Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-08 04:11 UTC
Certificate-log entries · 24 h
315.2M
from 84 distinct feeds
Unique certificates · 24 h
30.6M
each reviewed
Names resolved · 24 h
19.7M
14.6M with an address
Findings · 24 h
5,745
206 of 1,061 brands targeted

5,745 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. 152dapp-admin.demo123.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder demo123.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    152dapp-admin.demo123.xyz
    First seen
    2026-11-08 04:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing demo123.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-11-08 03:00 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 04:07 UTC in Google Argon2027h1, entry 920,817,152
    SHA-256 9dbc8ebd819234113f82f724e4f255c6ccb74a1c01ec50458ada55fb1ce789aa
    Public key SHA-256 1014d56c0452953bb8d55cb0cc30419e1bea4f6aefd13c3a2082bc2e9d0d4070
    Addresses
    104.21.71.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.30, 172.67.142.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    demo123.xyz
    Registered
    2024-09-06 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:02 UTC

    Suggest a correction

  2. 152dapp-h5.demo123.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder demo123.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    152dapp-h5.demo123.xyz
    First seen
    2026-11-08 04:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing demo123.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-11-08 03:00 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 04:08 UTC in DigiCert Wyvern2027h1, entry 449,357,865
    SHA-256 02a6105f3ce1dc122288fd8211801e4d92bd3826b1e0edd912c98dfaf93668ca
    Public key SHA-256 a96eedf80f8e29ccf7a3e2131117909fea612e12fe361b97c94b0eae4a2af25b
    Addresses
    104.21.71.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.30, 172.67.142.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    demo123.xyz
    Registered
    2024-09-06 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:02 UTC

    Suggest a correction

  3. 152dappadminapi.demo123.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder demo123.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    152dappadminapi.demo123.xyz
    First seen
    2026-11-08 04:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing demo123.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-11-08 03:00 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 04:08 UTC in Google Xenon2027h1, entry 770,509,567
    SHA-256 d494aa0d97b52c6538cefee1a586267897ab230de98b2668a968a9520b1ce0ed
    Public key SHA-256 168e3bf9cff2aacb009c3d9251b2b76a2d250dbd6d7cfa5aefe667f48a2ebbf3
    Addresses
    104.21.71.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.30, 172.67.142.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    demo123.xyz
    Registered
    2024-09-06 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:02 UTC

    Suggest a correction

  4. 152dapph5api.demo123.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder demo123.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    152dapph5api.demo123.xyz
    First seen
    2026-11-08 04:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing demo123.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-11-08 03:00 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 04:07 UTC in Google Xenon2027h1, entry 770,507,559
    SHA-256 06396900300bafba7fb59344b073b2fdb5b61e74e424c10c38164cf5a8d40ad9
    Public key SHA-256 69423075a9d07119cb81028491b504059de2b4b615ee4cb8449d420fca9c1784
    Addresses
    104.21.71.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.30, 172.67.142.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    demo123.xyz
    Registered
    2024-09-06 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:02 UTC

    Suggest a correction

  5. 154gdapi.demo123.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder demo123.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    154gdapi.demo123.xyz
    First seen
    2026-11-08 04:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing demo123.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-11-08 03:00 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 04:06 UTC in Google Argon2027h1, entry 920,810,633
    SHA-256 4f57f2747be27ec5c0b728e0d2cdf4f61d344ba99e7898964d09ee89d7e044fc
    Public key SHA-256 a67a6305113e741683d598e38544547b323c7d54e887e4a61e0875d4187abdf6
    Addresses
    104.21.71.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.30, 172.67.142.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    demo123.xyz
    Registered
    2024-09-06 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:02 UTC

    Suggest a correction

  6. 154gdh5.demo123.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder demo123.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    154gdh5.demo123.xyz
    First seen
    2026-11-08 04:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing demo123.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-11-08 03:00 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 04:06 UTC in Google Xenon2027h1, entry 770,492,615
    SHA-256 44119eb8ff6bb79cfe20727c3b5fa6a3e6ce7985708c000bbeb6f6d9df56aca7
    Public key SHA-256 2b0ebf36709b8a5e83d3bc66210e01a3d346c70639126108a4d99ddf4d1b1c96
    Addresses
    104.21.71.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.30, 172.67.142.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    demo123.xyz
    Registered
    2024-09-06 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:02 UTC

    Suggest a correction

  7. actidel.ch US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    actidel.ch
    First seen
    2026-11-08 04:10 UTC
    Listing
    CERT Polska listed it 2026-06-02 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 03:10 UTC to 2027-02-06 03:10 UTC
    Logged 2026-11-08 04:08 UTC in Google PlumbersArms2027h1, entry 671,533,931
    SHA-256 9ce81abbc94a84f32025a81c49766e6e696e5e64434845f0dc33b9c27f9dbd4c
    Public key SHA-256 ff4f0b391919c82e4df3067a2946d7a494669474cd3e4e41bb5be74426ba1ced
    Addresses
    104.21.23.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.23.221, 172.67.213.246): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    actidel.ch
    MX
    Receives mail at omeaga-smtp.actidel.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  8. consul.polar-tensor.com DE · AS51167 · CONTABO Contabo GmbH4 addresses
    ListedContabo +1Under polar-tensor.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    consul.polar-tensor.com
    First seen
    2026-11-08 04:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing polar-tensor.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 03:10 UTC to 2027-02-06 03:10 UTC
    Logged 2026-11-08 04:09 UTC in Let's Encrypt Willow2027h1, entry 996,821,134
    SHA-256 6c3303a665fba084a2a145e4835a314300cc3cc49ad4fef3f90d9d024c231391
    Public key SHA-256 4a080bb1f7d4dc60ab5aed54742104d9020c68fb50c9a116c7719ad980e288da
    Addresses
    5.189.134.86 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    57.128.187.75 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    57.129.49.179 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    193.242.211.59 · Germany · AS58329 SERVINGA-NL servinga GmbH
    Contabo +1
    Contabo (5.189.134.86): a cloud provider. It rents servers and addresses to its customers. OVH (57.128.187.75, 57.129.49.179): a cloud provider. It rents servers and addresses to its customers.
    Domain
    polar-tensor.com
    Registered
    2025-04-28 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 19:34 UTC

    Suggest a correction

  9. ekzwnn.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ekzwnn.asia
    First seen
    2026-11-08 04:10 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 03:09 UTC to 2027-02-06 04:06 UTC
    Logged 2026-11-08 04:09 UTC in Let's Encrypt Sycamore2027h1, entry 1,036,019,621
    SHA-256 c455d67391f67f048973da7435822ce08a515fba76591f101a4b4424eebfea97
    Public key SHA-256 b03ecda01467688aee553b14300e3ab7225a4df6d29381bc5033f3cb1ec94b62
    Addresses
    104.21.62.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.19 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.159, 172.67.137.19): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ekzwnn.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  10. tedefe-curaxo.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tedefe-curaxo.info
    First seen
    2026-11-08 04:10 UTC
    Listing
    CERT Polska listed it 2026-05-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 03:09 UTC to 2027-02-06 03:09 UTC
    Logged 2026-11-08 04:07 UTC in DigiCert Sphinx2027h1, entry 397,441,436
    SHA-256 42dbe3a43264a3f2059d11f03f62d8d8172709e2b6463d05cc64baa615d9a923
    Public key SHA-256 1ff5431d4359166dffe189fe85d2c96f7481284e958b7dac6636be78cb2c968c
    Addresses
    104.21.30.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.30.83, 172.67.172.132): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tedefe-curaxo.info
    Registered
    2026-05-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  11. testnet-explorer.rally.fun US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder rally.fun, reported by PhishDestroyMX presentSPF ?allDMARC policy noneRegistered 19 mo ago
    DetailsHide
    Hostname
    testnet-explorer.rally.fun
    First seen
    2026-11-08 04:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing rally.fun and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 03:07 UTC to 2027-02-06 03:07 UTC
    Logged 2026-11-08 04:05 UTC in Google ParcelYard2027h1, entry 671,186,024
    SHA-256 89626077fd56023cb6584e824b92aed7dd09a75e8052c149c7369159595c0b36
    Public key SHA-256 f4503e098d9787fbf819f06caeb954d88d416bfd4809f103ec6862e0bbfa05d3
    PhishDestroy
    Addresses
    104.21.17.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.177.19 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.17.158, 172.67.177.19): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rally.fun
    Registered
    2025-04-29 · NameCheap, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ?all: other senders are neutral
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 08:26 UTC

    Suggest a correction

  12. top-kosi.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ListedHostingerListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    top-kosi.com
    First seen
    2026-11-08 04:10 UTC
    Listing
    CERT Polska listed it 2026-05-27 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 03:07 UTC to 2027-02-06 03:07 UTC
    Logged 2026-11-08 04:06 UTC in Google PlumbersArms2027h1, entry 671,510,566
    SHA-256 2b0d47554170358881db99df217269b18c410860a5236d06d1b8f15739f4b0ee
    Public key SHA-256 8c1dc5f25cc5279db5af7ca58bc8388798c56f2c0a3e7cd4ce95ea24dbf80b1d
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    top-kosi.com
    Registered
    2026-05-26 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  13. www.top-kosi.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ListedHostingerUnder top-kosi.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.top-kosi.com
    First seen
    2026-11-08 04:10 UTC
    Listing
    CERT Polska listed it 2026-05-27 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing top-kosi.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 03:07 UTC to 2027-02-06 03:07 UTC
    Logged 2026-11-08 04:06 UTC in Google PlumbersArms2027h1, entry 671,510,566
    SHA-256 2b0d47554170358881db99df217269b18c410860a5236d06d1b8f15739f4b0ee
    Public key SHA-256 8c1dc5f25cc5279db5af7ca58bc8388798c56f2c0a3e7cd4ce95ea24dbf80b1d
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    top-kosi.com
    Registered
    2026-05-26 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  14. www.web-uniswap.co.com RO · AS218721 · HSTX HOSTOX GROUP S.R.L.Uniswap
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    www.web-uniswap.co.com
    First seen
    2026-11-08 04:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.245.41.169.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 163.245.41.169
    Certificate
    Issued by YR1
    Valid 2026-11-08 02:59 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 03:58 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,792,507
    SHA-256 0ad6bf3ef62b2ad5efb565eb174bc2e1a4085c34205c9a79faeed4d897ee3424
    Public key SHA-256 1f890a33faefccc182efaa2b9656164dc18823a2ba91d87dea4381642874d121
    Brand
    Uniswap
    Addresses
    163.245.41.169 · Romania · AS218721 HSTX HOSTOX GROUP S.R.L.

    Suggest a correction

  15. web-uniswap.co.com RO · AS218721 · HSTX HOSTOX GROUP S.R.L.Uniswap
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    web-uniswap.co.com
    First seen
    2026-11-08 04:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.245.41.169.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 163.245.41.169
    Certificate
    Issued by YR1
    Valid 2026-11-08 02:59 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 03:58 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,792,507
    SHA-256 0ad6bf3ef62b2ad5efb565eb174bc2e1a4085c34205c9a79faeed4d897ee3424
    Public key SHA-256 1f890a33faefccc182efaa2b9656164dc18823a2ba91d87dea4381642874d121
    Brand
    Uniswap
    Addresses
    163.245.41.169 · Romania · AS218721 HSTX HOSTOX GROUP S.R.L.

    Suggest a correction

  16. aave.casa US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    aave.casa
    First seen
    2026-11-08 04:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 03:03 UTC to 2027-02-06 03:03 UTC
    Logged 2026-11-08 04:01 UTC in Geomys Tuscolo2027h1, entry 523,044,950
    SHA-256 6d21acbd08dc090892643f6996a4793afd9371e027fd30d011ae38ff881ce398
    Public key SHA-256 987968129adffe98ecb0bd8ab4150bfd1781d76d1db668f87bae13ea9f93d8ee
    Addresses
    104.21.50.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.215.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.50.247, 172.67.215.7): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aave.casa
    Registered
    2026-05-15 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at mail.aave.casa
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:08 UTC

    Suggest a correction

  17. aoimmigration.com US · AS31898 · Oracle Corporation
    ReportedOracle CloudReported by PhishTankMX presentSPF -allDMARC policy noneRegistered 19 mo ago
    DetailsHide
    Hostname
    aoimmigration.com
    First seen
    2026-11-08 04:05 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 04:06 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 03:05 UTC to 2027-02-06 03:05 UTC
    Logged 2026-11-08 04:03 UTC in DigiCert Wyvern2027h1, entry 449,320,906
    SHA-256 1d977f0db2bfca9c3bfd1ab67c2236d516edf7b5012f5aa3c735b44d83767a17
    Public key SHA-256 097858b2b359b551344a69eeb2a1c81f3cb755f42cb32c9e3ff181639a7b4862
    PhishTank
    PhishTank report #9324445
    Addresses
    192.185.37.234 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (192.185.37.234): a cloud provider. It rents servers and addresses to its customers.
    Domain
    aoimmigration.com
    Registered
    2025-04-14 · GoDaddy.com, LLC
    MX
    Receives mail at aoimmigration-com.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  18. biedronka-online.shop US · AS13335 · Cloudflare, Inc.Biedronka
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    biedronka-online.shop
    First seen
    2026-11-08 04:05 UTC
    Listing
    CERT Polska listed it 2026-05-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 03:06 UTC to 2027-02-06 03:06 UTC
    Logged 2026-11-08 04:05 UTC in Google ParcelYard2027h1, entry 671,180,417
    SHA-256 746bc788122564f192a58230b2af96b7f5b202ca7a3e21b39b23980a3972d2ff
    Public key SHA-256 ac14e8fe9a40c9c4ec1005d940e675b578f36bc05de732b7c2c0facecf02eca2
    Brand
    Biedronka
    Addresses
    104.18.22.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.22.122): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    biedronka-online.shop
    Registered
    2026-05-15 · Dynadot Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:08 UTC

    Suggest a correction

  19. dns2.floydldevine.com GB · AS201738 · UFO-TECHNOLOGIES-LIMITED UF…
    ListedUnder floydldevine.com, listed by CERT PolskaMX absentSPF -allDMARC missingRegistered 16 y ago
    DetailsHide
    Hostname
    dns2.floydldevine.com
    First seen
    2026-11-08 04:05 UTC
    Listing
    CERT Polska listed it 2026-06-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing floydldevine.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 03:06 UTC to 2027-02-06 03:06 UTC
    Logged 2026-11-08 04:04 UTC in Google ParcelYard2027h1, entry 671,174,735
    SHA-256 3d24ff1994bf18d3fd32e3d7684997b8b6949909136ade3e1e16f629bc8c5891
    Public key SHA-256 24a3f6f41c310b2e779eff8b48be305403798e9025979dd4b3200b108e3d939c
    Addresses
    109.238.86.5 · United Kingdom · AS201738 UFO-TECHNOLOGIES-LIMITED UFO TECHNOLOGIES LIMITED
    Domain
    floydldevine.com
    Registered
    2010-12-14 · eNom, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:53 UTC

    Suggest a correction

  20. mk6fsd.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    mk6fsd.hdiv8jy.com
    First seen
    2026-11-08 04:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 03:02 UTC to 2027-02-06 03:02 UTC
    Logged 2026-11-08 04:01 UTC in Google PlumbersArms2027h1, entry 671,461,108
    SHA-256 bd310e0a8ebfad04849350e242b016e72fc7a6764e0736427c1e185cc7230403
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  21. nexustocanada.com US · AS31898 · Oracle Corporation
    ReportedOracle CloudReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    nexustocanada.com
    First seen
    2026-11-08 04:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 03:05 UTC to 2027-02-06 03:05 UTC
    Logged 2026-11-08 04:03 UTC in DigiCert Wyvern2027h1, entry 449,320,906
    SHA-256 1d977f0db2bfca9c3bfd1ab67c2236d516edf7b5012f5aa3c735b44d83767a17
    Public key SHA-256 097858b2b359b551344a69eeb2a1c81f3cb755f42cb32c9e3ff181639a7b4862
    PhishDestroy
    Addresses
    192.185.37.234 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (192.185.37.234): a cloud provider. It rents servers and addresses to its customers.
    Domain
    nexustocanada.com
    Registered
    2017-12-08 · GoDaddy.com, LLC
    MX
    Receives mail at nexustocanada-com.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  22. tevehyvro.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tevehyvro.work
    First seen
    2026-11-08 04:05 UTC
    Listing
    CERT Polska listed it 2026-06-05 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 03:05 UTC to 2027-02-06 03:05 UTC
    Logged 2026-11-08 04:03 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,891,422
    SHA-256 4cc73ca16f28fac5e3ec80521e862dcc1f2b017d13059bfe4f3f834c9d946beb
    Public key SHA-256 b5447f60c3261560a891bd5da05e0d1ec34e4b61eb4ff0066bd7780c9827d9c6
    Addresses
    104.21.17.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.17.247, 172.67.178.229): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevehyvro.work
    Registered
    2026-05-14 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  23. wmzbulqc.vijwlakn.szaexjbt.kydhiwmv.kqiovdce.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    wmzbulqc.vijwlakn.szaexjbt.kydhiwmv.kqiovdce.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-08 04:05 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 04:03 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 03:06 UTC to 2027-02-06 03:06 UTC
    Logged 2026-11-08 04:04 UTC in Google PlumbersArms2027h1, entry 671,496,857
    SHA-256 72b8adddccee0ad97509005df9fe4996fa39a7761bd94a21812284219bf6fb38
    Public key SHA-256 4b2687ddde67559e23603ad9fec56e21aa648bcdb340557c365750b54cbcbf67
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  24. vox.sberbankmobile.ru RU · AS49063 · DTLN Data Storage Center JSCSberbank
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    vox.sberbankmobile.ru
    First seen
    2026-11-08 04:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 87.242.79.60.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 87.242.79.60
    Certificate
    Issued by YE1
    Valid 2026-11-08 02:51 UTC to 2027-02-06 02:51 UTC
    Logged 2026-11-08 03:50 UTC in Google PlumbersArms2027h1, entry 671,340,085
    SHA-256 9e3ff7a052d86160ac5d3cee6eba3ee6ed89ab3b42748d566a0d6a1375941189
    Public key SHA-256 980fdb20c72f71bb0ab1299228bb7882ea7d79a2818c2cfd554b2b189b59f804
    Brand
    Sberbank
    Addresses
    87.242.79.60 · Russia · AS49063 DTLN Data Storage Center JSC
    Domain
    sberbankmobile.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 22:30 UTC

    Suggest a correction

  25. gc3.sberbankmobile.ru RU · AS49063 · DTLN Data Storage Center JSCSberbank
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    gc3.sberbankmobile.ru
    First seen
    2026-11-08 04:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 87.242.79.60.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 87.242.79.60
    Certificate
    Issued by YE2
    Valid 2026-11-08 02:51 UTC to 2027-02-06 02:51 UTC
    Logged 2026-11-08 03:50 UTC in Google ParcelYard2027h1, entry 671,020,434
    SHA-256 01cd7a545c14633bec42c848c0bd2ea2a2faff5d36d9ca60851c4b882984106c
    Public key SHA-256 57b419058d5d79f6b7dedcf9d8d84e07d5e37279d10cfbabc596bbdfd5c9a289
    Brand
    Sberbank
    Addresses
    87.242.79.60 · Russia · AS49063 DTLN Data Storage Center JSC
    Domain
    sberbankmobile.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 22:30 UTC

    Suggest a correction

  26. blablacar.pay.0z6ppawgp06k9lh0.cdek.rhxyvcq9vvts2ld9.r.mail.leankoala.com FR · AS200484 · SENDINBLUE-ASN Sendinblue S…BlaBlaCar
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 11 y ago
    DetailsHide
    Hostname
    blablacar.pay.0z6ppawgp06k9lh0.cdek.rhxyvcq9vvts2ld9.r.mail.leankoala.com
    First seen
    2026-11-08 04:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.246.243.65.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.246.243.65
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 02:58 UTC to 2027-02-06 02:58 UTC
    Logged 2026-11-08 03:57 UTC in Let's Encrypt Willow2027h1, entry 996,690,260
    SHA-256 7769836401fbc58aff266a16b83ce3e56bebde5b00fa485a1b718be2873598db
    Public key SHA-256 93072374d5e8b02bac527032361ae523a5d1b98f238ffe89df809372743d8677
    Brand
    BlaBlaCar
    Addresses
    172.246.243.65 · France · AS200484 SENDINBLUE-ASN Sendinblue SAS
    Domain
    leankoala.com
    Registered
    2016-03-15 · united-domains GmbH
    MX
    Receives mail at mx00.udag.de, mx01.udag.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 22:30 UTC

    Suggest a correction

  27. apkguide.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ReportedHostinger CDNReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    apkguide.online
    First seen
    2026-11-08 04:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 03:01 UTC to 2027-02-06 03:01 UTC
    Logged 2026-11-08 03:59 UTC in Google ParcelYard2027h1, entry 671,121,575
    SHA-256 19f65d486347567340f11c441aba510d591253f43f37dcc474594e0834300277
    Public key SHA-256 c67b3558490ac71737fe33bafbde1d48732b6f7a89596b47e1a6ddabb7457be3
    PhishDestroy
    Addresses
    191.101.104.143 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger CDN (cdn)
    195.35.60.54 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger CDN (cdn)
    Hostinger CDN
    Hostinger CDN (191.101.104.143, 195.35.60.54): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    apkguide.online
    Registered
    2019-05-01 · NameCheap, Inc.
    MX
    Receives mail at mx1.titan.email, mx2.titan.email
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  28. extension.soflare.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    extension.soflare.org
    First seen
    2026-11-08 04:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 03:00 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 03:58 UTC in Geomys Tuscolo2027h1, entry 523,020,138
    SHA-256 1fb39c8ed596b66d9c5389f907dc303d435664b9129fdf2de14675b109fd257f
    Public key SHA-256 4c7bc65baf7bd16f8214ded901936a236726f99466472b296fffa7e89c5a1962
    Addresses
    104.21.48.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.41 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.48.7, 172.67.175.41): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    soflare.org
    Registered
    2026-07-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  29. f32824.com HK · AS45753 · Netsec Limited
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    f32824.com
    First seen
    2026-11-08 04:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Certum DV TLS G2 R39 CA
    Valid 2026-01-09 08:29 UTC to 2027-02-08 08:29 UTC
    Logged 2026-11-08 03:57 UTC in Sectigo Statue2027h1, entry 89,979,323
    SHA-256 2b1e42ef76ec8f06ce4b46112371754bd5ab686bc8bf5ae428b4821e231b76cb
    Public key SHA-256 ece6672c1b860c19267b01d6b0b8b18c2d2c516aec7f025c92bb49216533fe3c
    PhishDestroy
    Addresses
    182.16.38.77 · Hong Kong · AS45753 NETSEC-HK - Netsec Limited
    Domain
    f32824.com
    Registered
    2023-11-16 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  30. raydium-swap.co.com RO · AS218721 · HSTX HOSTOX GROUP S.R.L.Raydium
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    raydium-swap.co.com
    First seen
    2026-11-08 04:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.245.41.169.
    1. Phishing-host list fetched with the address
    2. Resolved to 163.245.41.169
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 02:59 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 03:58 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,794,606
    SHA-256 1f5fe8ca2e7ba266a9ad84d3f642bc8c8bfc7742410bda227f5028a28982f07f
    Public key SHA-256 94115a9f9f188279974c1d7aa91a5cb40c69e8b2c6831907893e00b4697c1fa2
    Brand
    Raydium
    Addresses
    163.245.41.169 · Romania · AS218721 HSTX HOSTOX GROUP S.R.L.

    Suggest a correction

  31. wertelogixprosoft.com NL · AS62370 · Snel Snel.com B.V.
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    wertelogixprosoft.com
    First seen
    2026-11-08 04:00 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 02:59 UTC to 2027-02-06 03:55 UTC
    Logged 2026-11-08 03:59 UTC in IPng Networks Halloumi2027h1, entry 406,925,627
    SHA-256 fb97f24c9a2c89e1caf888845eb82473689d583b0cdc1feb4c663aa1208c7e4d
    Public key SHA-256 f06f4faab31cd1ec098474c77b74f04ec384f12a4b556e3c3b03cd285392c64b
    Addresses
    185.62.58.179 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    wertelogixprosoft.com
    Registered
    2025-11-18 · MainReg Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  32. www.apkguide.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ReportedHostingerUnder apkguide.online, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    www.apkguide.online
    First seen
    2026-11-08 04:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing apkguide.online and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 03:01 UTC to 2027-02-06 03:01 UTC
    Logged 2026-11-08 03:59 UTC in Google ParcelYard2027h1, entry 671,121,575
    SHA-256 19f65d486347567340f11c441aba510d591253f43f37dcc474594e0834300277
    Public key SHA-256 c67b3558490ac71737fe33bafbde1d48732b6f7a89596b47e1a6ddabb7457be3
    PhishDestroy
    Addresses
    77.37.83.6 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    93.127.179.76 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (77.37.83.6, 93.127.179.76): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    apkguide.online
    Registered
    2019-05-01 · NameCheap, Inc.
    MX
    Receives mail at mx1.titan.email, mx2.titan.email
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  33. www.f32824.com HK · AS45753 · Netsec Limited
    ReportedUnder f32824.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    www.f32824.com
    First seen
    2026-11-08 04:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing f32824.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Certum DV TLS G2 R39 CA
    Valid 2026-01-09 08:29 UTC to 2027-02-08 08:29 UTC
    Logged 2026-11-08 03:57 UTC in Sectigo Statue2027h1, entry 89,979,323
    SHA-256 2b1e42ef76ec8f06ce4b46112371754bd5ab686bc8bf5ae428b4821e231b76cb
    Public key SHA-256 ece6672c1b860c19267b01d6b0b8b18c2d2c516aec7f025c92bb49216533fe3c
    PhishDestroy
    Addresses
    182.16.38.77 · Hong Kong · AS45753 NETSEC-HK - Netsec Limited
    Domain
    f32824.com
    Registered
    2023-11-16 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  34. www.raydium-swap.co.com RO · AS218721 · HSTX HOSTOX GROUP S.R.L.Raydium
    ListedPhishing hostUnder raydium-swap.co.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    www.raydium-swap.co.com
    First seen
    2026-11-08 04:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing raydium-swap.co.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 163.245.41.169.
    1. Phishing-host list fetched with the address
    2. Resolved to 163.245.41.169
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 02:59 UTC to 2027-02-06 02:59 UTC
    Logged 2026-11-08 03:58 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,794,606
    SHA-256 1f5fe8ca2e7ba266a9ad84d3f642bc8c8bfc7742410bda227f5028a28982f07f
    Public key SHA-256 94115a9f9f188279974c1d7aa91a5cb40c69e8b2c6831907893e00b4697c1fa2
    Brand
    Raydium
    Addresses
    163.245.41.169 · Romania · AS218721 HSTX HOSTOX GROUP S.R.L.

    Suggest a correction

  35. www.t32824.com HK · AS45753 · Netsec Limited
    ReportedUnder t32824.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    www.t32824.com
    First seen
    2026-11-08 04:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing t32824.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Certum DV TLS G2 R39 CA
    Valid 2026-01-09 08:29 UTC to 2027-02-08 08:29 UTC
    Logged 2026-11-08 03:57 UTC in Sectigo Statue2027h1, entry 89,979,323
    SHA-256 2b1e42ef76ec8f06ce4b46112371754bd5ab686bc8bf5ae428b4821e231b76cb
    Public key SHA-256 ece6672c1b860c19267b01d6b0b8b18c2d2c516aec7f025c92bb49216533fe3c
    PhishDestroy
    Addresses
    182.16.38.77 · Hong Kong · AS45753 NETSEC-HK - Netsec Limited
    Domain
    t32824.com
    Registered
    2023-11-16 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 06:54 UTC

    Suggest a correction

  36. www.abnamro.com.cn US · AS46844 · Sharktech5 addressesABN AMRO
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.abnamro.com.cn
    First seen
    2026-11-08 03:58 UTC
    First published
    2026-11-03 03:45 UTC
    DNS
    Resolves · checked 2026-11-08 03:58 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 208.98.43.38.
    1. Phishing-host list fetched with the address
    2. Resolved to 208.98.43.38
    Brand
    ABN AMRO
    Addresses
    208.98.43.38 · United States · AS46844 SHARKTECH - Sharktech
    208.98.40.32 · United States · AS46844 SHARKTECH - Sharktech
    208.98.40.223 · United States · AS46844 SHARKTECH - Sharktech
    208.98.43.91 · United States · AS46844 SHARKTECH - Sharktech
    208.98.43.97 · United States · AS46844 SHARKTECH - Sharktech
    Domain
    abnamro.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 14:31 UTC

    Suggest a correction

  37. btc-oxlant920.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    btc-oxlant920.net
    First seen
    2026-11-08 03:56 UTC
    Listing
    CERT Polska listed it 2026-09-07 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 02:53 UTC to 2027-02-06 02:53 UTC
    Logged 2026-11-08 03:52 UTC in Geomys Tuscolo2027h1, entry 522,967,633
    SHA-256 9766f696be86b31392512f5a11dafd92599c6cadb91b8c897b6085ad609a574c
    Public key SHA-256 31bd8c2bafb8972c8f438349fe3b14f2495aa7583169b1777b222f10fd5f388e
    Addresses
    104.21.7.3 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.135.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.7.3, 172.67.135.139): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    btc-oxlant920.net
    Registered
    2026-05-15 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  38. www.coinhouse-ai.com CA · AS55286 · B2 Net Solutions Inc.
    ListedUnder coinhouse-ai.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    www.coinhouse-ai.com
    First seen
    2026-11-08 03:56 UTC
    Listing
    CERT Polska listed it 2026-11-02 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing coinhouse-ai.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 02:53 UTC to 2027-02-06 02:53 UTC
    Logged 2026-11-08 03:51 UTC in Google PlumbersArms2027h1, entry 671,357,425
    SHA-256 378b4aca3f20f53c192fef538c463ad7b03752274588d16dbf41e9b9d8c3618a
    Public key SHA-256 0a6e5a76daf4239ea2872c5874cba3f116350b04fe58b1a12ba806daf28c53ab
    Addresses
    185.7.214.147 · Canada · AS55286 SERVER-MANIA - B2 Net Solutions Inc.
    Domain
    coinhouse-ai.com
    Registered
    2026-11-02 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:34 UTC

    Suggest a correction

  39. www.mobile.exchange.taxi AE · AS59692 · IQWEB IQWeb FZ-LLC
    ListedUnder exchange.taxi, listed by MetaMaskMX absentSPF ~allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    www.mobile.exchange.taxi
    First seen
    2026-11-08 03:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing exchange.taxi and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 02:54 UTC to 2027-02-06 02:54 UTC
    Logged 2026-11-08 03:53 UTC in IPng Networks Halloumi2027h1, entry 406,874,378
    SHA-256 b9e257afd25890fbe256f5ebc8819e9ce4be599f26745543d1ce9e1c87a1afb9
    Public key SHA-256 956ccc77ec0f3dbac1fe60ad0d540c03cd0d349c817ceaac7356a9bd8f8ad233
    Addresses
    186.2.175.41 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    exchange.taxi
    Registered
    2026-04-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 19:34 UTC

    Suggest a correction

  40. www.rastuxorresena.com CA · AS55286 · B2 Net Solutions Inc.
    ListedUnder rastuxorresena.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    www.rastuxorresena.com
    First seen
    2026-11-08 03:56 UTC
    Listing
    CERT Polska listed it 2026-11-02 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing rastuxorresena.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 02:53 UTC to 2027-02-06 02:53 UTC
    Logged 2026-11-08 03:51 UTC in IPng Networks Gouda2027h1, entry 349,955,989
    SHA-256 abf4a882b4e41254d0b69ce54a1a3055b97b5618b8602db7d2110b3fb0a29858
    Public key SHA-256 76bfb4d1b68e42c5baafb44f8e57afef84803bd2811af7d725f9aae79242b99a
    Addresses
    185.7.214.147 · Canada · AS55286 SERVER-MANIA - B2 Net Solutions Inc.
    Domain
    rastuxorresena.com
    Registered
    2026-11-02 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:37 UTC

    Suggest a correction

  41. ycdxkf.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ycdxkf.asia
    First seen
    2026-11-08 03:56 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 01:55 UTC to 2026-12-09 02:54 UTC
    Logged 2026-11-08 03:54 UTC in Geomys Tuscolo2026h2, entry 1,045,634,229
    SHA-256 04e8e846f6333a6562fadcaa8d65474b87fd0b449c40925b8ba49c451653561e
    Public key SHA-256 71843054832fea3b1aed5dd192b4ff74fbc09ed942f51c4ac3c99983f60cfdab
    Addresses
    104.21.10.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.181 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.62, 172.67.144.181): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ycdxkf.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  42. 117508.sberbankmobile.ru RU · AS49063 · DTLN Data Storage Center JSCSberbank
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    117508.sberbankmobile.ru
    First seen
    2026-11-08 03:51 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 87.242.79.60.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 87.242.79.60
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 02:51 UTC to 2027-02-06 02:51 UTC
    Logged 2026-11-08 03:50 UTC in IPng Networks Halloumi2027h1, entry 406,844,815
    SHA-256 1812d9a6a2f01853d3c9330fcebbb065a6034d5ebfa94a3dd6223016db44ecd5
    Public key SHA-256 6976b102b2cc885ca3ef38740f1b4cc75397c92b28fef559e8ba80a5a61e97af
    Brand
    Sberbank
    Addresses
    87.242.79.60 · Russia · AS49063 DTLN Data Storage Center JSC
    Domain
    sberbankmobile.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 22:30 UTC

    Suggest a correction

  43. ffxxrd.icu US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    ffxxrd.icu
    First seen
    2026-11-08 03:51 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 02:48 UTC to 2027-02-06 03:46 UTC
    Logged 2026-11-08 03:48 UTC in Google ParcelYard2027h1, entry 671,010,465
    SHA-256 54bf46bca36bcfcc6302aabde209b76da33cc4455987ebb03b7258267344e08e
    Public key SHA-256 6bba1c5ed7660e34922507bafec7c0af8b04f410014ec42e2af7c5c90f8651a8
    Addresses
    104.21.1.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.1.249, 172.67.128.107): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ffxxrd.icu
    Registered
    2026-01-16 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  44. mpspay.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    mpspay.asia
    First seen
    2026-11-08 03:51 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 02:46 UTC to 2027-02-06 03:44 UTC
    Logged 2026-11-08 03:46 UTC in DigiCert Sphinx2027h1, entry 397,282,714
    SHA-256 28260e24c956ea45e2699a565ae61e986233d2d7e7737438771d49410cd30a66
    Public key SHA-256 0c2936e1b84b5f7cd72bb24bdfa8e4b42bce7ffcc2b9c890d4b4a16abe0cd9fb
    Addresses
    104.21.61.232 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.61.232, 172.67.216.13): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mpspay.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  45. spenosiza.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX absentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    spenosiza.cc
    First seen
    2026-11-08 03:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 02:52 UTC to 2027-02-06 02:52 UTC
    Logged 2026-11-08 03:51 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,638,743
    SHA-256 29834caa7fa384e7bb73c342c2324374582aad240685162edaf272fbedcfc0bc
    Public key SHA-256 47313727fb667f1ef8f547b3ac54772b7198fecf68bb2ae71cdf9d645f8808cf
    PhishDestroy
    Addresses
    103.224.182.250 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates spenosiza.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.250): a parking service. It answers for names that are typically for sale or unused.
    Domain
    spenosiza.cc
    Registered
    2025-11-07 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  46. thntax.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    thntax.asia
    First seen
    2026-11-08 03:51 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 02:55 UTC to 2026-12-09 02:53 UTC
    Logged 2026-11-08 03:47 UTC in Let's Encrypt Sycamore2026h2, entry 1,080,083,434
    SHA-256 10c5df84b63135486fae66ecfe4077eaae4ea78855005c9f932efb76926b535d
    Public key SHA-256 6ec114dd528503c7d048f78b2fcd3f97c8708151931cc5a9dedc40aa2bb1d9a6
    Addresses
    104.21.21.160 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.21.160, 172.67.199.90): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    thntax.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  47. www.udjelovnica-ai.com CA · AS55286 · B2 Net Solutions Inc.3 addresses
    ListedUnder udjelovnica-ai.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    www.udjelovnica-ai.com
    First seen
    2026-11-08 03:51 UTC
    Listing
    CERT Polska listed it 2026-11-02 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing udjelovnica-ai.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 02:47 UTC to 2027-02-06 02:47 UTC
    Logged 2026-11-08 03:46 UTC in Geomys Tuscolo2027h1, entry 522,913,645
    SHA-256 069a28bad28695fbf7db320bcb461ab95f2e78d2ea1226d83cd3941c4fba8251
    Public key SHA-256 116b419e616ab6cab5c460f0da25dce3ba0a3546f1a89418b7ea3735493ad004
    Addresses
    185.7.214.147 · Canada · AS55286 SERVER-MANIA - B2 Net Solutions Inc.
    2606:4700:3032::6815:2db8
    2606:4700:3032::ac43:da1e
    Domain
    udjelovnica-ai.com
    Registered
    2026-11-01 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:30 UTC

    Suggest a correction

  48. zebiqg.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    zebiqg.asia
    First seen
    2026-11-08 03:51 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 02:46 UTC to 2027-02-06 03:42 UTC
    Logged 2026-11-08 03:46 UTC in Google ParcelYard2027h1, entry 670,985,957
    SHA-256 0aeb4288d677b2b18a9112a37eea68f058395270e9cd3440beb246f16dc07594
    Public key SHA-256 4226a65d79ad4d8e12c645292b5e4dcf91438962bff2e8614debec172cce614f
    Addresses
    104.21.78.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.3 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.78.168, 172.67.136.3): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zebiqg.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  49. 55gh2cxl6qzvxb1j.mlvrgycn.mcqubflz.xvucqyer.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    55gh2cxl6qzvxb1j.mlvrgycn.mcqubflz.xvucqyer.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-08 03:46 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 04:03 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 02:43 UTC to 2027-02-06 02:43 UTC
    Logged 2026-11-08 03:41 UTC in Google ParcelYard2027h1, entry 670,937,737
    SHA-256 48e7b7d9b2f7671bd8d36627ad3da07d5787c23e5fa86c4b7823ab2f82c98af5
    Public key SHA-256 65bf6776876e286b15b27d033809e07168d93323868ee62efa8db302a05c5936
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  50. citrine-sandal.shop US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    citrine-sandal.shop
    First seen
    2026-11-08 03:46 UTC
    Listing
    CERT Polska listed it 2026-09-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 02:42 UTC to 2027-02-06 03:41 UTC
    Logged 2026-11-08 03:42 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,460,003
    SHA-256 0d13defa625d4b3b1092d77844cfa30b873ce73eee960170e4caa5e789b70ff9
    Public key SHA-256 033af8e55c5221da09a9922d8633ffd6f617d1a13c5ef1d0ce43f6ee293fdbf7
    Addresses
    104.18.71.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.71.116): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    citrine-sandal.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:47 UTC

    Suggest a correction

  51. fpdlejbw.gmjhtakx.jigcvzysl.vzchbewo.yidmvuao.tkmxdgnv.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    fpdlejbw.gmjhtakx.jigcvzysl.vzchbewo.yidmvuao.tkmxdgnv.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-08 03:46 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 04:03 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 02:43 UTC to 2027-02-06 02:43 UTC
    Logged 2026-11-08 03:41 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,438,260
    SHA-256 f90ee3d9c955e9d850fad1b470ac496d5306c0e3da0f1167ec75c9932bb0b1ac
    Public key SHA-256 d6034c146f244e72bb20f5956667ff43a1204ca8d8f06e667368d3e8ac9f1cd5
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  52. hb2979.com US · AS401696 · cognetcloud INC
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    hb2979.com
    First seen
    2026-11-08 03:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-09-30 15:11 UTC to 2026-12-29 15:11 UTC
    Logged 2026-11-08 03:42 UTC in DigiCert Wyvern2026h2, entry 2,211,399,535
    SHA-256 292d182f2fe5d7f9487a0a2ac234c9bd7f96334e5bca1a41a186365949fd63dd
    Public key SHA-256 2b12386946aee08c766f925933c443715e3453bc0e0c5f966fed832003ceeede
    PhishDestroy
    Addresses
    154.201.71.14 · United States · AS401696 COGNETCLOUD - cognetcloud INC
    Domain
    hb2979.com
    Registered
    2016-07-06 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  53. officeadrnin.org US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    officeadrnin.org
    First seen
    2026-11-08 03:46 UTC
    Listing
    CERT Polska listed it 2026-05-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-08 03:43 UTC to 2027-05-25 03:43 UTC
    Logged 2026-11-08 03:43 UTC in GoDaddy Aquamarine2027h1, entry 194,398,731
    SHA-256 23424d2aa0e619b14e3a17bcfb61ae908c338008705b540e96b8d37f34ce1b07
    Public key SHA-256 0243489ed1755ec7806794c6e8d92eafafa3aa4b66209b48e049f73a45aa2a24
    Addresses
    15.197.172.60 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (15.197.172.60): a cloud provider. It rents servers and addresses to its customers.
    Domain
    officeadrnin.org
    Registered
    2025-11-06 · eNom, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  54. stableyleldcub.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    stableyleldcub.com
    First seen
    2026-11-08 03:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 02:44 UTC to 2027-02-06 02:44 UTC
    Logged 2026-11-08 03:43 UTC in DigiCert Wyvern2027h1, entry 449,149,140
    SHA-256 d44eb02cc875a80f3ec1842393c3c27c2fbe3d93f7b686e5b46b13df3171d522
    Public key SHA-256 28a676833f8ff65cb9470ccc20435805cd593c93cc6494e28a543af1c051e46e
    Addresses
    104.21.57.238 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.151.211 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.57.238, 172.67.151.211): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    stableyleldcub.com
    Registered
    2026-09-10 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  55. stupina.eu RO · AS31244 · MYSERVER-MEDIA-AS MY SERVER…
    ReportedReported by PhishTankMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    stupina.eu
    First seen
    2026-11-08 03:46 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 04:06 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 02:47 UTC to 2027-02-06 02:47 UTC
    Logged 2026-11-08 03:45 UTC in Let's Encrypt Willow2027h1, entry 996,568,076
    SHA-256 6a84de7d90c931e8f39f2ba92659f9940f9e230034bf7d16ca063818e5a3c28e
    Public key SHA-256 32236cfc399e1ffbd95eff7fb604da4d3f511778438972a7dc72b035789e1395
    PhishTank
    PhishTank report #7810905
    Addresses
    91.216.156.40 · Romania · AS31244 MYSERVER-MEDIA-AS MY SERVER MEDIA SRL
    Domain
    stupina.eu
    MX
    Receives mail at stupina.eu
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 03:47 UTC

    Suggest a correction

  56. www.bslimanowa2026.tsn.one PL · AS210379 · PROGRESO PROGRESO.PL Sp. z …
    ListedListed by CERT PolskaMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    www.bslimanowa2026.tsn.one
    First seen
    2026-11-08 03:46 UTC
    Listing
    CERT Polska listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 02:45 UTC to 2027-02-06 02:45 UTC
    Logged 2026-11-08 03:44 UTC in DigiCert Sphinx2027h1, entry 397,263,706
    SHA-256 47fea0a301855fc3f66ed1045fe7d3faebcbe22d87bc76f353496ed6235437d3
    Public key SHA-256 07ff7a46b8c2289629cbc83081c8f15fe36fb1c0a5aa29e64ff409e3f358173c
    Addresses
    77.65.213.104 · Poland · AS210379 PROGRESO PROGRESO.PL Sp. z o.o.
    Domain
    tsn.one
    MX
    Receives mail at mx1.progreso.pl, mx2.progreso.pl, mx3.progreso.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 03:47 UTC

    Suggest a correction

  57. www.hb2979.com US · AS401696 · cognetcloud INC
    ReportedUnder hb2979.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    www.hb2979.com
    First seen
    2026-11-08 03:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing hb2979.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-09-30 15:11 UTC to 2026-12-29 15:11 UTC
    Logged 2026-11-08 03:42 UTC in DigiCert Wyvern2026h2, entry 2,211,399,535
    SHA-256 292d182f2fe5d7f9487a0a2ac234c9bd7f96334e5bca1a41a186365949fd63dd
    Public key SHA-256 2b12386946aee08c766f925933c443715e3453bc0e0c5f966fed832003ceeede
    PhishDestroy
    Addresses
    154.201.71.14 · United States · AS401696 COGNETCLOUD - cognetcloud INC
    Domain
    hb2979.com
    Registered
    2016-07-06 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  58. ytg5fd45dfq.mexcglobal.cc HK · AS152194 · CTG Server Limited
    ListedUnder mexcglobal.cc, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 25 d ago
    DetailsHide
    Hostname
    ytg5fd45dfq.mexcglobal.cc
    First seen
    2026-11-08 03:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing mexcglobal.cc and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 02:43 UTC to 2027-02-06 02:43 UTC
    Logged 2026-11-08 03:41 UTC in Geomys Tuscolo2027h1, entry 522,877,091
    SHA-256 4cbacedf3ee79bb1b8acd9cbe8014c6cc6eeb2ca250daec08975ae34e1bb4f19
    Public key SHA-256 933563dbbfe608e9f195573b8b41671d7f529789511add94a987d7e1965c0c21
    Addresses
    202.79.175.136 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    mexcglobal.cc
    Registered
    2026-10-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 07:07 UTC

    Suggest a correction

  59. ytg5fd45dfq.mexcglobal.top HK · AS152194 · CTG Server Limited
    ListedUnder mexcglobal.top, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 25 d ago
    DetailsHide
    Hostname
    ytg5fd45dfq.mexcglobal.top
    First seen
    2026-11-08 03:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing mexcglobal.top and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 02:43 UTC to 2027-02-06 02:43 UTC
    Logged 2026-11-08 03:41 UTC in Geomys Tuscolo2027h1, entry 522,877,091
    SHA-256 4cbacedf3ee79bb1b8acd9cbe8014c6cc6eeb2ca250daec08975ae34e1bb4f19
    Public key SHA-256 933563dbbfe608e9f195573b8b41671d7f529789511add94a987d7e1965c0c21
    Addresses
    202.79.175.136 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    mexcglobal.top
    Registered
    2026-10-14 · gadomains
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 07:07 UTC

    Suggest a correction

  60. ytg5fd45dfq.mexcglobal.vip HK · AS152194 · CTG Server Limited
    ListedUnder mexcglobal.vip, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 25 d ago
    DetailsHide
    Hostname
    ytg5fd45dfq.mexcglobal.vip
    First seen
    2026-11-08 03:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing mexcglobal.vip and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 02:43 UTC to 2027-02-06 02:43 UTC
    Logged 2026-11-08 03:41 UTC in Geomys Tuscolo2027h1, entry 522,877,091
    SHA-256 4cbacedf3ee79bb1b8acd9cbe8014c6cc6eeb2ca250daec08975ae34e1bb4f19
    Public key SHA-256 933563dbbfe608e9f195573b8b41671d7f529789511add94a987d7e1965c0c21
    Addresses
    202.79.175.136 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    mexcglobal.vip
    Registered
    2026-10-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 07:07 UTC

    Suggest a correction

  61. ad648mis.fxxprocoin.vip HK · AS152194 · CTG Server Limited
    ListedUnder fxxprocoin.vip, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    ad648mis.fxxprocoin.vip
    First seen
    2026-11-08 03:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-05 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing fxxprocoin.vip and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 02:39 UTC to 2027-02-06 02:39 UTC
    Logged 2026-11-08 03:37 UTC in IPng Networks Gouda2027h1, entry 349,848,795
    SHA-256 4c91a442de7dda3a59a37e23881025fa6b686dc9738fcaa4e3b557f2467cf652
    Public key SHA-256 e0d925639b32f7a349619320d94363e1a10bf07cd9870350813594e1691173f8
    Addresses
    202.79.175.136 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    fxxprocoin.vip
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:42 UTC

    Suggest a correction

  62. bioelectrophotonicinterconnectivity.cryptopayment.xyz US · AS14061 · DigitalOcean, LLC
    ListedDigitalOceanUnder cryptopayment.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    bioelectrophotonicinterconnectivity.cryptopayment.xyz
    First seen
    2026-11-08 03:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing cryptopayment.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 02:40 UTC to 2027-02-06 02:39 UTC
    Logged 2026-11-08 03:38 UTC in DigiCert Sphinx2027h1, entry 397,216,145
    SHA-256 70ca3966c16a2e6caa42f91c357557a74ef6f19000ad2f862e05731c36a4bbff
    Public key SHA-256 cb50012549bae8c9f32ba029abf1584bbaa61c6064b6045d333e69608969b9e5
    Addresses
    143.244.211.82 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (143.244.211.82): a cloud provider. It rents servers and addresses to its customers.
    Domain
    cryptopayment.xyz
    Registered
    2020-11-20 · Interstellar Registrar Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  63. letong77790686.cryptopayment.xyz US · AS14061 · DigitalOcean, LLC
    ListedDigitalOceanUnder cryptopayment.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    letong77790686.cryptopayment.xyz
    First seen
    2026-11-08 03:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing cryptopayment.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 02:38 UTC to 2027-02-06 02:38 UTC
    Logged 2026-11-08 03:36 UTC in Geomys Tuscolo2027h1, entry 522,835,674
    SHA-256 96612c4b65f1990ad0bbb12669f93754e48998f633a8b83a52ac5de149a065aa
    Public key SHA-256 445eb6a6edb037a4245039daab04d2b8de3d11822bb0fde79e24770601908c28
    Addresses
    143.244.211.82 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (143.244.211.82): a cloud provider. It rents servers and addresses to its customers.
    Domain
    cryptopayment.xyz
    Registered
    2020-11-20 · Interstellar Registrar Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  64. scjvam.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    scjvam.asia
    First seen
    2026-11-08 03:41 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 01:54 UTC to 2026-12-09 02:53 UTC
    Logged 2026-11-08 03:40 UTC in Geomys Tuscolo2026h2, entry 1,045,614,748
    SHA-256 80af8b661b82264e393bd1416e82af6250e8f1d08649d52842b8428020b64aee
    Public key SHA-256 fac6b21d6214ed5e3713ece58aec78cedf0759293ee36a161053c725ea278f90
    Addresses
    104.21.21.231 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.200.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.21.231, 172.67.200.243): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    scjvam.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  65. us956web-zoom.us US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    us956web-zoom.us
    First seen
    2026-11-08 03:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    USOM listed it 2026-11-06 · still listed at the last successful feed check 2026-11-08 04:03 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 02:40 UTC to 2027-02-06 02:40 UTC
    Logged 2026-11-08 03:39 UTC in Google PlumbersArms2027h1, entry 671,229,155
    SHA-256 c5dbe542963d66e11adae83b2b3024998f284101a2ed4d29756486e0512e7460
    Public key SHA-256 625812e18f5b8bd222b7b37ec342967f87de48214718c9163ded705860975fe6
    Addresses
    104.21.3.21 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.130.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.3.21, 172.67.130.13): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    us956web-zoom.us
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:42 UTC

    Suggest a correction

  66. www.scarletnode.net CA · AS55286 · B2 Net Solutions Inc.3 addresses
    ListedUnder scarletnode.net, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    www.scarletnode.net
    First seen
    2026-11-08 03:41 UTC
    Listing
    CERT Polska listed it 2026-11-02 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing scarletnode.net and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 02:41 UTC to 2027-02-06 02:41 UTC
    Logged 2026-11-08 03:40 UTC in DigiCert Wyvern2027h1, entry 449,121,417
    SHA-256 4f54299463f9f4a1275278d2af28bb55bc12e3eedcffbfc314b030c2f8d0d6ca
    Public key SHA-256 c418598e8411c92785ae84bdfe1f937c39650708a1d79fa528ddbe4c9c7d725a
    Addresses
    185.7.214.147 · Canada · AS55286 SERVER-MANIA - B2 Net Solutions Inc.
    2606:4700:3037::6815:278f
    2606:4700:3037::ac43:921d
    Domain
    scarletnode.net
    Registered
    2026-11-01 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 08:30 UTC

    Suggest a correction

  67. anniversaryclaim.dpdns.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroy
    DetailsHide
    Hostname
    anniversaryclaim.dpdns.org
    First seen
    2026-11-08 03:36 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-07 23:56 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-31 (6 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 02:36 UTC to 2027-02-06 02:36 UTC
    Logged 2026-11-08 03:34 UTC in Google ParcelYard2027h1, entry 670,861,008
    SHA-256 15badb3d538a14bad3af2c0e9400ffc7cd6b41a16276d25f36b29b018a353132
    Public key SHA-256 c393859d85870f8b92f4320eacd6c2591223d89b819e0e5c6c221ef1e009520d
    PhishDestroy
    Addresses
    104.21.71.189 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.148.20 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.189, 172.67.148.20): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  68. api.astrariseprofitssystem-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    api.astrariseprofitssystem-com.financecryptoworld.com
    First seen
    2026-11-08 03:36 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 02:34 UTC to 2027-02-06 03:34 UTC
    Logged 2026-11-08 03:34 UTC in Google ParcelYard2027h1, entry 670,863,814
    SHA-256 b2e7292ef67af6fcff8d0fa5b08846d215f49aa36b01c94b5675302da559f2a8
    Public key SHA-256 f09c831af2f368d38a5f5e0845fbb8f04e6b35aec5f507af259331c8d5285a9a
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  69. api.quantum-ai-project-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    api.quantum-ai-project-com.financecryptoworld.com
    First seen
    2026-11-08 03:36 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 02:31 UTC to 2027-02-06 03:30 UTC
    Logged 2026-11-08 03:31 UTC in Geomys Tuscolo2027h1, entry 522,784,698
    SHA-256 c818eee78bf815a983af2bb70c0c81aca8c2353a92ef9ee0e19dc58ed4be4b49
    Public key SHA-256 4f17f97dbe3648b33dffe17e40ddde18d2021aadca2d4daf5ccdbae925cb17e4
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  70. api.testnet.fogolend.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder fogolend.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    api.testnet.fogolend.com
    First seen
    2026-11-08 03:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing fogolend.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 02:31 UTC to 2027-02-06 03:26 UTC
    Logged 2026-11-08 03:31 UTC in DigiCert Wyvern2027h1, entry 449,070,753
    SHA-256 265514ef112ea38d219a39c6d249f1ac532a10727c5c1f0b29614845ac96bf40
    Public key SHA-256 2644e4873cf275613de39337d276a1b067b90b68d2263d95082cdc6001ea04bf
    PhishDestroy
    Addresses
    104.21.96.16 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.150.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.96.16, 172.67.150.64): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fogolend.com
    Registered
    2025-08-28 · NameCheap, Inc.
    MX
    Receives mail at route2.mx.cloudflare.net, route1.mx.cloudflare.net, route3.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:37 UTC

    Suggest a correction

  71. barman.pt.shorturl.pt PT · AS24768 · ALMOUROLTEC ALMOUROLTEC SER…
    ReportedUnder shorturl.pt, reported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    barman.pt.shorturl.pt
    First seen
    2026-11-08 03:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing shorturl.pt and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 02:34 UTC to 2027-02-06 02:34 UTC
    Logged 2026-11-08 03:33 UTC in Google PlumbersArms2027h1, entry 671,163,041
    SHA-256 3d6bded5fa3899dc8b71c31e8d5a0aebb5f83a4a89a021318013042facbced59
    Public key SHA-256 5f765e828797e3f89c7231fb54d8373452d27da80e09030780d97271616ee9ec
    PhishDestroy
    Addresses
    94.46.183.47 · Portugal · AS24768 ALMOUROLTEC ALMOUROLTEC SERVICOS DE INFORMATICA E INTERNET LDA
    Domain
    shorturl.pt
    MX
    Receives mail at mail.shorturl.pt
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 03:42 UTC

    Suggest a correction

  72. deserve.ostrovsky.sk FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ostrovsky.sk, listed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    deserve.ostrovsky.sk
    First seen
    2026-11-08 03:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing ostrovsky.sk and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 02:36 UTC to 2027-02-06 02:36 UTC
    Logged 2026-11-08 03:34 UTC in Google ParcelYard2027h1, entry 670,865,368
    SHA-256 8e459b9f5891b06243069c3ad49d188e2cad7d6ee43de989247c6b4bed42d2bd
    Public key SHA-256 d9153f2cffeb2f35c2838ab911e812ba3a9da9853d73cad15602e182ee7348fd
    Addresses
    54.36.26.88 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (54.36.26.88): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ostrovsky.sk
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:37 UTC

    Suggest a correction

  73. merkl-rewards.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    merkl-rewards.xyz
    First seen
    2026-11-08 03:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 02:36 UTC to 2027-02-06 02:36 UTC
    Logged 2026-11-08 03:35 UTC in Google ParcelYard2027h1, entry 670,868,066
    SHA-256 1e5b69394d64f7364445333f757b12768f593e097fa2c1d6e5a36ccc5767e288
    Public key SHA-256 3c4e5491d002ac79d8a6e0a0b74a6f13a3b37bb177e6ad4903b575d8525bdfbf
    Addresses
    104.21.7.238 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.156.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.7.238, 172.67.156.139): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    merkl-rewards.xyz
    Registered
    2026-05-15 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  74. registry.lightchain.ai AU · AS18381 · RedSwitches
    ReportedUnder lightchain.ai, reported by PhishDestroyMX presentSPF -allDMARC policy noneRegistered 24 mo ago
    DetailsHide
    Hostname
    registry.lightchain.ai
    First seen
    2026-11-08 03:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing lightchain.ai and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 02:37 UTC to 2027-02-06 02:37 UTC
    Logged 2026-11-08 03:35 UTC in Let's Encrypt Willow2027h1, entry 996,473,603
    SHA-256 9f33f0ec35dfaac9df56e2ad641661343520bcb6bd8ce7d9ad054d95d149e703
    Public key SHA-256 2a22c80150b92a9407e7821bce3e23245565c84c37d1159be6eb2e7d7ed0a575
    PhishDestroy
    Addresses
    103.41.177.44 · Australia · AS18381 RSL-AS-AP - RedSwitches
    Domain
    lightchain.ai
    Registered
    2024-11-21 · Name.com, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 08:39 UTC

    Suggest a correction

  75. shorturl.pt PT · AS24768 · ALMOUROLTEC ALMOUROLTEC SER…
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    shorturl.pt
    First seen
    2026-11-08 03:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 02:34 UTC to 2027-02-06 02:34 UTC
    Logged 2026-11-08 03:33 UTC in Google PlumbersArms2027h1, entry 671,163,041
    SHA-256 3d6bded5fa3899dc8b71c31e8d5a0aebb5f83a4a89a021318013042facbced59
    Public key SHA-256 5f765e828797e3f89c7231fb54d8373452d27da80e09030780d97271616ee9ec
    PhishDestroy
    Addresses
    94.46.183.47 · Portugal · AS24768 ALMOUROLTEC ALMOUROLTEC SERVICOS DE INFORMATICA E INTERNET LDA
    Domain
    shorturl.pt
    MX
    Receives mail at mail.shorturl.pt
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 03:42 UTC

    Suggest a correction

  76. staff.exchange.taxi AE · AS59692 · IQWEB IQWeb FZ-LLC
    ListedUnder exchange.taxi, listed by MetaMaskMX absentSPF ~allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    staff.exchange.taxi
    First seen
    2026-11-08 03:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing exchange.taxi and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 02:32 UTC to 2027-02-06 02:32 UTC
    Logged 2026-11-08 03:31 UTC in IPng Networks Gouda2027h1, entry 349,807,016
    SHA-256 c1d4978ae4dc2ee3f23655f29ab84fd665a808e181ec0d2de4e68794f8043c0f
    Public key SHA-256 7ed1ae1dcaf45c597fc754e10609ffdadaef83e5d51e8a2ab93521197d745540
    Addresses
    186.2.175.41 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    exchange.taxi
    Registered
    2026-04-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 19:34 UTC

    Suggest a correction

  77. treasuryuamq.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    treasuryuamq.com
    First seen
    2026-11-08 03:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 01:35 UTC to 2026-12-09 02:34 UTC
    Logged 2026-11-08 03:33 UTC in DigiCert Wyvern2026h2, entry 2,211,388,250
    SHA-256 25238cf8e29ff757af360933bde6a8fcaa044bd7418f49f65aecfa6f9e04dcbc
    Public key SHA-256 8b77b8851bc0f48bd3cba7a6482e1db18d774f7c6d8c31f961cccec3a90b487d
    Addresses
    104.21.17.215 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.17.215, 172.67.178.85): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    treasuryuamq.com
    Registered
    2026-09-10 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  78. ufymqc.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ufymqc.asia
    First seen
    2026-11-08 03:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-08 02:34 UTC to 2027-02-06 03:31 UTC
    Logged 2026-11-08 03:34 UTC in DigiCert Wyvern2027h1, entry 449,090,849
    SHA-256 3939cfa8f56decdee41812cf9adcf0a576d05cbcfc81509199aff0539d9eaef1
    Public key SHA-256 fcd9bd6025c1be5a11ad4b39e7f8d5c0b9560718e7a14e3e60536d167ef09ca9
    Addresses
    104.21.45.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.174 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.45.251, 172.67.221.174): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ufymqc.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  79. v2.exchange.taxi AE · AS59692 · IQWEB IQWeb FZ-LLC
    ListedUnder exchange.taxi, listed by MetaMaskMX absentSPF ~allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    v2.exchange.taxi
    First seen
    2026-11-08 03:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Listed
    MetaMask, listing exchange.taxi and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 02:36 UTC to 2027-02-06 02:36 UTC
    Logged 2026-11-08 03:34 UTC in Let's Encrypt Sycamore2027h1, entry 1,035,300,767
    SHA-256 11c0764f2c74c295c144d3533c5d5935a7718b9a117cf95be83784e457f9a995
    Public key SHA-256 15a740d7316f138f126b5582612fce911f173ae2a9f4bd7577bf4f499a512851
    Addresses
    186.2.175.41 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    exchange.taxi
    Registered
    2026-04-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 19:34 UTC

    Suggest a correction

  80. web3.wayfind.click US · AS16509 · Amazon.com, Inc.4 addresses
    ListedAmazon Web ServicesUnder wayfind.click, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 40 d ago
    DetailsHide
    Hostname
    web3.wayfind.click
    First seen
    2026-11-08 03:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-07 23:57 UTC
    Listed
    MetaMask, listing wayfind.click and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 S18 · precertificate
    Valid 2026-11-08 02:31 UTC to 2027-05-25 03:31 UTC
    Logged 2026-11-08 03:31 UTC in DigiCert Wyvern2027h1, entry 449,067,305
    SHA-256 420a897048c008d787386944d3e0ae5ea360d58d474312407b5faa17ba35226c
    Public key SHA-256 8ee97f4f193e5d3029bf74c8064033ca5f4a9332aac7ba3e5890dccb41b8f740
    Addresses
    108.156.60.76 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    108.156.60.79 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    108.156.60.95 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    108.156.60.125 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (108.156.60.76, 108.156.60.79, 108.156.60.95, 108.156.60.125): a cloud provider. It rents servers and addresses to its customers.
    Domain
    wayfind.click
    Registered
    2026-09-29 · Amazon Registrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:47 UTC

    Suggest a correction

  81. www.barman.pt.shorturl.pt PT · AS24768 · ALMOUROLTEC ALMOUROLTEC SER…
    ReportedUnder shorturl.pt, reported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    www.barman.pt.shorturl.pt
    First seen
    2026-11-08 03:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy, listing shorturl.pt and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 02:34 UTC to 2027-02-06 02:34 UTC
    Logged 2026-11-08 03:33 UTC in Google PlumbersArms2027h1, entry 671,163,041
    SHA-256 3d6bded5fa3899dc8b71c31e8d5a0aebb5f83a4a89a021318013042facbced59
    Public key SHA-256 5f765e828797e3f89c7231fb54d8373452d27da80e09030780d97271616ee9ec
    PhishDestroy
    Addresses
    94.46.183.47 · Portugal · AS24768 ALMOUROLTEC ALMOUROLTEC SERVICOS DE INFORMATICA E INTERNET LDA
    Domain
    shorturl.pt
    MX
    Receives mail at mail.shorturl.pt
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 03:42 UTC

    Suggest a correction

  82. www.lamaniasale-pl.com US · AS396982 · Google LLC
    ListedGoogle CloudUnder lamaniasale-pl.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 56 d ago
    DetailsHide
    Hostname
    www.lamaniasale-pl.com
    First seen
    2026-11-08 03:36 UTC
    Listing
    CERT Polska listed it 2026-09-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska, listing lamaniasale-pl.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 02:34 UTC to 2027-02-06 03:27 UTC
    Logged 2026-11-08 03:34 UTC in DigiCert Wyvern2027h1, entry 449,083,971
    SHA-256 7b8a915ca33a7e58f8675eb35abcd847600029d3cb3e1187f35593c41dd5d8ff
    Public key SHA-256 3889d7dfc1ba6352898fc3ac3baf35b4383fc5d876e8aaf2986b6c209257ceba
    Addresses
    34.8.77.192 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.8.77.192): a cloud provider. It rents servers and addresses to its customers.
    Domain
    lamaniasale-pl.com
    Registered
    2026-09-13 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  83. www.bestbuy.de DE · AS24940 · HETZNER-AS Hetzner Online G…Best Buy
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.bestbuy.de
    First seen
    2026-11-08 03:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 195.201.69.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 195.201.69.223
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 02:31 UTC to 2027-02-06 02:31 UTC
    Logged 2026-11-08 03:30 UTC in IPng Networks Halloumi2027h1, entry 406,693,247
    SHA-256 9ee3fa85b2398f4c0d813981d613691bf269f0ab327bca6f2144b5f9fa577ffc
    Public key SHA-256 522a4c98a4ae8ded7a7fa915064b82ce30a165a226a3835b1bc8ebe2f82ad4a9
    Brand
    Best Buy
    Addresses
    195.201.69.223 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (195.201.69.223): a cloud provider. It rents servers and addresses to its customers.
    Domain
    bestbuy.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:37 UTC

    Suggest a correction

  84. bestbuy.de DE · AS24940 · HETZNER-AS Hetzner Online G…Best Buy
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    bestbuy.de
    First seen
    2026-11-08 03:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 195.201.69.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 195.201.69.223
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 02:31 UTC to 2027-02-06 02:31 UTC
    Logged 2026-11-08 03:30 UTC in IPng Networks Halloumi2027h1, entry 406,693,247
    SHA-256 9ee3fa85b2398f4c0d813981d613691bf269f0ab327bca6f2144b5f9fa577ffc
    Public key SHA-256 522a4c98a4ae8ded7a7fa915064b82ce30a165a226a3835b1bc8ebe2f82ad4a9
    Brand
    Best Buy
    Addresses
    195.201.69.223 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (195.201.69.223): a cloud provider. It rents servers and addresses to its customers.
    Domain
    bestbuy.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:37 UTC

    Suggest a correction

  85. 54567351.cfd US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    54567351.cfd
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 20:49 UTC to 2027-02-05 20:49 UTC
    Logged 2026-11-07 21:47 UTC in Let's Encrypt Sycamore2027h1, entry 1,027,189,708
    SHA-256 1f096222c6f40915911cfa5edea324822efa8a1ee875b6f89200e272f98ef574
    Public key SHA-256 856c9c6e394ae5bbc419df06ac963456bb56106294bb002e95b2109a0acd0707
    Addresses
    104.21.96.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.84 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3036::6815:609e
    2606:4700:3037::ac43:b954
    Cloudflare
    Cloudflare (104.21.96.158, 172.67.185.84): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    54567351.cfd
    Registered
    2026-11-07 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  86. giornrinca.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    giornrinca.store
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 05:55 UTC to 2027-02-05 05:55 UTC
    Logged 2026-11-07 06:54 UTC in DigiCert Wyvern2027h1, entry 438,384,538
    SHA-256 0d5be7340b1f886a57056c94c0de4b7051a339632e21f9838913a054596c5695
    Public key SHA-256 1c3a4476f4b2749ce06663371204c500e1ab904ad5264adc0c56bf2b526f9f95
    Addresses
    104.21.49.70 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.163 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3036::6815:3146
    2606:4700:3036::ac43:a0a3
    Cloudflare
    Cloudflare (104.21.49.70, 172.67.160.163): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    giornrinca.store
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:15 UTC

    Suggest a correction

  87. hexalonaimax.net US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    hexalonaimax.net
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 17:33 UTC to 2027-02-05 17:33 UTC
    Logged 2026-11-07 18:31 UTC in Google PlumbersArms2027h1, entry 664,843,756
    SHA-256 5b67f2ddc55156e3e219d59bbf240d1d5b3c0987c926afafa6177f31e62e9a8a
    Public key SHA-256 cc47ce4d6f7a70788a246a69dadd11eb75787c2b7961b14d770eb92b18cd5f18
    Addresses
    104.21.74.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.206.180 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:ceb4
    2606:4700:3036::6815:4ad5
    Cloudflare
    Cloudflare (104.21.74.213, 172.67.206.180): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hexalonaimax.net
    Registered
    2026-11-07 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  88. iliaaombr.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    iliaaombr.store
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 05:50 UTC to 2027-02-05 05:50 UTC
    Logged 2026-11-07 06:49 UTC in IPng Networks Gouda2027h1, entry 341,552,404
    SHA-256 4ebfc17a6c14ead3d0036b22d9a5b83887879817b3b91e928c045292cd8eebd2
    Public key SHA-256 91724884f3fdc248294dea230fdd3085a61473181c325a4e4c11623432fc0d31
    Addresses
    104.21.46.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:2e52
    2606:4700:3036::ac43:8874
    Cloudflare
    Cloudflare (104.21.46.82, 172.67.136.116): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    iliaaombr.store
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  89. merigdarna.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    merigdarna.store
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-07 06:43 UTC to 2027-02-05 06:51 UTC
    Logged 2026-11-07 06:53 UTC in DigiCert Sphinx2027h1, entry 387,461,295
    SHA-256 1fb4d7ce049037fb0591547cd7ee0d4f6eab31402c9c8ad08e74f20cdaf1ebd5
    Public key SHA-256 3ac3b36beb46384b4ee05c9ca1fdea9608d9181494206ff98b36a0f39cefdad3
    Addresses
    104.21.38.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.201 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:26ed
    2606:4700:3031::ac43:8cc9
    Cloudflare
    Cloudflare (104.21.38.237, 172.67.140.201): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    merigdarna.store
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  90. oversnotri.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    oversnotri.store
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 05:50 UTC to 2027-02-05 05:50 UTC
    Logged 2026-11-07 06:49 UTC in Google ParcelYard2027h1, entry 656,144,851
    SHA-256 a73723960448e513f0d57229133a12090b02b05ed7be0f294a817a975a3fb75a
    Public key SHA-256 8d380727243980ab718fb18835f4cae00c288cf37e74336a6b3afbfbfa7e16c2
    Addresses
    104.21.3.52 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.130.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:8242
    2606:4700:3034::6815:334
    Cloudflare
    Cloudflare (104.21.3.52, 172.67.130.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    oversnotri.store
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  91. pi-oferta858151.lat US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    pi-oferta858151.lat
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-07 21:36 UTC to 2027-02-05 22:33 UTC
    Logged 2026-11-07 22:36 UTC in DigiCert Sphinx2027h1, entry 394,906,702
    SHA-256 57a385e946658028549deef99475dbbf00a7ad9dd65294dd83bfcac0162554c6
    Public key SHA-256 1cf023391234a71dffd7a5f237f83e561e674a3df105d4b4d35db9cf0163cb73
    Addresses
    104.21.89.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:59a8
    2606:4700:3036::ac43:bdfa
    Cloudflare
    Cloudflare (104.21.89.168, 172.67.189.250): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pi-oferta858151.lat
    Registered
    2026-11-07 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  92. poisoconju.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    poisoconju.store
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 05:55 UTC to 2027-02-05 05:55 UTC
    Logged 2026-11-07 06:54 UTC in Google PlumbersArms2027h1, entry 656,546,428
    SHA-256 290bac268e0dd87ba1945617b91b7e7a48f174ddb0a4e89eedb7ffea5bc3d1a7
    Public key SHA-256 488ed54b280ffd38b19178bbeba0d32349eccee5d45f49f039a1835c0d07562d
    Addresses
    104.21.69.45 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.204.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:cc55
    2606:4700:3037::6815:452d
    Cloudflare
    Cloudflare (104.21.69.45, 172.67.204.85): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    poisoconju.store
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  93. reneeshoes.shop US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    reneeshoes.shop
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-07 17:39 UTC to 2027-02-05 18:37 UTC
    Logged 2026-11-07 18:39 UTC in Let's Encrypt Willow2027h1, entry 990,233,606
    SHA-256 146a73d4b187f49e2e362a423ef10b50109fe18149c56317ab2e687e4f66a1f7
    Public key SHA-256 550dade76e8734d3ef938379689d115bdc1f1a20ecd8c162a78d23c56edf8d5b
    Addresses
    104.18.20.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.20.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    reneeshoes.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:32 UTC

    Suggest a correction

  94. sbugipesco.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    sbugipesco.store
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-07 05:55 UTC to 2027-02-05 05:55 UTC
    Logged 2026-11-07 06:53 UTC in Let's Encrypt Sycamore2027h1, entry 1,006,428,007
    SHA-256 0821216a258bd3bc3ac56964cda50edd9439465043042910f78ccfb9f8ffacd9
    Public key SHA-256 3929cd82fda1562eb6f22c0e1b0bb5262d4ccbd058fa6a6f589f794c485375b4
    Addresses
    104.21.82.98 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:5262
    2606:4700:3031::ac43:c7e4
    Cloudflare
    Cloudflare (104.21.82.98, 172.67.199.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sbugipesco.store
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  95. sodomgete.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    sodomgete.store
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 05:51 UTC to 2027-02-05 05:51 UTC
    Logged 2026-11-07 06:49 UTC in Google ParcelYard2027h1, entry 656,150,753
    SHA-256 319564d3d9f125a948b184eceaedff0b6bd2dfc1f6f5a9415f016ff63829d0c6
    Public key SHA-256 9ef8308e3c5ca44d6d0fdc059ac51e31b2430ba164f3332a7e0012bad17f6853
    Addresses
    104.21.2.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.87 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:299
    2606:4700:3035::ac43:8157
    Cloudflare
    Cloudflare (104.21.2.153, 172.67.129.87): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sodomgete.store
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  96. trillrimun.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    trillrimun.store
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 05:50 UTC to 2027-02-05 05:50 UTC
    Logged 2026-11-07 06:48 UTC in Google ParcelYard2027h1, entry 656,141,874
    SHA-256 c67f64ad60c1905f2c133f7ba8b180de2b6f9a86e131f338ce8ef1b4baf88cfd
    Public key SHA-256 e705799b13c1e25e4273445017dbf12dd30762fd782767dfa533f0c8ad672f7f
    Addresses
    104.21.4.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:83cf
    2606:4700:3036::6815:452
    Cloudflare
    Cloudflare (104.21.4.82, 172.67.131.207): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    trillrimun.store
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  97. truly2-expedita39.cfd
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    truly2-expedita39.cfd
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-07 20:13 UTC to 2027-02-05 20:13 UTC
    Logged 2026-11-07 21:11 UTC in Google PlumbersArms2027h1, entry 666,785,785
    SHA-256 26c846d237bd14f0c542daad2422308104847985e9691ae8ed57e7c58468e6e8
    Public key SHA-256 3c41ceb8f286986c15cba40e03c50c82551a7f14a1fb4538b0bc8cc47fb9ce9a
    Domain
    truly2-expedita39.cfd
    Registered
    2026-11-07 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  98. truly5-molestiae30.cfd
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    truly5-molestiae30.cfd
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-07 19:11 UTC to 2027-02-05 19:11 UTC
    Logged 2026-11-07 20:09 UTC in Google PlumbersArms2027h1, entry 666,022,738
    SHA-256 2bf68e84e80afdd77c05285d0e0b67b4b72a3a8ec0ed0e05bedbb1b7ca2834d3
    Public key SHA-256 16570ac4edd6ee46151ca2b2af1c398615f89fabccec09e222e62ac7c88f5f28
    Domain
    truly5-molestiae30.cfd
    Registered
    2026-11-07 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  99. unidlrectpyementcloud.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    unidlrectpyementcloud.com
    First seen
    2026-11-08 03:31 UTC
    Listing
    CERT Polska listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 03:30 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-07 16:01 UTC to 2027-02-05 16:01 UTC
    Logged 2026-11-07 16:59 UTC in Let's Encrypt Sycamore2027h1, entry 1,020,615,295
    SHA-256 843fa9eb33068759fc675b3e2bc8d558f1c958e25285eabc792e895d0712e86d
    Public key SHA-256 e57bf876cce400486ccb07c0d9c7af6a612690f8e7bef0494d43dbd5490ecebc
    Addresses
    104.21.43.84 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:2b54
    2606:4700:3036::ac43:b0f8
    Cloudflare
    Cloudflare (104.21.43.84, 172.67.176.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    unidlrectpyementcloud.com
    Registered
    2026-11-07 · Key-Systems GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  100. kra40cc.com US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedParking page · AfternicReported by PhishDestroyMX absentSPF -allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    kra40cc.com
    First seen
    2026-11-08 03:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-07 23:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-08 03:26 UTC to 2027-05-25 03:26 UTC
    Logged 2026-11-08 03:26 UTC in Sectigo Elephant2027h1, entry 773,205,763
    SHA-256 9f068c3a4d2a8dd66ea7615af6a786c7c99493150931e18d1284305af532c226
    Public key SHA-256 d558e2f292bdbee42e17e9d30d40bed67c01f4a880f669324ecd815d58bee395
    PhishDestroy
    Addresses
    13.248.169.48 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    76.223.54.146 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    Parking page · Afternic
    The registry delegates kra40cc.com to Afternic’s nameservers, which answer for it. Afternic (13.248.169.48, 76.223.54.146): a parking service. It answers for names that are typically for sale or unused.
    Domain
    kra40cc.com
    Registered
    2026-04-25 · Afterdark Domains, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

Showing 1–100 of 5,745 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources