangeio.net
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 20:09 UTC to 2027-02-05 21:06 UTC
    Logged 2026-11-07 21:09 UTC in Google PlumbersArms2027h1, entry 666,751,679
    SHA-256 1e26d07a0338020106235a14989d7ae3504f003cd21e0c1584f7ab105091ab48
    Public key SHA-256 ebbba92dfd823d8fd001736c61b77fdb87acb9f071d75c5d30ea082ba385472f
    Addresses
    104.21.33.196 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.196, 172.67.149.25): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exchangeio.net
    Registered
    2026-05-14 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  17. golkarbulukumba.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF missingDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    golkarbulukumba.com
    First seen
    2026-11-07 21:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 20:07 UTC to 2027-02-05 20:07 UTC
    Logged 2026-11-07 21:06 UTC in Google PlumbersArms2027h1, entry 666,706,894
    SHA-256 7749d357edc02db0fc73fc7cd5a1f7c32f211938463e568a5f56bc657ee0fa04
    Public key SHA-256 1ed7a931dbce3b1ed70caf26db088dd674fbad25916f37da1043c188e57dbc89
    PhishDestroy
    Addresses
    104.21.51.28 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.220.4 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.28, 172.67.220.4): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    golkarbulukumba.com
    Registered
    2025-08-11 · Gname.com Pte. Ltd.
    MX
    Receives mail at ghs.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  18. m-obilet.org
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    m-obilet.org
    First seen
    2026-11-07 21:10 UTC
    Listing
    USOM listed it 2026-06-05 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 20:10 UTC to 2027-02-05 20:10 UTC
    Logged 2026-11-07 21:09 UTC in Google PlumbersArms2027h1, entry 666,745,741
    SHA-256 18ee5c91de9aa0ef963ac69b1790b32bf8b80b32b5bd909ad9ffeb0d0593a567
    Public key SHA-256 4b56b45c3fb62fd05809bdfa653445b897da5b87e54e4622a1b347dbd50e8fe4
    Domain
    m-obilet.org
    Registered
    2026-05-14 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  19. www.exchangeio.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder exchangeio.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.exchangeio.net
    First seen
    2026-11-07 21:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing exchangeio.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 20:09 UTC to 2027-02-05 21:06 UTC
    Logged 2026-11-07 21:09 UTC in Google PlumbersArms2027h1, entry 666,751,679
    SHA-256 1e26d07a0338020106235a14989d7ae3504f003cd21e0c1584f7ab105091ab48
    Public key SHA-256 ebbba92dfd823d8fd001736c61b77fdb87acb9f071d75c5d30ea082ba385472f
    Addresses
    104.21.33.196 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.196, 172.67.149.25): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exchangeio.net
    Registered
    2026-05-14 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  20. www.golkarbulukumba.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder golkarbulukumba.com, reported by PhishDestroyMX presentSPF missingDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    www.golkarbulukumba.com
    First seen
    2026-11-07 21:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing golkarbulukumba.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 20:07 UTC to 2027-02-05 20:07 UTC
    Logged 2026-11-07 21:06 UTC in Google PlumbersArms2027h1, entry 666,706,894
    SHA-256 7749d357edc02db0fc73fc7cd5a1f7c32f211938463e568a5f56bc657ee0fa04
    Public key SHA-256 1ed7a931dbce3b1ed70caf26db088dd674fbad25916f37da1043c188e57dbc89
    PhishDestroy
    Addresses
    104.21.51.28 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.220.4 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.28, 172.67.220.4): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    golkarbulukumba.com
    Registered
    2025-08-11 · Gname.com Pte. Ltd.
    MX
    Receives mail at ghs.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  21. wwwcolchoesemma.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    wwwcolchoesemma.com
    First seen
    2026-11-07 21:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:06 UTC to 2027-02-05 20:06 UTC
    Logged 2026-11-07 21:05 UTC in IPng Networks Halloumi2027h1, entry 403,553,759
    SHA-256 87103af0f235fea19c318da385f1b7f7f12862d77ee7f42538cf3f1d75bd848c
    Public key SHA-256 949de71f0b5b6a2c6594cb008fd488e70ca0a5f30ce9adb539e23e065d79ef18
    PhishDestroy
    Addresses
    104.21.62.176 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.230 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.176, 172.67.137.230): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wwwcolchoesemma.com
    Registered
    2026-02-12 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  22. www.ubereats-code-promo.fr FR · AS16276 · OVH OVH SASUber Eats
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    www.ubereats-code-promo.fr
    First seen
    2026-11-07 21:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 145.239.37.162.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 145.239.37.162
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:53 UTC to 2027-02-05 19:53 UTC
    Logged 2026-11-07 20:51 UTC in Let's Encrypt Willow2027h1, entry 991,778,045
    SHA-256 51f26cce3eb44552f14e0653365f7252a7afc1277dd2a34417c14cf7b1fcc059
    Public key SHA-256 0fc6278dcbe05414772332cef07a7b1b5699612022a3852356ead67dd530b868
    Brand
    Uber Eats
    Addresses
    145.239.37.162 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (145.239.37.162): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ubereats-code-promo.fr
    Registered
    2025-04-24 · OVH
    MX
    Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 09:24 UTC

    Suggest a correction

  23. 811intake.com
    ListedListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    811intake.com
    First seen
    2026-11-07 21:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:03 UTC to 2027-02-05 21:01 UTC
    Logged 2026-11-07 21:03 UTC in Let's Encrypt Willow2027h1, entry 991,927,776
    SHA-256 087079803ae3258bacf46f9c06c5d99a09e0dd54792667c822f7b437ea9e270a
    Public key SHA-256 d94a78986ca4a8637c689edeef35989c4fdb575f0318bee7b179bdafbce5beea
    Domain
    811intake.com
    Registered
    2026-09-09 · Cloudflare, Inc.
    MX
    Receives mail at 811intake-com.mail.protection.outlook.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  24. addvocado.com DE · AS51167 · CONTABO Contabo GmbH
    ListedContaboListed by CERT PolskaMX presentSPF ~allDMARC policy noneRegistered 14 y ago
    DetailsHide
    Hostname
    addvocado.com
    First seen
    2026-11-07 21:05 UTC
    Listing
    CERT Polska listed it 2026-05-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 20:02 UTC to 2027-02-05 20:02 UTC
    Logged 2026-11-07 21:00 UTC in Google PlumbersArms2027h1, entry 666,634,851
    SHA-256 0f74c9943ac5d9b34c59b46bb2473f51b351b7325b4c36ba7646a5ee1f3e84b5
    Public key SHA-256 29f71317f00f21a9c82a24a4c4cef635bdd8ea587b6ff83cb552791857ff6afb
    Addresses
    212.90.120.121 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    Contabo
    Contabo (212.90.120.121): a cloud provider. It rents servers and addresses to its customers.
    Domain
    addvocado.com
    Registered
    2012-06-05 · eNom, LLC
    MX
    Receives mail at addvocado.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  25. backoffice.habitvs.io US · AS397273 · Render2 addresses
    ReportedShared platform · RenderUnder habitvs.io, reported by PhishDestroyMX presentSPF missingDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    backoffice.habitvs.io
    First seen
    2026-11-07 21:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing habitvs.io and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:03 UTC to 2027-02-05 21:03 UTC
    Logged 2026-11-07 21:03 UTC in IPng Networks Halloumi2027h1, entry 403,534,960
    SHA-256 739a2f67df11cd2b78602532689d3021991455c8684121dd1cd55347c04ec979
    Public key SHA-256 496576d0d7291c8be55b570b1bfbccdc408d8e9b0f8e5712197d076f8a25c3dc
    PhishDestroy
    Addresses
    216.24.57.16 · United States · AS397273 RENDER - Render · Render (shared platform)
    216.24.57.18 · United States · AS397273 RENDER - Render · Render (shared platform)
    Shared platform · Render
    Render (216.24.57.16, 216.24.57.18): a shared platform front end. The address serves every app deployed on the platform.
    Domain
    habitvs.io
    Registered
    2023-05-26 · Amazon Registrar, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  26. fi-strategy-assistant-website.website US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    fi-strategy-assistant-website.website
    First seen
    2026-11-07 21:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-29 15:14 UTC to 2026-12-28 16:14 UTC
    Logged 2026-11-07 21:02 UTC in DigiCert Wyvern2026h2, entry 2,210,839,123
    SHA-256 1c9e5186628cd7897d15d288a4af65a06f9b7fd2182a98fae8fc1f2d0c09c494
    Public key SHA-256 32ae278da4ef90c950945c59ea7821a0c474d14580fd02efaf16ad9e8c97d904
    Addresses
    104.21.76.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.76.147, 172.67.196.62): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fi-strategy-assistant-website.website
    Registered
    2026-07-12 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  27. gjxmk.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    gjxmk.work
    First seen
    2026-11-07 21:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:03 UTC to 2027-02-05 20:03 UTC
    Logged 2026-11-07 21:02 UTC in IPng Networks Halloumi2027h1, entry 403,524,864
    SHA-256 61cee06bbbdb9560c567c9e76b47cb725f06e67db870e65ace0fb93f64b150de
    Public key SHA-256 bc857b1e6c0cc18cf28c8ca429d642609505009afb37765326c0d3bd09409993
    Addresses
    104.21.68.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.97, 172.67.193.225): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gjxmk.work
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  28. home--en--ledgr.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    home--en--ledgr.pages.dev
    First seen
    2026-11-07 21:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:02 UTC to 2027-02-05 21:00 UTC
    Logged 2026-11-07 21:02 UTC in Let's Encrypt Willow2027h1, entry 991,920,941
    SHA-256 bd5ef763236a232ac919229c6ef8765b857ca84651b717970a64365f70d931ec
    Public key SHA-256 d7fa36549d811a853c7b1932314834ddd9d3b0f8609d2da45a5afadede1d0a9a
    Addresses
    172.66.44.125 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.131 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.125, 172.66.47.131): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  29. iec-ims.com AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 19 y ago
    DetailsHide
    Hostname
    iec-ims.com
    First seen
    2026-11-07 21:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:05 UTC to 2027-02-05 20:05 UTC
    Logged 2026-11-07 21:03 UTC in IPng Networks Halloumi2027h1, entry 403,540,231
    SHA-256 7a06de9fbba662867a9524660bf5ec65e6e0df01b736b06fd652076713880d20
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.241 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates iec-ims.com to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.241): a parking service. It answers for names that are typically for sale or unused.
    Domain
    iec-ims.com
    Registered
    2007-07-03 · Dynadot Inc
    MX
    Receives mail at mx156.hostedmxserver.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  30. interbahisresmigirisler.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    interbahisresmigirisler.vip
    First seen
    2026-11-07 21:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-09 16:46 UTC to 2026-12-08 17:44 UTC
    Logged 2026-11-07 21:01 UTC in DigiCert Wyvern2026h2, entry 2,210,838,371
    SHA-256 226459452acd60b88ba50e63498c70684a0d6e2d8ad1b8ffcd93ee9c464eca91
    Public key SHA-256 55abe219ce6ef1d905f68ca2754152384833d7367343e3b414b54d5fb38524ac
    PhishDestroy
    Addresses
    104.21.88.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.152.156 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.88.195, 172.67.152.156): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    interbahisresmigirisler.vip
    Registered
    2026-07-10 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:09 UTC

    Suggest a correction

  31. kra45---c--c.ru US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    kra45---c--c.ru
    First seen
    2026-11-07 21:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:02 UTC to 2027-02-05 21:00 UTC
    Logged 2026-11-07 21:02 UTC in IPng Networks Halloumi2027h1, entry 403,523,545
    SHA-256 12e04a92c3cdc2aa6537807fc2af0fc113f6c5bdcbca5e0887bb7cacb96cbbad
    Public key SHA-256 7cc334676abe11bb5f88331ce038c2ce0d5ea22685008f47259f04b539c6b436
    PhishDestroy
    Addresses
    104.21.62.8 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.167 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.8, 172.67.217.167): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kra45---c--c.ru
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:09 UTC

    Suggest a correction

  32. ledger-co.io US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ledger-co.io
    First seen
    2026-11-07 21:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 20:03 UTC to 2027-02-05 21:01 UTC
    Logged 2026-11-07 21:03 UTC in Google PlumbersArms2027h1, entry 666,668,812
    SHA-256 05b423b8161582e76ece34496f00f0191ab06ce25a33defa3fe1645f579ae6fe
    Public key SHA-256 4261a7c83d787d017d610abe01e9cd930f129a1e04c82131b91f7145fbda1dde
    Addresses
    104.21.67.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.33 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.67.193, 172.67.180.33): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledger-co.io
    Registered
    2026-07-12 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  33. makerduoo.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    makerduoo.pro
    First seen
    2026-11-07 21:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:05 UTC to 2027-02-05 20:05 UTC
    Logged 2026-11-07 21:04 UTC in IPng Networks Halloumi2027h1, entry 403,541,891
    SHA-256 0b043eaeba74c09ec853d32576a8351a1df781a44af80773f302eb879ee55ce1
    Public key SHA-256 6e1b836083b7fd7a8cc0b2cf2083da89d0f17ff6a09218d7aabd41081d0b81a0
    Addresses
    104.21.44.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.203.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.44.195, 172.67.203.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    makerduoo.pro
    Registered
    2026-05-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  34. moonshot-vote.bond US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    moonshot-vote.bond
    First seen
    2026-11-07 21:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 20:04 UTC to 2027-02-05 20:04 UTC
    Logged 2026-11-07 21:02 UTC in Let's Encrypt Willow2027h1, entry 991,921,958
    SHA-256 498bd842762c1daba7ed4abe282aae0ac99395a8a2f5e0b89a4058312dbc0f98
    Public key SHA-256 75db44b4f496bfa6f81d81f4b0bff1f94bb68975b79537322b1bd59dce14e2a9
    PhishDestroy
    Addresses
    104.21.54.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.54.6, 172.67.221.237): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    moonshot-vote.bond
    Registered
    2026-03-16 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  35. starlockfort.com BD · AS153947 · FAST ZONE IT
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    starlockfort.com
    First seen
    2026-11-07 21:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 20:02 UTC to 2027-02-05 20:02 UTC
    Logged 2026-11-07 21:01 UTC in Google ParcelYard2027h1, entry 666,310,940
    SHA-256 51ce7bc1afcec4baf4cbadfb6f32dd0c6a7e202cceabbdc5f44c1175794e7bc6
    Public key SHA-256 339c5ed54e8e7bc9802392e6fa0835e2ab3487b23f36f9c9e62fc13a735a21c8
    PhishDestroy
    Addresses
    193.187.110.10 · Bangladesh · AS153947 FASTZONEIT-AS-AP - FAST ZONE IT
    Domain
    starlockfort.com
    Registered
    2026-09-03 · GMO Internet Group, Inc. d/b/a Onamae.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  36. www.starlockfort.com BD · AS153947 · FAST ZONE IT
    ReportedUnder starlockfort.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.starlockfort.com
    First seen
    2026-11-07 21:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing starlockfort.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 20:02 UTC to 2027-02-05 20:02 UTC
    Logged 2026-11-07 21:01 UTC in Google ParcelYard2027h1, entry 666,310,940
    SHA-256 51ce7bc1afcec4baf4cbadfb6f32dd0c6a7e202cceabbdc5f44c1175794e7bc6
    Public key SHA-256 339c5ed54e8e7bc9802392e6fa0835e2ab3487b23f36f9c9e62fc13a735a21c8
    PhishDestroy
    Addresses
    193.187.110.10 · Bangladesh · AS153947 FASTZONEIT-AS-AP - FAST ZONE IT
    Domain
    starlockfort.com
    Registered
    2026-09-03 · GMO Internet Group, Inc. d/b/a Onamae.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  37. bftjojhr.wgsurcel.8vjcyszxb.csarxeio.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    bftjojhr.wgsurcel.8vjcyszxb.csarxeio.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-07 21:00 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 20:00 UTC to 2027-02-05 20:00 UTC
    Logged 2026-11-07 20:58 UTC in Let's Encrypt Sycamore2027h1, entry 1,026,043,561
    SHA-256 b11e1c9204bc23dbfe2f1943e9bcf0c0b2c31a60c6d114ac8cb703324533ed9e
    Public key SHA-256 dbe3e7f560a7df6cad2b386423ed049209280ffb89567f0e8d940ea1d4662943
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  38. dekikjy2qjar6spy.bftjojhr.wgsurcel.8vjcyszxb.csarxeio.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    dekikjy2qjar6spy.bftjojhr.wgsurcel.8vjcyszxb.csarxeio.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-07 21:00 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:00 UTC to 2027-02-05 20:00 UTC
    Logged 2026-11-07 20:58 UTC in IPng Networks Gouda2027h1, entry 346,894,060
    SHA-256 1ff488eab04180cc40d028b82ab72eb37e1b5dfbbe839dc9bdd994c49b912e7f
    Public key SHA-256 452f2a6eef6ccbe6a16154eaab1f5bc9d28ff5dc6443c6d59421e016fdf48f71
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  39. gdfxdw.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    gdfxdw.xyz
    First seen
    2026-11-07 21:00 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:59 UTC to 2027-02-05 20:58 UTC
    Logged 2026-11-07 20:59 UTC in Google ParcelYard2027h1, entry 666,289,383
    SHA-256 dd4ca620c742dbea2c6ea29d78fc0c62500dc16e36cf29975fb06cb2b8e70f6d
    Public key SHA-256 d34d846cf8f76eec1a34740ec34eed5bfd3ee77f6c0e28add11eb63ff4aed05b
    Addresses
    104.21.77.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.211.134 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.77.209, 172.67.211.134): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gdfxdw.xyz
    Registered
    2025-11-18 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  40. gritproyect.com US · AS15169 · Google LLC4 addresses
    ListedGoogleListed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    gritproyect.com
    First seen
    2026-11-07 21:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3
    Valid 2026-09-11 18:33 UTC to 2026-12-10 19:25 UTC
    Logged 2026-11-07 20:58 UTC in DigiCert Wyvern2026h2, entry 2,210,833,163
    SHA-256 7067e416a25acb76a2d1a15ac7778b59f362437974e10328195ff0869ab84280
    Public key SHA-256 b822d9a65834d34e5d9daa8c93edd8074dd8df8ac33d2a521ea1990aef6c9ef6
    Addresses
    216.239.32.21 · United States · AS15169 GOOGLE - Google LLC · Google (cloud provider)
    216.239.34.21 · United States · AS15169 GOOGLE - Google LLC · Google (cloud provider)
    216.239.36.21 · United States · AS15169 GOOGLE - Google LLC · Google (cloud provider)
    216.239.38.21 · United States · AS15169 GOOGLE - Google LLC · Google (cloud provider)
    Google
    Google (216.239.32.21, 216.239.34.21, 216.239.36.21, 216.239.38.21): a cloud provider. It rents servers and addresses to its customers.
    Domain
    gritproyect.com
    Registered
    2026-06-22 · Squarespace Domains II LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 13:59 UTC

    Suggest a correction

  41. mhnewqfx.pqbqwhyq.iexungarq.sehtqnid.wejfdxnc.rbl2jkv1f4qkmyqq.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    mhnewqfx.pqbqwhyq.iexungarq.sehtqnid.wejfdxnc.rbl2jkv1f4qkmyqq.gatewaylearning.ezgateway.net
    First seen
    2026-11-07 21:00 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:00 UTC to 2027-02-05 20:00 UTC
    Logged 2026-11-07 20:58 UTC in Let's Encrypt Willow2027h1, entry 991,867,152
    SHA-256 20d21ad2785a1d4e1e0cb0db3ace931673031ef2d2368fabca70f82ef921f7ea
    Public key SHA-256 d67611bf25d72bfd2033bbe5c18641ca5cf3be8d0b18ad8152d0e0f7b0ba4846
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  42. okwn.agndatacom.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under agndatacom.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    okwn.agndatacom.com
    First seen
    2026-11-07 21:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing agndatacom.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:00 UTC to 2027-02-05 20:00 UTC
    Logged 2026-11-07 20:58 UTC in Let's Encrypt Willow2027h1, entry 991,863,685
    SHA-256 6b3cc0e75ed0b9769b226a3a813b1584af6ffc98a311dfe23d15497897efb0fe
    Public key SHA-256 dc9621a04bcb13512d1c9b4381c071ef255b5bdddad0f092d3d309297d6d7d03
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    agndatacom.com
    Registered
    2026-08-20 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  43. pn9t2vvrra4f9w3h.dolaghsc.cqjiypuv.kvjsbyeg.emnbzdvj.uatmfwcq.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    pn9t2vvrra4f9w3h.dolaghsc.cqjiypuv.kvjsbyeg.emnbzdvj.uatmfwcq.gatewaylearning.ezgateway.net
    First seen
    2026-11-07 21:00 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 20:00 UTC to 2027-02-05 20:00 UTC
    Logged 2026-11-07 20:58 UTC in Geomys Tuscolo2027h1, entry 519,228,160
    SHA-256 1def3c66efe8f93e1c578e56e5245b33b0046303224a674444076c84c3347eb2
    Public key SHA-256 07e10c5d721c665fa71abdb6c3762723da2ed8551ac37b4d990f677d7583f0ea
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  44. rbl2jkv1f4qkmyqq.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    rbl2jkv1f4qkmyqq.gatewaylearning.ezgateway.net
    First seen
    2026-11-07 21:00 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 20:00 UTC to 2027-02-05 20:00 UTC
    Logged 2026-11-07 20:58 UTC in Let's Encrypt Willow2027h1, entry 991,866,898
    SHA-256 e458b8db91781b13ae24397e60aca074ebb3b500c95bc4c21ca16a03f2989ba0
    Public key SHA-256 240813caede5a4b545e32e3cefd3b094af27468803007b88ce6324f4c3726c5c
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  45. winstep.net.cn CN · AS24429 · Zhejiang Taobao Network Co.…
    ListedListed by MetaMaskMX absentSPF missingDMARC reject
    DetailsHide
    Hostname
    winstep.net.cn
    First seen
    2026-11-07 21:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 19:58 UTC to 2027-02-05 19:58 UTC
    Logged 2026-11-07 20:56 UTC in DigiCert Wyvern2027h1, entry 445,722,365
    SHA-256 817de56027ae653918b2495a4a45ab1200629f96385d9dcca83aeacb40f289fc
    Public key SHA-256 cd2fc84b93ea8af97a191f2279537cf3d4a72348809d7cbb2dc8cc6f9733c180
    Addresses
    47.246.22.223 · China · AS24429 Taobao - Zhejiang Taobao Network Co.,Ltd
    Domain
    winstep.net.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 21:03 UTC

    Suggest a correction

  46. www.sbdxkjrp.tuvxglwm.pztcoqlu.ixyhmceu.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    www.sbdxkjrp.tuvxglwm.pztcoqlu.ixyhmceu.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-07 21:00 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 20:00 UTC to 2027-02-05 20:00 UTC
    Logged 2026-11-07 20:58 UTC in Let's Encrypt Sycamore2027h1, entry 1,026,043,743
    SHA-256 2fb317a895619202ad8403d5d83753f13b64e8bd265373d65a86334b598551c0
    Public key SHA-256 8b1b9a98b016788c0e940945a8971d6b14eaa055fd288bd09f796443f39418f4
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  47. 86zr3.infoVisa
    ListedListed by JPCERT/CC as imitating VISAMX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    86zr3.info
    First seen
    2026-11-07 20:56 UTC
    Listing
    JPCERT/CC confirmed it 2026-09-03 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 14:11 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:52 UTC to 2027-02-05 20:51 UTC
    Logged 2026-11-07 20:52 UTC in Geomys Tuscolo2027h1, entry 519,177,250
    SHA-256 56ae56877e5bf35cd30acba3e83c7e4b838bd6fa95ae727a10949ccd5da3f53a
    Public key SHA-256 9847755451c0e5524164e0396caecde26c8b998d369ea08049fb7fea532a98cf
    Brand
    Visa
    Domain
    86zr3.info
    Registered
    2025-11-16 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Receives mail at route1.mx.cloudflare.net, route2.mx.cloudflare.net, route3.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  48. api.evolution-zenith.org DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under evolution-zenith.org, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 29 d ago
    DetailsHide
    Hostname
    api.evolution-zenith.org
    First seen
    2026-11-07 20:56 UTC
    Listing
    CERT Polska listed it 2026-10-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    PhishDestroy: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Listed
    CERT Polska, listing evolution-zenith.org and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 19:54 UTC to 2027-02-05 19:53 UTC
    Logged 2026-11-07 20:52 UTC in Let's Encrypt Sycamore2027h1, entry 1,025,896,344
    SHA-256 b6ef1bbfd2bb673953fb8f3b90893ad443ad5c7d70719b47273f693a5bf5a80f
    Public key SHA-256 e81b3aaa76871b045e8a98f98781b82af9b795e2994ab3fc5e0a2aa3675e3709
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    evolution-zenith.org
    Registered
    2026-10-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 07:51 UTC

    Suggest a correction

  49. backend.evolution-zenith.org DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under evolution-zenith.org, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 29 d ago
    DetailsHide
    Hostname
    backend.evolution-zenith.org
    First seen
    2026-11-07 20:56 UTC
    Listing
    CERT Polska listed it 2026-10-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    PhishDestroy: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Listed
    CERT Polska, listing evolution-zenith.org and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 19:54 UTC to 2027-02-05 19:54 UTC
    Logged 2026-11-07 20:52 UTC in Geomys Tuscolo2027h1, entry 519,178,561
    SHA-256 415f1c6b8352da8fd90ba96e61678dd2204030be2062ee38d47f4165ff953834
    Public key SHA-256 e81b3aaa76871b045e8a98f98781b82af9b795e2994ab3fc5e0a2aa3675e3709
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    evolution-zenith.org
    Registered
    2026-10-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 07:51 UTC

    Suggest a correction

  50. fulcrom-finance.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    fulcrom-finance.net
    First seen
    2026-11-07 20:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:51 UTC to 2027-02-05 20:50 UTC
    Logged 2026-11-07 20:51 UTC in DigiCert Sphinx2027h1, entry 394,061,553
    SHA-256 e013d8348e87ac297ff0c23b489edc09c58eb75821eda4a59ed153302c6388f2
    Public key SHA-256 b268ff236672140f3803788015bcdbf6256fb52d7ad80515e849f48f7af0b91a
    Addresses
    104.21.85.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.85.207, 172.67.210.152): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fulcrom-finance.net
    Registered
    2026-04-09 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  51. github.eplay.at DE · AS24940 · HETZNER-AS Hetzner Online G…2 addresses
    ReportedHetznerUnder eplay.at, reported by PhishDestroyMX presentSPF ?allDMARC missing
    DetailsHide
    Hostname
    github.eplay.at
    First seen
    2026-11-07 20:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing eplay.at and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 19:55 UTC to 2027-02-05 19:55 UTC
    Logged 2026-11-07 20:54 UTC in Google PlumbersArms2027h1, entry 666,554,745
    SHA-256 78de183bac1c753b6e0547bba9e01c1a781a8581f12ec5c69e4e520e4fdf4363
    Public key SHA-256 216153174ef5c1ceb2433e331f2fb73a1aefb25ba8375c0696efb04ae94950e2
    PhishDestroy
    Addresses
    157.90.126.141 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    2a01:4f8:1c1c:344c::1
    Hetzner
    Hetzner (157.90.126.141): a cloud provider. It rents servers and addresses to its customers.
    Domain
    eplay.at
    MX
    Receives mail at www358.your-server.de
    SPF
    SPF record with ?all: other senders are neutral
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-06 23:37 UTC

    Suggest a correction

  52. micescrewdriverspear.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    micescrewdriverspear.com
    First seen
    2026-11-07 20:56 UTC
    Listing
    USOM listed it 2026-05-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 19:52 UTC to 2027-02-05 19:52 UTC
    Logged 2026-11-07 20:51 UTC in Google ParcelYard2027h1, entry 666,191,227
    SHA-256 7c2c5de3954cf250a7b830b6b7e3f2814ad13b1986348154ba536c89781d3dfa
    Public key SHA-256 ce7d686922d863aedb14b50e8015f1d99fcc814c1c4228e31fbe63f5247eb84b
    Addresses
    104.21.7.145 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.154 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.7.145, 172.67.187.154): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    micescrewdriverspear.com
    Registered
    2026-05-14 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  53. tevehyron.help US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tevehyron.help
    First seen
    2026-11-07 20:56 UTC
    Listing
    CERT Polska listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:54 UTC to 2027-02-05 19:54 UTC
    Logged 2026-11-07 20:53 UTC in DigiCert Sphinx2027h1, entry 394,077,401
    SHA-256 14ae384e33a9e563c63242534ced912ef81501fc566d472ec77029e9bcc621fb
    Public key SHA-256 b75302aa8321df9188dcb39dc666de417a285f3b40bb702b0affe21fdf30d29f
    Addresses
    104.21.46.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.143.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.46.243, 172.67.143.49): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevehyron.help
    Registered
    2026-05-14 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  54. u2phy.infoANA
    ListedListed by JPCERT/CC as imitating ANAMX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    u2phy.info
    First seen
    2026-11-07 20:56 UTC
    Listing
    JPCERT/CC confirmed it 2026-09-03 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 14:11 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:54 UTC to 2027-02-05 20:52 UTC
    Logged 2026-11-07 20:54 UTC in Geomys Tuscolo2027h1, entry 519,192,764
    SHA-256 782d3ebe34c86c744fb21f35d62cb5c4d5979d362de8f01d1f940b99607a9b03
    Public key SHA-256 de41775a88bd618784d861f28c3867ec49bdc08099e253e0e1217711f0286895
    Brand
    ANA
    Domain
    u2phy.info
    Registered
    2025-11-16 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Receives mail at route2.mx.cloudflare.net, route3.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  55. www.omotoyosifoundation.com.ng US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder omotoyosifoundation.com.ng, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 20 mo ago
    DetailsHide
    Hostname
    www.omotoyosifoundation.com.ng
    First seen
    2026-11-07 20:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing omotoyosifoundation.com.ng and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 19:56 UTC to 2027-02-05 19:56 UTC
    Logged 2026-11-07 20:54 UTC in Geomys Tuscolo2027h1, entry 519,197,277
    SHA-256 074144f7c7b510b214c7c9cfa40172cdd62053f0be9a86e1e3774b9b474c7d71
    Public key SHA-256 372db1533a993e8771d4c4903458254424ea4e2c3c2eaadf63ecd815708aaa30
    PhishDestroy
    Addresses
    104.21.33.84 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.128 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.84, 172.67.160.128): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    omotoyosifoundation.com.ng
    Registered
    2025-03-26 · MYDOT.NGONLINE
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:50 UTC

    Suggest a correction

  56. 811intake.net
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    811intake.net
    First seen
    2026-11-07 20:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:50 UTC to 2027-02-05 20:49 UTC
    Logged 2026-11-07 20:50 UTC in IPng Networks Gouda2027h1, entry 346,826,679
    SHA-256 e939996ba247bf13dad60d066c4b7fd0eb5f76289ea39df4f48eb1e4603f89de
    Public key SHA-256 53c71d4d014cb6e47175b7d89c5b2f96c02077d22d1c677facb460881e665b19
    Domain
    811intake.net
    Registered
    2026-09-09 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  57. bn-sansimburada.online SC · AS403005 · Blatant
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    bn-sansimburada.online
    First seen
    2026-11-07 20:51 UTC
    Listing
    USOM listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:50 UTC to 2027-02-05 20:47 UTC
    Logged 2026-11-07 20:50 UTC in Google PlumbersArms2027h1, entry 666,507,355
    SHA-256 51449a82d0dfb020b193de79b9b9e77b98e3a6efff8ef5eeb2cdff3347011fba
    Public key SHA-256 eed3d98eaa975aecfabab523c763930093190e2023207fcf4fbb58c467bf4e38
    Addresses
    64.89.160.46 · Seychelles · AS403005 BLATANTHOST - Blatant
    Domain
    bn-sansimburada.online
    Registered
    2026-09-09 · Unstoppable Domains, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  58. carrefourtemis.ca US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    carrefourtemis.ca
    First seen
    2026-11-07 20:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 19:48 UTC to 2027-02-05 19:48 UTC
    Logged 2026-11-07 20:46 UTC in Let's Encrypt Willow2027h1, entry 991,720,277
    SHA-256 01be9960ddca30c8bf8689168a03748102d61ea1d8879d60ab2073f51041ead2
    Public key SHA-256 6790afc468b2ec0bc0df0065aa1c21926cebf3e4cfb2342edd26ad95ca7fc9ff
    PhishDestroy
    Addresses
    104.21.25.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.134.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.25.242, 172.67.134.237): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    carrefourtemis.ca
    Registered
    2026-08-21 · CENTRALNIC CANADA INC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  59. dev-website.aurum.foundation US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder aurum.foundation, listed by FSMA (cryptocurrency fraud)MX presentSPF -allDMARC policy noneRegistered 2 y ago
    DetailsHide
    Hostname
    dev-website.aurum.foundation
    First seen
    2026-11-07 20:51 UTC
    Listing
    FSMA warned about it 2026-07-06 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 15:40 UTC
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    FSMA, listing aurum.foundation and the names under it
    1. Warning by FSMA
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:49 UTC to 2027-02-05 20:47 UTC
    Logged 2026-11-07 20:49 UTC in Geomys Tuscolo2027h1, entry 519,145,746
    SHA-256 0559cb675e14b6a3db21e39186e46589d7a6a0cbb1f4dfbd863d32f07131b90b
    Public key SHA-256 c7f65242b89634ce4e3c7a1f698851018314729eb513cf289a703b1b74cca303
    Addresses
    104.21.38.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.38.184, 172.67.137.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aurum.foundation
    Registered
    2024-08-01 · NameCheap, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 05:12 UTC

    Suggest a correction

  60. insegik.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    insegik.com
    First seen
    2026-11-07 20:51 UTC
    Listing
    CERT Polska listed it 2026-05-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 19:47 UTC to 2027-02-05 19:47 UTC
    Logged 2026-11-07 20:46 UTC in Geomys Tuscolo2027h1, entry 519,112,550
    SHA-256 03f3d2d51035c00d0f82e7cef326dcaf181b3072cb79f37e5d557ed18df68289
    Public key SHA-256 25ac3a879226a1a0970d3da3711dbef6b1e5ddcc50eda062f5b30564cccc839a
    Addresses
    104.21.10.145 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.145, 172.67.163.152): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    insegik.com
    Registered
    2026-05-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  61. reward-center.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    reward-center.net
    First seen
    2026-11-07 20:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:46 UTC to 2027-02-05 20:43 UTC
    Logged 2026-11-07 20:46 UTC in Google ParcelYard2027h1, entry 666,128,895
    SHA-256 1e780e8cac44d7f27d7f70de3e607056006011fed66fbbb5beb8c4b6f0da8b7b
    Public key SHA-256 bec3d8cbe22b9df75bb7bc1be3514651bb22ea6ffa44719df27433facd9eda9d
    Addresses
    104.21.34.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.34.31, 172.67.167.216): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    reward-center.net
    Registered
    2026-06-10 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  62. stg.reward-center.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder reward-center.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    stg.reward-center.net
    First seen
    2026-11-07 20:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing reward-center.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:46 UTC to 2027-02-05 20:43 UTC
    Logged 2026-11-07 20:46 UTC in Google ParcelYard2027h1, entry 666,128,895
    SHA-256 1e780e8cac44d7f27d7f70de3e607056006011fed66fbbb5beb8c4b6f0da8b7b
    Public key SHA-256 bec3d8cbe22b9df75bb7bc1be3514651bb22ea6ffa44719df27433facd9eda9d
    Addresses
    104.21.34.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.34.31, 172.67.167.216): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    reward-center.net
    Registered
    2026-06-10 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  63. ww17.hardshipgrants.com VG · AS40034 · Confluence Networks Inc
    ReportedParking page · Above.comUnder hardshipgrants.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 21 y ago
    DetailsHide
    Hostname
    ww17.hardshipgrants.com
    First seen
    2026-11-07 20:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing hardshipgrants.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2
    Valid 2026-11-07 00:00 UTC to 2027-02-05 23:59 UTC
    Logged 2026-11-07 20:48 UTC in HARICA Selene2027h1, entry 58,261,633
    SHA-256 b2a0bdcf63501b3c8eddf08a71976d6ca646be8bc3886d991e3e97875af2ab2d
    Public key SHA-256 5c47e721018b3dfabb9fc4af59984762a13ad0f03aa4cff013dfe0b921c4802e
    PhishDestroy
    Addresses
    199.191.50.196 · British Virgin Islands · AS40034 CONFLUENCE-NETWORK-INC - Confluence Networks Inc · Confluence Networks (parking page)
    Parking page · Above.com
    The registry delegates hardshipgrants.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Confluence Networks (199.191.50.196): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hardshipgrants.com
    Registered
    2006-02-24 · Register.com - Network Solutions, LLC
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  64. www-keepass.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    www-keepass.info
    First seen
    2026-11-07 20:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:46 UTC to 2027-02-05 20:44 UTC
    Logged 2026-11-07 20:46 UTC in Google ParcelYard2027h1, entry 666,126,845
    SHA-256 7b0552a211ba0a0db608ed4391b678c89335d0b58cc5fcbcc273d555fd5aeb4b
    Public key SHA-256 69e82ffa64ee2d8abbe5fb373a1eb0c58a667b407d3409c15924994082b9d457
    Addresses
    104.21.18.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.73 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.18.253, 172.67.184.73): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    www-keepass.info
    Registered
    2026-01-16 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  65. www.carrefourtemis.ca US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder carrefourtemis.ca, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    www.carrefourtemis.ca
    First seen
    2026-11-07 20:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing carrefourtemis.ca and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 19:48 UTC to 2027-02-05 19:48 UTC
    Logged 2026-11-07 20:46 UTC in Let's Encrypt Willow2027h1, entry 991,720,277
    SHA-256 01be9960ddca30c8bf8689168a03748102d61ea1d8879d60ab2073f51041ead2
    Public key SHA-256 6790afc468b2ec0bc0df0065aa1c21926cebf3e4cfb2342edd26ad95ca7fc9ff
    PhishDestroy
    Addresses
    104.21.25.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.134.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.25.242, 172.67.134.237): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    carrefourtemis.ca
    Registered
    2026-08-21 · CENTRALNIC CANADA INC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  66. eneco.no NO · AS12996 · DOMENESHOP Domeneshop ASEneco
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    eneco.no
    First seen
    2026-11-07 20:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 194.63.248.52.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 194.63.248.52
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-07 19:44 UTC to 2027-02-05 19:44 UTC
    Logged 2026-11-07 20:43 UTC in IPng Networks Gouda2027h1, entry 346,772,295
    SHA-256 3fd69c3cb8e3da2563d32f67394dad87d8d3bfd4fbf5a803e50f32ecd4b5987b
    Public key SHA-256 eff4f4f30fc2cc0f4ea25e856e530540469b6cb09c77fcfcccf1a7b23e957812
    Brand
    Eneco
    Addresses
    194.63.248.52 · Norway · AS12996 DOMENESHOP Domeneshop AS
    Domain
    eneco.no
    Registered
    2026-05-20 · Domeneshop AS
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:47 UTC

    Suggest a correction

  67. 2.video-lezione.it US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder video-lezione.it, reported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    2.video-lezione.it
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing video-lezione.it and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:41 UTC to 2027-02-05 20:39 UTC
    Logged 2026-11-07 20:41 UTC in DigiCert Wyvern2027h1, entry 445,599,225
    SHA-256 14b12cc1221a193120dacaaf1f8e512dc0f1cdfb1644bc514ea89c030cabedcf
    Public key SHA-256 4c9384278f66702a097a4c04e43128311d78e5ef1347dd4951aba8997bf9b884
    PhishDestroy
    Addresses
    104.21.29.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.29.164, 172.67.149.118): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    video-lezione.it
    MX
    Receives mail at mx00.ionos.it, mx01.ionos.it
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:27 UTC

    Suggest a correction

  68. 99.fake.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder fake.cc, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    99.fake.cc
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing fake.cc and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Let's Encrypt Willow2027h1, entry 991,672,850
    SHA-256 30fbf21c9f1ed325affb7cff1914c581c03123b29aef28becb40d9038ede29f1
    Public key SHA-256 3e5d4d1b2f66713e5f03b5fb20bff9d3bb79232a6790a56df61742de628fb595
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates fake.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fake.cc
    Registered
    2014-04-30 · Spaceship, Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  69. aj5g96.infoANA
    ListedListed by JPCERT/CC as imitating ANAMX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    aj5g96.info
    First seen
    2026-11-07 20:46 UTC
    Listing
    JPCERT/CC confirmed it 2026-09-02 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 14:11 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:41 UTC to 2027-02-05 20:40 UTC
    Logged 2026-11-07 20:41 UTC in IPng Networks Gouda2027h1, entry 346,761,162
    SHA-256 71789fef955e7863ffe3c028ea5e86da34f9ffe13f1a5876b69b6799477bff89
    Public key SHA-256 dae06002108e9d3687aa122557cead100a2b4950f1125980df97fec2eed00206
    Brand
    ANA
    Domain
    aj5g96.info
    Registered
    2025-11-18 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Receives mail at route3.mx.cloudflare.net, route1.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  70. app.fake.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder fake.cc, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    app.fake.cc
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing fake.cc and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Let's Encrypt Willow2027h1, entry 991,672,850
    SHA-256 30fbf21c9f1ed325affb7cff1914c581c03123b29aef28becb40d9038ede29f1
    Public key SHA-256 3e5d4d1b2f66713e5f03b5fb20bff9d3bb79232a6790a56df61742de628fb595
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates fake.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fake.cc
    Registered
    2014-04-30 · Spaceship, Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  71. avenspol.digital US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    avenspol.digital
    First seen
    2026-11-07 20:46 UTC
    Listing
    CERT Polska listed it 2026-07-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:42 UTC to 2027-02-05 20:40 UTC
    Logged 2026-11-07 20:42 UTC in Google PlumbersArms2027h1, entry 666,412,588
    SHA-256 caddc26e4dd907902e1b1bdf132ac922b87dff4aabd68aa6689dedd159813548
    Public key SHA-256 77f326bc2bdcb37d12352aec6f92cdbf6d50c2034c89e8599b43101176a5dce3
    Addresses
    104.21.26.126 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.26.126, 172.67.136.67): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    avenspol.digital
    Registered
    2026-07-12 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  72. ayumerito.com US · AS399629 · BL Networks
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    ayumerito.com
    First seen
    2026-11-07 20:46 UTC
    Listing
    CERT Polska listed it 2026-08-29 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Google PlumbersArms2027h1, entry 666,406,997
    SHA-256 5d74ddef67d6b0fd2b4ac2e4ab498dfd33386c69132a25161ae909f696160074
    Public key SHA-256 1ba02cf3c73ec2a4d8f06f5a2ebd0bf507d8c28b044478f918ca8d625d8ae15d
    Addresses
    198.13.158.16 · United States · AS399629 BLNWX - BL Networks
    Domain
    ayumerito.com
    Registered
    2026-08-29 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  73. balancer-fi.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    balancer-fi.com
    First seen
    2026-11-07 20:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:41 UTC in DigiCert Sphinx2027h1, entry 393,999,724
    SHA-256 1c1721e4642dcee25bfee15d0bd2bc92882609b6bd8a98214400666eac36ece6
    Public key SHA-256 b68990e20b5ebd85f048b681cd9b2df75cb935ae42b82b7d2e2f02b576b5672b
    Addresses
    104.21.82.103 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.200.41 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.82.103, 172.67.200.41): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    balancer-fi.com
    Registered
    2026-04-09 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  74. c.video-lezione.it US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder video-lezione.it, reported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    c.video-lezione.it
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing video-lezione.it and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:45 UTC to 2027-02-05 20:43 UTC
    Logged 2026-11-07 20:45 UTC in Let's Encrypt Sycamore2027h1, entry 1,025,756,538
    SHA-256 04a042da72643ef1f5c71b57833def0fdc472e50a8eaeca5c4898010ae645df0
    Public key SHA-256 0987bc27bb33b805c655dd71430d6f22e8e4e17a1dcb24ea25b3f2b4733037d2
    PhishDestroy
    Addresses
    104.21.29.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.29.164, 172.67.149.118): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    video-lezione.it
    MX
    Receives mail at mx00.ionos.it, mx01.ionos.it
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:27 UTC

    Suggest a correction

  75. control.video-lezione.it
    ReportedUnder video-lezione.it, reported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    control.video-lezione.it
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing video-lezione.it and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:45 UTC to 2027-02-05 20:42 UTC
    Logged 2026-11-07 20:45 UTC in IPng Networks Halloumi2027h1, entry 403,381,604
    SHA-256 79092bdace09fd4428e015682ec3339aaae09c896b67a63ef79bc3665c0414ca
    Public key SHA-256 822e0a863c05e4f6067f0c3417bcfc5aeda3437323ee60b151a2716434d8cb42
    PhishDestroy
    Domain
    video-lezione.it
    MX
    Receives mail at mx00.ionos.it, mx01.ionos.it
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:27 UTC

    Suggest a correction

  76. deanh.me US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    deanh.me
    First seen
    2026-11-07 20:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:40 UTC to 2027-02-05 20:39 UTC
    Logged 2026-11-07 20:40 UTC in Google ParcelYard2027h1, entry 666,059,845
    SHA-256 54700f65f6d0d8f98f5ba8415b9c26e0d879186376d9dbc195a24a1c055d5943
    Public key SHA-256 c1064ace419b7a129f81100ff4231b5a249563d71f0828ed631b07aff7260066
    Addresses
    104.21.85.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.204.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.85.88, 172.67.204.58): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    deanh.me
    Registered
    2026-09-09 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  77. fake.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    fake.cc
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Let's Encrypt Willow2027h1, entry 991,672,850
    SHA-256 30fbf21c9f1ed325affb7cff1914c581c03123b29aef28becb40d9038ede29f1
    Public key SHA-256 3e5d4d1b2f66713e5f03b5fb20bff9d3bb79232a6790a56df61742de628fb595
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates fake.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fake.cc
    Registered
    2014-04-30 · Spaceship, Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  78. fassets-flare.foundation US · AS13335 · Cloudflare, Inc.4 addressesFlare Network
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    fassets-flare.foundation
    First seen
    2026-11-07 20:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 19:46 UTC to 2027-02-05 19:46 UTC
    Logged 2026-11-07 20:45 UTC in Geomys Tuscolo2027h1, entry 519,103,949
    SHA-256 7e08702f98ce636c2f6c0f665cf34847d98598caabc01bfb3def9fabbbc90932
    Public key SHA-256 3d49a1287cc9a0fffc9e0331c1c7c559732c42b7b8e3eab6698cd827223b40c7
    Brand
    Flare Network
    Addresses
    104.21.61.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.37 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:d925
    2606:4700:3034::6815:3df2
    Cloudflare
    Cloudflare (104.21.61.242, 172.67.217.37): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fassets-flare.foundation
    Registered
    2026-05-14 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:47 UTC

    Suggest a correction

  79. fortwex.pro BD · AS153947 · FAST ZONE IT
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    fortwex.pro
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 19:46 UTC to 2027-02-05 19:46 UTC
    Logged 2026-11-07 20:45 UTC in Google PlumbersArms2027h1, entry 666,445,648
    SHA-256 73c725bc82ee193480ac8f168899f8c5bdac8f4af36d8c46d59d08aa499bbc00
    Public key SHA-256 1374f3df18bb3b6bbc532a0e72e2bc77db653f32a9bfe0b6636e62d24ca075d1
    PhishDestroy
    Addresses
    193.187.110.10 · Bangladesh · AS153947 FASTZONEIT-AS-AP - FAST ZONE IT
    Domain
    fortwex.pro
    Registered
    2026-09-02 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  80. kampanyalicekilis.online SC · AS403005 · Blatant
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    kampanyalicekilis.online
    First seen
    2026-11-07 20:46 UTC
    Listing
    USOM listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 19:45 UTC to 2027-02-05 19:45 UTC
    Logged 2026-11-07 20:43 UTC in Geomys Tuscolo2027h1, entry 519,086,213
    SHA-256 92dd7d582c63b3ee28e32583d308f59d838ab04a632946bcf1ab894357b4d267
    Public key SHA-256 03e1e2fb64b6b4938e3983c426213289b0a7b461891625df8224e94c15c8abeb
    Addresses
    64.89.160.49 · Seychelles · AS403005 BLATANTHOST - Blatant
    Domain
    kampanyalicekilis.online
    Registered
    2026-09-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  81. kuneopa.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    kuneopa.shop
    First seen
    2026-11-07 20:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:41 UTC to 2027-02-05 20:40 UTC
    Logged 2026-11-07 20:41 UTC in Google PlumbersArms2027h1, entry 666,402,594
    SHA-256 1c7f5d1ebf03c00f423a4dbeca485c9fca5554b6b1cf10d7406dc1df80d33f0b
    Public key SHA-256 411b6d77ea741a85fca216add3817945c0a1ae2e057822c57edf5829f4788251
    Addresses
    104.21.4.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.8 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.4.58, 172.67.154.8): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kuneopa.shop
    Registered
    2025-11-18 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  82. live.aaveapp.us US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder aaveapp.us, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    live.aaveapp.us
    First seen
    2026-11-07 20:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    PhishDestroy: observed back in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-07 17:55 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-02 (8 days)
    Listed
    MetaMask, listing aaveapp.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 20:42 UTC
    Logged 2026-11-07 20:43 UTC in Let's Encrypt Sycamore2027h1, entry 1,025,711,025
    SHA-256 7112c45a59e08708880a43ce6bdf327c200db629d74caf5286e9c916d147bd83
    Public key SHA-256 635d3f9b08a395e40a99fac377332e20457e958e3d3e3b972e2be14aa807a546
    Addresses
    104.21.2.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.2.175, 172.67.129.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aaveapp.us
    Registered
    2026-04-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:07 UTC

    Suggest a correction

  83. mainnet-flare.com US · AS13335 · Cloudflare, Inc.2 addressesFlare Network
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    mainnet-flare.com
    First seen
    2026-11-07 20:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:46 UTC to 2027-02-05 19:46 UTC
    Logged 2026-11-07 20:45 UTC in Let's Encrypt Willow2027h1, entry 991,706,511
    SHA-256 044bd5ce576c4c21f9ce21121026e0a7b1a4f9b6d5f7c1c9897dba966b619088
    Public key SHA-256 74e96fe3eb2a11a043233e22112337c8609252e7ba38f97152a4bd4ba41b04af
    Brand
    Flare Network
    Addresses
    104.21.58.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.58.253, 172.67.167.7): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mainnet-flare.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:47 UTC

    Suggest a correction

  84. nwjka.fake.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder fake.cc, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    nwjka.fake.cc
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing fake.cc and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Let's Encrypt Willow2027h1, entry 991,672,850
    SHA-256 30fbf21c9f1ed325affb7cff1914c581c03123b29aef28becb40d9038ede29f1
    Public key SHA-256 3e5d4d1b2f66713e5f03b5fb20bff9d3bb79232a6790a56df61742de628fb595
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates fake.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fake.cc
    Registered
    2014-04-30 · Spaceship, Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  85. official-torzon.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    official-torzon.org
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:45 UTC to 2027-02-05 20:44 UTC
    Logged 2026-11-07 20:45 UTC in Google PlumbersArms2027h1, entry 666,445,846
    SHA-256 78651c59024b2594aff320e8ea3ab163d905a7deff931bc3f9afd57ae2bf65c2
    Public key SHA-256 d6d61167555a83b2278770c6c19f6d56abef2c79bf3139d85464551c1bc88b44
    PhishDestroy
    Addresses
    104.21.64.201 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.52 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.201, 172.67.136.52): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    official-torzon.org
    Registered
    2026-01-03 · Internet Domain Service BS Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  86. plex.pong.secuirtyguard.sbs DE · AS51167 · CONTABO Contabo GmbH
    ListedContaboUnder secuirtyguard.sbs, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    plex.pong.secuirtyguard.sbs
    First seen
    2026-11-07 20:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing secuirtyguard.sbs and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:45 UTC to 2027-02-05 19:45 UTC
    Logged 2026-11-07 20:43 UTC in Let's Encrypt Sycamore2027h1, entry 1,025,718,371
    SHA-256 04270c7efc4a84f53357c27c2c8a256fdd1b36490ef752627b14449f11776248
    Public key SHA-256 8052542bed5d0cf5235c38c43a6d651d38790fbd4538a2dc33dd22e3de05552a
    Addresses
    13.140.145.220 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    Contabo
    Contabo (13.140.145.220): a cloud provider. It rents servers and addresses to its customers.
    Domain
    secuirtyguard.sbs
    Registered
    2025-12-25 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 11:31 UTC

    Suggest a correction

  87. pn5rig.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    pn5rig.net
    First seen
    2026-11-07 20:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:42 UTC to 2027-02-05 20:40 UTC
    Logged 2026-11-07 20:42 UTC in Google PlumbersArms2027h1, entry 666,412,230
    SHA-256 32f03d2fff69320ee2c5195459962b0db494545470d7aa46db00186cb1d55bd7
    Public key SHA-256 ddbbb10167f89ab50c115f5963629a65f78cabef7bd2ca255c8ca353a5c71e03
    Addresses
    104.21.67.190 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.179.196 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.67.190, 172.67.179.196): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pn5rig.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:47 UTC

    Suggest a correction

  88. random.fake.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder fake.cc, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    random.fake.cc
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing fake.cc and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Let's Encrypt Willow2027h1, entry 991,672,850
    SHA-256 30fbf21c9f1ed325affb7cff1914c581c03123b29aef28becb40d9038ede29f1
    Public key SHA-256 3e5d4d1b2f66713e5f03b5fb20bff9d3bb79232a6790a56df61742de628fb595
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates fake.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fake.cc
    Registered
    2014-04-30 · Spaceship, Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  89. salepassports.fake.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder fake.cc, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    salepassports.fake.cc
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing fake.cc and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Let's Encrypt Willow2027h1, entry 991,672,850
    SHA-256 30fbf21c9f1ed325affb7cff1914c581c03123b29aef28becb40d9038ede29f1
    Public key SHA-256 3e5d4d1b2f66713e5f03b5fb20bff9d3bb79232a6790a56df61742de628fb595
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates fake.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fake.cc
    Registered
    2014-04-30 · Spaceship, Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  90. sponsorlucekilisin.online SC · AS403005 · Blatant
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    sponsorlucekilisin.online
    First seen
    2026-11-07 20:46 UTC
    Listing
    USOM listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 20:31 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 19:42 UTC to 2027-02-05 19:42 UTC
    Logged 2026-11-07 20:40 UTC in Google PlumbersArms2027h1, entry 666,389,097
    SHA-256 337b81b9dd6e80d5bfb21d9007832e532b329a7a4367ce1c08451fca858e8273
    Public key SHA-256 503b80a2f6fda11e878fe0babb07c55e8675a6e1b3365d8c716c9841589583d7
    Addresses
    64.89.160.46 · Seychelles · AS403005 BLATANTHOST - Blatant
    Domain
    sponsorlucekilisin.online
    Registered
    2026-09-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  91. steamunderground.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    steamunderground.net
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:40 UTC to 2027-02-05 20:39 UTC
    Logged 2026-11-07 20:40 UTC in Google PlumbersArms2027h1, entry 666,389,777
    SHA-256 1f1728f3c9316229320fd136b8a650a2f8465aa59662ffed68eae2d268d27d43
    Public key SHA-256 8206811775f9f3f8fa940eac2d6b55ac917eb6a0cad0ce477bd077f32ca80979
    PhishDestroy
    Addresses
    104.21.85.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.201.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.85.38, 172.67.201.229): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    steamunderground.net
    Registered
    2024-08-02 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:47 UTC

    Suggest a correction

  92. uiok.xyz
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    uiok.xyz
    First seen
    2026-11-07 20:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:43 UTC to 2027-02-05 20:42 UTC
    Logged 2026-11-07 20:43 UTC in Geomys Tuscolo2027h1, entry 519,087,749
    SHA-256 ffd2a9b14ecc798106e5fd74b8d06e31c73dd75f6659c34e1ab21ac9fb3b48b4
    Public key SHA-256 cbb4432593eb43bd85dc3c415c345cfd295650c39aaee4f6299c1232a8d08dde
    Domain
    uiok.xyz
    Registered
    2026-09-09 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  93. www.ayumerito.com US · AS399629 · BL Networks
    ListedUnder ayumerito.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.ayumerito.com
    First seen
    2026-11-07 20:46 UTC
    Listing
    CERT Polska listed it 2026-08-29 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska, listing ayumerito.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Google PlumbersArms2027h1, entry 666,406,997
    SHA-256 5d74ddef67d6b0fd2b4ac2e4ab498dfd33386c69132a25161ae909f696160074
    Public key SHA-256 1ba02cf3c73ec2a4d8f06f5a2ebd0bf507d8c28b044478f918ca8d625d8ae15d
    Addresses
    198.13.158.16 · United States · AS399629 BLNWX - BL Networks
    Domain
    ayumerito.com
    Registered
    2026-08-29 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  94. www.fortwex.pro BD · AS153947 · FAST ZONE IT
    ReportedUnder fortwex.pro, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.fortwex.pro
    First seen
    2026-11-07 20:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 17:55 UTC
    Reported
    PhishDestroy, listing fortwex.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-07 19:46 UTC to 2027-02-05 19:46 UTC
    Logged 2026-11-07 20:45 UTC in Google PlumbersArms2027h1, entry 666,445,648
    SHA-256 73c725bc82ee193480ac8f168899f8c5bdac8f4af36d8c46d59d08aa499bbc00
    Public key SHA-256 1374f3df18bb3b6bbc532a0e72e2bc77db653f32a9bfe0b6636e62d24ca075d1
    PhishDestroy
    Addresses
    193.187.110.10 · Bangladesh · AS153947 FASTZONEIT-AS-AP - FAST ZONE IT
    Domain
    fortwex.pro
    Registered
    2026-09-02 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  95. www.pn5rig.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder pn5rig.net, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.pn5rig.net
    First seen
    2026-11-07 20:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing pn5rig.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 19:42 UTC to 2027-02-05 20:40 UTC
    Logged 2026-11-07 20:42 UTC in Google PlumbersArms2027h1, entry 666,412,230
    SHA-256 32f03d2fff69320ee2c5195459962b0db494545470d7aa46db00186cb1d55bd7
    Public key SHA-256 ddbbb10167f89ab50c115f5963629a65f78cabef7bd2ca255c8ca353a5c71e03
    Addresses
    104.21.67.190 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.179.196 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.67.190, 172.67.179.196): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pn5rig.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:47 UTC

    Suggest a correction

  96. yj520.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (phishing site)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    yj520.vip
    First seen
    2026-11-07 20:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 13:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 19:43 UTC to 2027-02-05 19:43 UTC
    Logged 2026-11-07 20:42 UTC in Google PlumbersArms2027h1, entry 666,407,043
    SHA-256 408128bd7a7b70e815bf799fb6b9564a68b75d7321f2929cd26f2d88456e499c
    Public key SHA-256 4e9c261c06e2c4d996408e70ce7c43da54543593cf6a6ffada0c220a58f08de1
    Addresses
    104.21.51.208 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.208, 172.67.185.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    yj520.vip
    Registered
    2026-03-16 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:21 UTC

    Suggest a correction

  97. 34lwvf.infoVisa
    ListedListed by JPCERT/CC as imitating VISAMX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    34lwvf.info
    First seen
    2026-11-07 20:41 UTC
    Listing
    JPCERT/CC confirmed it 2026-09-04 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 14:11 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:37 UTC to 2027-02-05 20:35 UTC
    Logged 2026-11-07 20:37 UTC in Google ParcelYard2027h1, entry 666,016,346
    SHA-256 50c29d42aa11b03a55ea7ad8963c4e2d5d77c2d302116af4e1dcb3174b97ea74
    Public key SHA-256 e6a9665924e0ad100cbf648326098954073c4813cdf2b7b4d22c5b5d9659f1de
    Brand
    Visa
    Domain
    34lwvf.info
    Registered
    2025-11-18 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Receives mail at route1.mx.cloudflare.net, route3.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 21:22 UTC

    Suggest a correction

  98. darkmatternetworkhgfd.cryptopayment.xyz US · AS14061 · DigitalOcean, LLC
    ListedDigitalOceanUnder cryptopayment.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    darkmatternetworkhgfd.cryptopayment.xyz
    First seen
    2026-11-07 20:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 17:56 UTC
    Listed
    MetaMask, listing cryptopayment.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 19:37 UTC to 2027-02-05 19:37 UTC
    Logged 2026-11-07 20:36 UTC in Let's Encrypt Sycamore2027h1, entry 1,025,572,041
    SHA-256 73a797206d19cd053a4a19a42d25ad2bb11c119223b0e4ab888675ff2019a8d4
    Public key SHA-256 6ba8f2adc1102660bd005d1182579b9750762efd05c19868ae5ebb8d63207454
    Addresses
    143.244.211.82 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (143.244.211.82): a cloud provider. It rents servers and addresses to its customers.
    Domain
    cryptopayment.xyz
    Registered
    2020-11-20 · Interstellar Registrar Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  99. lekkirendovikai.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    lekkirendovikai.net
    First seen
    2026-11-07 20:41 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 19:40 UTC to 2027-02-05 19:40 UTC
    Logged 2026-11-07 20:39 UTC in Google PlumbersArms2027h1, entry 666,368,433
    SHA-256 31f99f1f59222156a3faccf9302393b44d83c0c93df08a7235396baf75a64f03
    Public key SHA-256 a04957e1dced5f25ad2a1b3b6d888c5d2cd78b7fa701f221e32e6237a3c071e0
    Addresses
    104.21.82.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.166.114 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.82.254, 172.67.166.114): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lekkirendovikai.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:42 UTC

    Suggest a correction

  100. nwealth-app-solution-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    nwealth-app-solution-com.financecryptoworld.com
    First seen
    2026-11-07 20:41 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 18:27 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 19:37 UTC to 2027-02-05 20:37 UTC
    Logged 2026-11-07 20:37 UTC in Google ParcelYard2027h1, entry 666,022,303
    SHA-256 2c693a53c3397d87592224b35c6d6f792319f890c888ee681ad396174e8a2125
    Public key SHA-256 01f927317ba612d2fab760ae513fe7b520ab4d183c3949851d43e2186cb15a5b
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

Showing 1–100 of 6,086 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources