Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-08 08:45 UTC
Certificate-log entries · 24 h
319.3M
from 84 distinct feeds
Unique certificates · 24 h
30.9M
each reviewed
Names resolved · 24 h
20.5M
15.3M with an address
Findings · 24 h
5,704
209 of 1,061 brands targeted

5,704 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. anadoluajanslari.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    anadoluajanslari.com
    First seen
    2026-11-08 08:41 UTC
    Listing
    USOM listed it 2026-05-26 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 08:36 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:39 UTC to 2027-02-06 07:39 UTC
    Logged 2026-11-08 08:37 UTC in Let's Encrypt Willow2027h1, entry 999,971,663
    SHA-256 0ed222fb798acdfc9bea41cbc40a860a2d32225239f6e5b8c089a1ba39964586
    Public key SHA-256 076062bf7a86c4b9d45b29ef55d77bea1573843887e0c16fcb25eb5648020f7a
    Addresses
    104.21.40.241 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.96 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.40.241, 172.67.140.96): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    anadoluajanslari.com
    Registered
    2026-05-14 · Realtime Register B.V.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  2. app-links.smartrent-qa.com US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX absentSPF -allDMARC quarantineRegistered 10 y ago
    DetailsHide
    Hostname
    app-links.smartrent-qa.com
    First seen
    2026-11-08 08:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:37 UTC to 2027-02-06 08:35 UTC
    Logged 2026-11-08 08:37 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,347,490
    SHA-256 2bf18f6dc5219dc141f48eb08bc7f4e4579f4f100e8ec526d8406bda4a8fa256
    Public key SHA-256 17a8d38a1f559246194bccae62a794ff80d419e849fa78811a4910d7283c1f75
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    smartrent-qa.com
    Registered
    2017-03-24 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-08 08:41 UTC

    Suggest a correction

  3. app.rippl.ai US · AS54113 · Fastly, Inc.2 addresses
    ReportedFastlyReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    app.rippl.ai
    First seen
    2026-11-08 08:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:37 UTC to 2027-02-06 08:35 UTC
    Logged 2026-11-08 08:37 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,347,490
    SHA-256 2bf18f6dc5219dc141f48eb08bc7f4e4579f4f100e8ec526d8406bda4a8fa256
    Public key SHA-256 17a8d38a1f559246194bccae62a794ff80d419e849fa78811a4910d7283c1f75
    PhishDestroy
    Addresses
    151.101.1.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    151.101.65.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (151.101.1.195, 151.101.65.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rippl.ai
    Registered
    2021-01-21 · NameCheap, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  4. bodira.shop US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    bodira.shop
    First seen
    2026-11-08 08:41 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-08 07:37 UTC to 2027-02-06 08:35 UTC
    Logged 2026-11-08 08:38 UTC in DigiCert Wyvern2027h1, entry 451,800,774
    SHA-256 9b863931a1701254a1de76ba717d4c01e3e39fedc4da9abf553f96209973d640
    Public key SHA-256 c50ac1128a76a6c8134a6642c5bb2c82dbf3579b0b40790abf92627ed379441e
    Addresses
    104.21.70.87 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.222.41 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:de29
    2606:4700:3037::6815:4657
    Cloudflare
    Cloudflare (104.21.70.87, 172.67.222.41): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bodira.shop
    Registered
    2026-07-13 · Dynadot Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  5. bookingsherwooddreamsresort.sherwoodhotels.com.tr US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder sherwoodhotels.com.tr, reported by PhishDestroyMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    bookingsherwooddreamsresort.sherwoodhotels.com.tr
    First seen
    2026-11-08 08:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing sherwoodhotels.com.tr and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 07:39 UTC to 2027-02-06 07:39 UTC
    Logged 2026-11-08 08:37 UTC in IPng Networks Halloumi2027h1, entry 409,244,695
    SHA-256 4d062fefeb8b199562c36cbebf05e0795ca68a8f217457d2c00339ab08c3dedc
    Public key SHA-256 22a15c8486c38570f6e7c60f5ba8d64cc228094e80726325404e791563eddeb2
    PhishDestroy
    Addresses
    216.150.1.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.193, 216.150.16.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    sherwoodhotels.com.tr
    MX
    Receives mail at sherwoodhotels-com-tr.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:44 UTC

    Suggest a correction

  6. fetc-govni-tw.comFETC (eTag)
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    fetc-govni-tw.com
    First seen
    2026-11-08 08:41 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:36 UTC to 2027-02-06 08:34 UTC
    Logged 2026-11-08 08:36 UTC in Let's Encrypt Willow2027h1, entry 999,960,961
    SHA-256 948295234acb642e8cea65de82f9dca68c784f22ccf45d54ef7bbc06d155c9aa
    Public key SHA-256 90ba9cd14dcc27487a96d67610ed99aa355b629476ae4c109d2b1afa32d244bb
    Brand
    FETC (eTag)
    Domain
    fetc-govni-tw.com
    Registered
    2026-07-13 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  7. genovixworld.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    genovixworld.com
    First seen
    2026-11-08 08:41 UTC
    Listing
    USOM listed it 2026-06-05 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 08:36 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:41 UTC to 2027-02-06 07:41 UTC
    Logged 2026-11-08 08:39 UTC in DigiCert Sphinx2027h1, entry 399,726,678
    SHA-256 a8fb484864b141deaa9a5e73745bd3c0ce1a1c8c86c3d73433bf33e2d7d3b725
    Public key SHA-256 4bd709ac50de410be46ea77206b6ffcccb470539cca9b9ad52fe5b1cd6c47003
    Addresses
    104.21.40.65 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.211 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b2d3
    2606:4700:3035::6815:2841
    Cloudflare
    Cloudflare (104.21.40.65, 172.67.178.211): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    genovixworld.com
    Registered
    2026-05-14 · Realtime Register B.V.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  8. kqixwked.space US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    kqixwked.space
    First seen
    2026-11-08 08:41 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 07:36 UTC to 2026-12-09 08:33 UTC
    Logged 2026-11-08 08:40 UTC in DigiCert Wyvern2026h2, entry 2,211,820,037
    SHA-256 5513ab0fd83ad943d75a95c194add4c086de1ec9825508b2c93fa0079fe654ef
    Public key SHA-256 e92bd2626c501b117ae7c2ff35992919663ec7f651580e46dea947d55c6ae490
    Addresses
    104.21.3.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.130.127 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:827f
    2606:4700:3034::6815:353
    Cloudflare
    Cloudflare (104.21.3.83, 172.67.130.127): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kqixwked.space
    Registered
    2026-07-13 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  9. kxzscq.com US · AS13335 · Cloudflare, Inc.4 addressesSMBC Card
    ListedCloudflareListed by JPCERT/CC as imitating 三井住友カードMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    kxzscq.com
    First seen
    2026-11-08 08:41 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 02:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:37 UTC to 2027-02-06 08:35 UTC
    Logged 2026-11-08 08:37 UTC in IPng Networks Gouda2027h1, entry 352,105,868
    SHA-256 0ec4b4bd3f259b9c97b9da94dfc97f708dd9f8a133f59a25d514498db851e265
    Public key SHA-256 03c05b38a223ce986caeb4b8308504d66862fce1007740969c2351e143530822
    Brand
    SMBC Card
    Addresses
    104.21.75.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.140 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:4bfb
    2606:4700:3036::ac43:b88c
    Cloudflare
    Cloudflare (104.21.75.251, 172.67.184.140): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kxzscq.com
    Registered
    2026-11-01 · TuringSign Inc. d/b/a Cosmotown
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  10. ledger-com-start.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ledger-com-start.com
    First seen
    2026-11-08 08:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:36 UTC to 2027-02-06 08:34 UTC
    Logged 2026-11-08 08:36 UTC in Google PlumbersArms2027h1, entry 674,557,864
    SHA-256 7bce19b2f2e6dde4c91c7d46ece94f00a4cdd5197cd2cbf273728fd01897a7fe
    Public key SHA-256 fd4dc1369befa8c0373ecf23e91a5da1f4a340423eae561f4072acc3b6207b84
    Addresses
    104.21.41.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.71 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:2959
    2606:4700:3036::ac43:a347
    Cloudflare
    Cloudflare (104.21.41.89, 172.67.163.71): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledger-com-start.com
    Registered
    2026-07-12 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  11. mail.utilita-energy.ltd DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under utilita-energy.ltd, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    mail.utilita-energy.ltd
    First seen
    2026-11-08 08:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing utilita-energy.ltd and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 07:37 UTC to 2027-02-06 07:37 UTC
    Logged 2026-11-08 08:35 UTC in Google PlumbersArms2027h1, entry 674,546,422
    SHA-256 859968e6d58c8f1717d259dfaee89188ac41c10de34f8dea19f0294ddbb5c473
    Public key SHA-256 71ec09dc9395c06251ee50bd2d6dc969a7ad4e097dafe580ffc4a9648751f183
    PhishDestroy
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    utilita-energy.ltd
    Registered
    2026-06-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 11:10 UTC

    Suggest a correction

  12. qaapi.zenledger.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder zenledger.dev, reported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    qaapi.zenledger.dev
    First seen
    2026-11-08 08:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing zenledger.dev and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:39 UTC to 2027-02-06 07:39 UTC
    Logged 2026-11-08 08:38 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,388,592
    SHA-256 44d2a784afeaf71a50b8c243b6b0766671831d40d5bf6f181401eef52eb4c397
    Public key SHA-256 785ed8fbb2d42773138e16c17464b570f3a8d36153335c547d6a960d41d4b20a
    PhishDestroy
    Addresses
    104.20.28.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.164.119 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.20.28.62, 172.66.164.119): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zenledger.dev
    Registered
    2022-09-15 · Namecheap Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 08:09 UTC

    Suggest a correction

  13. sahibinden.live US · AS13335 · Cloudflare, Inc.4 addressesSahibinden
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    sahibinden.live
    First seen
    2026-11-08 08:41 UTC
    Listing
    USOM listed it 2026-07-27 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 08:36 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 07:40 UTC to 2027-02-06 07:40 UTC
    Logged 2026-11-08 08:39 UTC in DigiCert Sphinx2027h1, entry 399,718,765
    SHA-256 2b659df6b906c36f45b88dc4b6cec6932747025c89b3fc9b8ad5329ac53710bd
    Public key SHA-256 f1fc2fd710111c703a65d1f64d174d2637c15814a2a9bf3df4613e9cff472204
    Brand
    Sahibinden
    Addresses
    104.21.27.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.156 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:1b82
    2606:4700:3032::ac43:8e9c
    Cloudflare
    Cloudflare (104.21.27.130, 172.67.142.156): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sahibinden.live
    Registered
    2026-05-15 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:41 UTC

    Suggest a correction

  14. tapy.ws US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    tapy.ws
    First seen
    2026-11-08 08:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 07:39 UTC to 2027-02-06 07:39 UTC
    Logged 2026-11-08 08:38 UTC in Google PlumbersArms2027h1, entry 674,582,520
    SHA-256 0a3c04272eeb7c8faf56ec3ee297a9d0cad7bc5bbc0e8fae8f354373e8cb4ffe
    Public key SHA-256 58c74c53fdd2c6ec7e1930e4366e733a511ae321a1f8dac58b54c499f745166b
    Addresses
    104.21.29.240 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.29.240, 172.67.149.253): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tapy.ws
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  15. we.gbvdshsd.top HK · AS133752 · LEASEWEB HONG KONG LIMITED
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    we.gbvdshsd.top
    First seen
    2026-11-08 08:41 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 07:41 UTC to 2027-02-06 07:41 UTC
    Logged 2026-11-08 08:39 UTC in Google PlumbersArms2027h1, entry 674,604,067
    SHA-256 579fdf82ac4b40e3cdf8c1039fe3feaa49643470a02231bf4eb9e131c5a69686
    Public key SHA-256 2609ef6e33af40d41a81477784b36a9074fb159211ffda5f12ceb302758166a7
    Addresses
    27.0.232.35 · Hong Kong · AS133752 LEASEWEB-APAC-HKG-10 - LEASEWEB HONG KONG LIMITED
    Domain
    gbvdshsd.top
    Registered
    2026-09-08 · gadomains
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  16. webmail.utilita-energy.ltd DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under utilita-energy.ltd, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    webmail.utilita-energy.ltd
    First seen
    2026-11-08 08:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing utilita-energy.ltd and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:37 UTC to 2027-02-06 07:37 UTC
    Logged 2026-11-08 08:35 UTC in Let's Encrypt Willow2027h1, entry 999,940,522
    SHA-256 093a8c2f6677dcbaad8717b6012d415f5180343384f35ce85c1a695844141b11
    Public key SHA-256 71ec09dc9395c06251ee50bd2d6dc969a7ad4e097dafe580ffc4a9648751f183
    PhishDestroy
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    utilita-energy.ltd
    Registered
    2026-06-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 11:10 UTC

    Suggest a correction

  17. www.einfach-reisekosten.de US · AS54113 · Fastly, Inc.
    ReportedFastlyUnder einfach-reisekosten.de, reported by PhishDestroyMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    www.einfach-reisekosten.de
    First seen
    2026-11-08 08:41 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-10-31 · still listed at the last successful feed check 2026-11-08 05:57 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-30 (5 days)
    Reported
    PhishDestroy, listing einfach-reisekosten.de and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3
    Valid 2026-10-10 11:30 UTC to 2027-01-08 12:28 UTC
    Logged 2026-11-08 08:40 UTC in Sectigo Statue2027h1, entry 92,133,607
    SHA-256 51ebc5e7d23953a6030c36c2facdb27e86f337bbccc30021a2e820c6e834f5a7
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    einfach-reisekosten.de
    MX
    Receives mail at mx0.einfach-reisekosten.de
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:38 UTC

    Suggest a correction

  18. bitrefill.com-dk01-esim-gift.com GB · AS214351 · FEMOIT FEMO IT SOLUTIONS LI…Bitrefill
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    bitrefill.com-dk01-esim-gift.com
    First seen
    2026-11-08 08:36 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 62.60.226.39.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 62.60.226.39
    Certificate
    Issued by YR2
    Valid 2026-11-08 07:34 UTC to 2027-02-06 07:34 UTC
    Logged 2026-11-08 08:33 UTC in Google PlumbersArms2027h1, entry 674,514,461
    SHA-256 3bce7010655aa04208ff18da6e638aafe102c33ed5109836d84224b2d845c3cd
    Public key SHA-256 6710c839f23a190d6a6c89b42269c9111f28c1b9590bab5d41a0e861d03e5439
    Brand
    Bitrefill
    Addresses
    62.60.226.39 · United Kingdom · AS214351 FEMOIT FEMO IT SOLUTIONS LIMITED
    Domain
    com-dk01-esim-gift.com
    Registered
    2026-11-08 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  19. 4b677a73.dev US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    4b677a73.dev
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    4b677a73.dev
    Registered
    2022-07-03 · Squarespace Domains II LLC.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  20. aokarkau.com US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX presentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    aokarkau.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aokarkau.com
    Registered
    2021-03-05 · NameCheap, Inc.
    MX
    Receives mail at mx01.mail.icloud.com, mx02.mail.icloud.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  21. app-kindredlabs.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    app-kindredlabs.xyz
    First seen
    2026-11-08 08:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 07:35 UTC to 2027-02-06 07:35 UTC
    Logged 2026-11-08 08:34 UTC in Google ParcelYard2027h1, entry 674,211,051
    SHA-256 4088ab73711feb79fc6098ad512cbe84637cbeb1d3436e64fea5db03fdb61a96
    Public key SHA-256 ce1e0404003ff91b242528c9aba1d75a72f1d0ef7278c26656e928cb5323b5f1
    Addresses
    104.21.6.37 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.204 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.37, 172.67.154.204): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    app-kindredlabs.xyz
    Registered
    2026-03-17 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  22. app-staging.farmevo.ai US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 4 y ago
    DetailsHide
    Hostname
    app-staging.farmevo.ai
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    farmevo.ai
    Registered
    2023-03-31 · NameCheap, Inc.
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  23. cmeetit.com US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    cmeetit.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cmeetit.com
    Registered
    2025-04-23 · Squarespace Domains LLC
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:06 UTC

    Suggest a correction

  24. comichaiku.com US · AS54113 · Fastly, Inc.2 addresses
    ReportedFastlyReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    comichaiku.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    151.101.1.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    151.101.65.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (151.101.1.195, 151.101.65.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    comichaiku.com
    Registered
    2019-02-14 · Squarespace Domains II LLC
    MX
    Receives mail at mxa.mailgun.org, mxb.mailgun.org
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  25. cue.tomthomas.app US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    cue.tomthomas.app
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tomthomas.app
    Registered
    2026-02-23 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  26. dashboard.technicalwater.app US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    dashboard.technicalwater.app
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    technicalwater.app
    Registered
    2023-06-08 · Namecheap Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  27. dev-app.cbreenergy.com US · AS54113 · Fastly, Inc.2 addresses
    ReportedFastlyReported by PhishDestroyMX presentSPF missingDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    dev-app.cbreenergy.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    151.101.1.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    151.101.65.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (151.101.1.195, 151.101.65.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cbreenergy.com
    Registered
    2018-04-26 · CSC Corporate Domains, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  28. dev.eb.incrementals.app US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    dev.eb.incrementals.app
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    incrementals.app
    Registered
    2022-04-29 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  29. fast-okx-dwfepw.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    fast-okx-dwfepw.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:34 UTC to 2027-02-06 07:34 UTC
    Logged 2026-11-08 08:32 UTC in Let's Encrypt Willow2027h1, entry 999,896,630
    SHA-256 de67fe894fe4297961056c7a50705972df04a93a26fb84b6872565767e248bcd
    Public key SHA-256 f0522b865790b8f599f2e967d89f5bbe2cb2207851082cb3308218d4b0dcc29e
    Addresses
    104.21.32.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.92 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.32.30, 172.67.182.92): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fast-okx-dwfepw.com
    Registered
    2026-08-24 · Gransy, s.r.o.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  30. fx.mounttips.com US · AS19318 · Interserver, Inc
    ListedInterserverUnder mounttips.com, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    fx.mounttips.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing mounttips.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 07:32 UTC to 2027-02-06 07:32 UTC
    Logged 2026-11-08 08:30 UTC in Google PlumbersArms2027h1, entry 674,476,477
    SHA-256 4621b043c79a538d16d43f90a5de7d9d72ac21afcee2f5cc3bad5d47a09baa13
    Public key SHA-256 74b25f734fabd3c272233224a4743a497d3f87c6609b41d71a8b7fedfd4a064b
    Addresses
    157.250.199.67 · United States · AS19318 IS-AS-1 - Interserver, Inc · Interserver (shared hosting)
    Interserver
    Interserver (157.250.199.67): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    mounttips.com
    Registered
    2026-04-30 · Tucows Domains Inc.
    MX
    Receives mail at mounttips.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:42 UTC

    Suggest a correction

  31. gemius.app US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    gemius.app
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gemius.app
    Registered
    2021-10-01 · Squarespace Domains II LLC.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  32. hotspotdating.app US · AS54113 · Fastly, Inc.
    ReportedFastlyReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    hotspotdating.app
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:26 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,156,393
    SHA-256 f9fafd98f24583fc1321f431bd51980b5030ac1f06ff7b324c991e1e8f8d8f33
    Public key SHA-256 bbdd71febbfd8af32b5ced1dbba37600123a0628957c3d13f7d0d3133a2a4afe
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hotspotdating.app
    Registered
    2025-11-03 · CloudFlare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  33. img.pong.secuirtyguard.sbs DE · AS51167 · CONTABO Contabo GmbH
    ListedContaboUnder secuirtyguard.sbs, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    img.pong.secuirtyguard.sbs
    First seen
    2026-11-08 08:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing secuirtyguard.sbs and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:35 UTC to 2027-02-06 07:35 UTC
    Logged 2026-11-08 08:33 UTC in IPng Networks Halloumi2027h1, entry 409,200,884
    SHA-256 8133ccf560894bb8933e896f8a205a9ce5ad51665b214fbb17e728adde252227
    Public key SHA-256 872b3168d19691bb76d5f8d019f4cfa72527e82b424818cb36bdb5d25880364e
    Addresses
    13.140.145.220 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    Contabo
    Contabo (13.140.145.220): a cloud provider. It rents servers and addresses to its customers.
    Domain
    secuirtyguard.sbs
    Registered
    2025-12-25 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 11:31 UTC

    Suggest a correction

  34. io-skin.tech RU · AS197695 · AS-REGRU "Domain names regi…
    ListedRegistrar page · REG.RUListed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    io-skin.tech
    First seen
    2026-11-08 08:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 07:33 UTC to 2027-02-06 07:33 UTC
    Logged 2026-11-08 08:31 UTC in Geomys Tuscolo2027h1, entry 525,472,903
    SHA-256 2f4a431b6dc31eff0d05a7f3d7e8e0fe6b16e65b91da25a22e19818e3877e661
    Public key SHA-256 08cbfc137f57413d9be61e0daeab86455fc6e351306b34c9eb242ab2bae6c585
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    io-skin.tech
    Registered
    2026-06-19 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  35. onstreamsapp.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    onstreamsapp.pro
    First seen
    2026-11-08 08:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 07:34 UTC to 2027-02-06 07:34 UTC
    Logged 2026-11-08 08:32 UTC in Google ParcelYard2027h1, entry 674,195,486
    SHA-256 51cfd449930ebba3308b9e410fdc259eeb093217d822f6ad1537c9f62bd03460
    Public key SHA-256 3f2e0b7216c5104b69e48c261257f875ff6c0893bd91e710c5aa55e540b63ea5
    Addresses
    104.21.8.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.157.70 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.8.97, 172.67.157.70): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    onstreamsapp.pro
    Registered
    2026-09-10 · Porkbun LLC
    MX
    Receives mail at route1.mx.cloudflare.net, route2.mx.cloudflare.net, route3.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  36. qanft-metadata.zenledger.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder zenledger.dev, reported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    qanft-metadata.zenledger.dev
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing zenledger.dev and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 07:35 UTC to 2027-02-06 07:35 UTC
    Logged 2026-11-08 08:33 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,242,720
    SHA-256 a14295f8aa43ece450022a48f7726d41a8115db8302b0573ec16eaac48430816
    Public key SHA-256 3104d701a5a8d92eb39046302045fe2f03c32c1c775de04586bbd73cf01aa464
    PhishDestroy
    Addresses
    104.20.28.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.164.119 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.20.28.62, 172.66.164.119): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zenledger.dev
    Registered
    2022-09-15 · Namecheap Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 08:09 UTC

    Suggest a correction

  37. smgl.shop US · AS16509 · Amazon.com, Inc.4 addresses
    ListedAmazon Web ServicesListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    smgl.shop
    First seen
    2026-11-08 08:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 S18 · precertificate
    Valid 2026-11-08 07:31 UTC to 2027-05-25 08:31 UTC
    Logged 2026-11-08 08:31 UTC in DigiCert Sphinx2027h1, entry 399,629,502
    SHA-256 00ca7ed424c674e5329ffb282cb0015198e230b8c2d6346cc9d311cd595106dd
    Public key SHA-256 91c2bf3145ea6b9b6509127d79654e5eb24c0bdb98f2da408e81d93c67300f8f
    Addresses
    18.239.105.47 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.105.54 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.105.94 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.105.97 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (18.239.105.47, 18.239.105.54, 18.239.105.94, 18.239.105.97): a cloud provider. It rents servers and addresses to its customers.
    Domain
    smgl.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:41 UTC

    Suggest a correction

  38. svbanf.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    svbanf.asia
    First seen
    2026-11-08 08:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:35 UTC to 2027-02-06 08:34 UTC
    Logged 2026-11-08 08:35 UTC in DigiCert Wyvern2027h1, entry 451,762,960
    SHA-256 b3e40704da08d45cc179caaa5f5389430a14ecac44bcee975e212c2d8bd02cd5
    Public key SHA-256 d0eedd2ac6a1d91a915ba36d810b69440f76daa200989ab726565a949d59e8fb
    Addresses
    104.21.75.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.230 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.75.228, 172.67.182.230): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    svbanf.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  39. tradecradle.com FR · AS16276 · OVH OVH SAS
    ReportedOVHReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    tradecradle.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 07:36 UTC to 2027-02-06 07:36 UTC
    Logged 2026-11-08 08:34 UTC in Let's Encrypt Sycamore2027h1, entry 1,042,277,952
    SHA-256 d2756f37852d890663dac72d0e1e54755dc05fc5e20ad4dc63eded8d06f186c6
    Public key SHA-256 30cba092c01a443362875a76a6864816d4b8bf87394e5f611fbc8ae932a60434
    PhishDestroy
    Addresses
    51.38.123.251 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.38.123.251): a cloud provider. It rents servers and addresses to its customers.
    Domain
    tradecradle.com
    Registered
    2026-09-08 · Dominet (HK) Limited
    MX
    Receives mail at tradecradle.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  40. www.akbeautylab.com.br US · AS54113 · Fastly, Inc.
    ReportedFastlyUnder akbeautylab.com.br, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    www.akbeautylab.com.br
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing akbeautylab.com.br and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:34 UTC to 2027-02-06 08:32 UTC
    Logged 2026-11-08 08:34 UTC in DigiCert Wyvern2027h1, entry 451,746,296
    SHA-256 f3fad076b416ff34f8cd1f2b4638be7f990cb536e8c87b7f909e7d5eb2b05125
    Public key SHA-256 17a8d38a1f559246194bccae62a794ff80d419e849fa78811a4910d7283c1f75
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    akbeautylab.com.br
    Registered
    2025-04-05
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  41. www.bergsignalgptapp.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder bergsignalgptapp.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.bergsignalgptapp.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    CERT Polska listed it 2026-09-08 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska, listing bergsignalgptapp.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 07:35 UTC to 2027-02-06 07:35 UTC
    Logged 2026-11-08 08:33 UTC in Google ParcelYard2027h1, entry 674,206,198
    SHA-256 a994102029c875584eb500ad222205b281ca03e6035a5a2a9a0bf89460e20cf0
    Public key SHA-256 bd2ae0ad243dafa367551dc00301725adf5a8323172f1f469ca3c869d7dc9a96
    Addresses
    104.21.78.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.222.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.78.139, 172.67.222.108): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bergsignalgptapp.com
    Registered
    2026-09-08 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 13:00 UTC

    Suggest a correction

  42. www.fx.mounttips.com US · AS19318 · Interserver, Inc
    ListedInterserverUnder mounttips.com, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    www.fx.mounttips.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing mounttips.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 07:32 UTC to 2027-02-06 07:32 UTC
    Logged 2026-11-08 08:30 UTC in Google PlumbersArms2027h1, entry 674,476,477
    SHA-256 4621b043c79a538d16d43f90a5de7d9d72ac21afcee2f5cc3bad5d47a09baa13
    Public key SHA-256 74b25f734fabd3c272233224a4743a497d3f87c6609b41d71a8b7fedfd4a064b
    Addresses
    157.250.199.67 · United States · AS19318 IS-AS-1 - Interserver, Inc · Interserver (shared hosting)
    Interserver
    Interserver (157.250.199.67): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    mounttips.com
    Registered
    2026-04-30 · Tucows Domains Inc.
    MX
    Receives mail at mounttips.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:42 UTC

    Suggest a correction

  43. www.io-skin.tech RU · AS197695 · AS-REGRU "Domain names regi…
    ListedRegistrar page · REG.RUUnder io-skin.tech, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.io-skin.tech
    First seen
    2026-11-08 08:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing io-skin.tech and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 07:33 UTC to 2027-02-06 07:33 UTC
    Logged 2026-11-08 08:31 UTC in Geomys Tuscolo2027h1, entry 525,472,903
    SHA-256 2f4a431b6dc31eff0d05a7f3d7e8e0fe6b16e65b91da25a22e19818e3877e661
    Public key SHA-256 08cbfc137f57413d9be61e0daeab86455fc6e351306b34c9eb242ab2bae6c585
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    io-skin.tech
    Registered
    2026-06-19 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  44. xrp-pool.app US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    xrp-pool.app
    First seen
    2026-11-08 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 07:33 UTC to 2027-02-06 07:33 UTC
    Logged 2026-11-08 08:31 UTC in Google PlumbersArms2027h1, entry 674,492,824
    SHA-256 09ba92fecdaa61208fe21622edd64f9163c59222b0364305a49632befda08192
    Public key SHA-256 5340d39630facdfe84409f6726a640e817acc70235fb3dc35d15a762e11a28ce
    PhishDestroy
    Addresses
    104.21.64.183 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.183, 172.67.154.77): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xrp-pool.app
    Registered
    2026-05-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  45. zyvralen-spain.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    zyvralen-spain.com
    First seen
    2026-11-08 08:36 UTC
    Listing
    CERT Polska listed it 2026-09-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:24 UTC to 2027-02-06 08:33 UTC
    Logged 2026-11-08 08:34 UTC in DigiCert Wyvern2027h1, entry 451,756,838
    SHA-256 1e00b5643c08ba57aa6a53a95e0df043939f904e8f55b6fde41f59178732f809
    Public key SHA-256 1aa5d87660ed868f7f1dbb5a81618b1c30318edbe8301a23be090328ff99b57f
    Addresses
    104.21.62.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.141.55 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.246, 172.67.141.55): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zyvralen-spain.com
    Registered
    2026-07-13 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  46. uyapakademigovtr.com US · AS22612 · Namecheap, Inc.
    ListedNamecheapListed by USOMMX presentSPF ~allDMARC policy noneRegistered 1 d ago
    DetailsHide
    Hostname
    uyapakademigovtr.com
    First seen
    2026-11-08 08:35 UTC
    Listing
    USOM listed it 2026-11-08 · still listed at the last successful feed check 2026-11-08 08:36 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by SSL.com TLS Issuing RSA CA R1 · precertificate
    Valid 2026-11-07 19:34 UTC to 2027-05-24 19:43 UTC
    Logged 2026-11-07 19:44 UTC in DigiCert Wyvern2027h1, entry 445,131,426
    SHA-256 7331d8f982fb32bf9b5969946fbed780fe9ea9f4e45ce3cf100dc8834bdcb5d1
    Public key SHA-256 74cca157034346650f0b7af95cb6b5b67e530627e295f95eece6d4e2db8adc29
    Addresses
    198.54.114.222 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (198.54.114.222): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    uyapakademigovtr.com
    Registered
    2026-11-07 · NameCheap, Inc.
    MX
    Receives mail at mx1-hosting.jellyfish.systems, mx2-hosting.jellyfish.systems, mx3-hosting.jellyfish.systems
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  47. bullcash.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    bullcash.cc
    First seen
    2026-11-08 08:30 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:28 UTC to 2027-02-06 07:28 UTC
    Logged 2026-11-08 08:26 UTC in IPng Networks Gouda2027h1, entry 352,016,075
    SHA-256 16847dfbe3ee9f149afb0f7ed78a65efe3eb4899f7000430c6468e382dc979c2
    Public key SHA-256 33718722e95f9e8ec47e0d19654c85ae8f91feb74d29dea55eab6ec968e4b77e
    Addresses
    104.21.1.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.152.149 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.1.237, 172.67.152.149): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bullcash.cc
    Registered
    2026-09-10 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  48. careers.cookie-stock.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder cookie-stock.com, reported by PhishDestroyMX absentSPF missingDMARC policy noneRegistered 15 mo ago
    DetailsHide
    Hostname
    careers.cookie-stock.com
    First seen
    2026-11-08 08:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing cookie-stock.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 07:31 UTC to 2027-02-06 07:31 UTC
    Logged 2026-11-08 08:30 UTC in Google ParcelYard2027h1, entry 674,157,231
    SHA-256 48c1f456a4f5b3c947d3846a4000c75fdada3ba13f4919c8e7618510d5014964
    Public key SHA-256 7b4958c3480f64c7385f2db3eb9417bdc11ea0cd6cec6906d47a7945e2b85470
    PhishDestroy
    Addresses
    185.178.208.177 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.177): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cookie-stock.com
    Registered
    2025-08-26 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 23:42 UTC

    Suggest a correction

  49. eidksmxs.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    eidksmxs.shop
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:28 UTC to 2027-02-06 08:27 UTC
    Logged 2026-11-08 08:28 UTC in IPng Networks Gouda2027h1, entry 352,031,468
    SHA-256 9b16a88dff995c9f539522074f57a470fdeed66b97ddcf39af61368714e29cae
    Public key SHA-256 07e833337a79cba0fef512ad09dd3fb92f2b53581f28b0598196d181698e0309
    Addresses
    104.21.47.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.170.202 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.83, 172.67.170.202): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    eidksmxs.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  50. fifa-2026.xyz US · AS13335 · Cloudflare, Inc.
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    fifa-2026.xyz
    First seen
    2026-11-08 08:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 07:26 UTC to 2027-02-06 08:24 UTC
    Logged 2026-11-08 08:26 UTC in Google ParcelYard2027h1, entry 674,105,529
    SHA-256 453ee40a721e21fb121383c91b674b0d2144e3d721ba6bb00c0a0f199e37d362
    Public key SHA-256 a0e403e3cd233408e39425e836198309444859696806328af0ea438c36b6aa69
    PhishDestroy
    Addresses
    185.158.133.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (185.158.133.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fifa-2026.xyz
    Registered
    2026-03-10 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:08 UTC

    Suggest a correction

  51. kitchenwareshopping.shop
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    kitchenwareshopping.shop
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 07:30 UTC
    Logged 2026-11-08 08:28 UTC in DigiCert Sphinx2027h1, entry 399,600,173
    SHA-256 2060afaf7aa09863ae8076af318b80e1e799d103c07bd55c33b5f99e36a93ed7
    Public key SHA-256 42fd9545d084c1b0fa3989a14f5c2918baa2f9e979572add4e707dca17db880d
    Domain
    kitchenwareshopping.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  52. qxm7tz25.shop CA · AS25820 · IT7 Networks Inc
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    qxm7tz25.shop
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 07:30 UTC to 2027-02-06 07:30 UTC
    Logged 2026-11-08 08:28 UTC in Google ParcelYard2027h1, entry 674,141,425
    SHA-256 15de711e02992bdab60f0a825d01fcb52b3aba40173ad3281666404624ceb10d
    Public key SHA-256 36706ca1e530fb0e456308966fdb2320a6cb7632cabd45d411a0845ddacd5f01
    Addresses
    74.82.196.142 · Canada · AS25820 IT7NET - IT7 Networks Inc
    Domain
    qxm7tz25.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  53. rmp9xv41.shop CA · AS25820 · IT7 Networks Inc
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    rmp9xv41.shop
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 07:28 UTC to 2027-02-06 07:28 UTC
    Logged 2026-11-08 08:26 UTC in DigiCert Sphinx2027h1, entry 399,581,562
    SHA-256 b73205730d881572060485a9ef60e5f38b0e15ba280893218de3c76d1791bdaf
    Public key SHA-256 770cb35566d2fdd9c4884ed485038d0c25e1e8738727625f3c2bd29e60eccfc1
    Addresses
    74.82.196.142 · Canada · AS25820 IT7NET - IT7 Networks Inc
    Domain
    rmp9xv41.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  54. rocashmeadowview.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    rocashmeadowview.com
    First seen
    2026-11-08 08:30 UTC
    Listing
    CERT Polska listed it 2026-07-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:17 UTC to 2027-02-06 08:25 UTC
    Logged 2026-11-08 08:27 UTC in DigiCert Wyvern2027h1, entry 451,677,746
    SHA-256 5a55cea2a7823d460a5fc3d2ee7e4b35febb315f4751e1799d0d137130c9a0e2
    Public key SHA-256 be45252848f18aefac9e29d4ff0145abd15dd6fa182dd07910c53c682f203513
    Addresses
    104.21.50.141 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.206.205 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.50.141, 172.67.206.205): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rocashmeadowview.com
    Registered
    2026-07-13 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  55. serenaprovechura.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    serenaprovechura.net
    First seen
    2026-11-08 08:30 UTC
    Listing
    CERT Polska listed it 2026-09-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 08:27 UTC
    Logged 2026-11-08 08:30 UTC in Let's Encrypt Willow2027h1, entry 999,859,024
    SHA-256 9b23ba01b95fabf50edc371de8fc54a5ddc76a2949495b969a5cb8e2577e7591
    Public key SHA-256 d79dcb8f48889c278a337c14c2bd5332e7b076678d39045dc82da450d22e5957
    Addresses
    104.21.83.51 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.214.205 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.83.51, 172.67.214.205): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    serenaprovechura.net
    Registered
    2026-09-10 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  56. status-pl-582019.eu.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    status-pl-582019.eu.cc
    First seen
    2026-11-08 08:30 UTC
    Listing
    CERT Polska listed it 2026-09-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:28 UTC to 2027-02-06 08:27 UTC
    Logged 2026-11-08 08:28 UTC in DigiCert Wyvern2027h1, entry 451,686,913
    SHA-256 beb9932bdc58a936cedbe67f362ad83879d80bf923e97e9c1c0d927f4f321929
    Public key SHA-256 0ddf5247ac0574dd8bd4107d72b900feaeefe65df5a5c1c8e8807a08817e7b94
    Addresses
    104.21.69.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.69.159, 172.67.210.88): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  57. taiwancbi.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    taiwancbi.shop
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:20 UTC to 2027-02-06 08:28 UTC
    Logged 2026-11-08 08:30 UTC in DigiCert Wyvern2027h1, entry 451,699,686
    SHA-256 4df1f531b003c145bd72b564efa782f5af84f08b53fcb122ccb3c0cdfb0db993
    Public key SHA-256 65a02b317b287f29a8e2bc4c27b2e3d8c1fe9ca5515c9846e091e07defb9a764
    Addresses
    104.21.83.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.214.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.83.63, 172.67.214.247): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    taiwancbi.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  58. txk4pn83.shop CA · AS25820 · IT7 Networks Inc
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    txk4pn83.shop
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 07:29 UTC to 2027-02-06 07:29 UTC
    Logged 2026-11-08 08:27 UTC in Google ParcelYard2027h1, entry 674,129,139
    SHA-256 9419eace00fb65002dcfff8f0ab1b34b482f8bd9f35aad377877ac59a1a5d089
    Public key SHA-256 0d8b9b54ffa056e097777b04963905a91510daec7f35b25467c59af8b8979e4a
    Addresses
    74.82.196.142 · Canada · AS25820 IT7NET - IT7 Networks Inc
    Domain
    txk4pn83.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  59. unmodincan.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    unmodincan.store
    First seen
    2026-11-08 08:30 UTC
    Listing
    CERT Polska listed it 2026-09-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:29 UTC to 2027-02-06 08:28 UTC
    Logged 2026-11-08 08:29 UTC in Google ParcelYard2027h1, entry 674,152,692
    SHA-256 abcb2017571bfbba744dd76803a62b7760a5cb81d6a1d8e873de573546ada446
    Public key SHA-256 ad415e2f29536d699b3fc0f4ba749b988691ba560a8b8ff8e024a7c3d5b34453
    Addresses
    104.21.52.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.19 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.52.44, 172.67.195.19): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    unmodincan.store
    Registered
    2026-09-10 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  60. v-potwierdz-602914.eu.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    v-potwierdz-602914.eu.cc
    First seen
    2026-11-08 08:30 UTC
    Listing
    CERT Polska listed it 2026-09-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:19 UTC to 2027-02-06 08:27 UTC
    Logged 2026-11-08 08:29 UTC in DigiCert Wyvern2027h1, entry 451,698,988
    SHA-256 86e68b8ac5b809820d12cad5c72e3a2cda44a23f7f72662256d52f79c53f7bab
    Public key SHA-256 6d237773ec30eda87759103437e030d46db1d5942842fb2101957dbf0c49b57c
    Addresses
    104.21.2.11 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.127 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.2.11, 172.67.128.127): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  61. vpt4qx85.shop CA · AS25820 · IT7 Networks Inc
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    vpt4qx85.shop
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 07:31 UTC to 2027-02-06 07:31 UTC
    Logged 2026-11-08 08:29 UTC in Google ParcelYard2027h1, entry 674,153,064
    SHA-256 069068d2e2cd83c4272bc212fb568fcfaa5419fbaaa651f7680022183b050ca0
    Public key SHA-256 8af8b62c0d16cdeaa655f9739241d2a58e4bda2a609b63f09368542c88afcd0e
    Addresses
    74.82.196.142 · Canada · AS25820 IT7NET - IT7 Networks Inc
    Domain
    vpt4qx85.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  62. vsignal.app
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    vsignal.app
    First seen
    2026-11-08 08:30 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:30 UTC to 2027-02-06 07:30 UTC
    Logged 2026-11-08 08:28 UTC in DigiCert Sphinx2027h1, entry 399,600,920
    SHA-256 4e9c136492672fb94da294503d46b495f9543ed30bddad5b0896ab825cb9d1d9
    Public key SHA-256 fd0de931ae232f7716b37b2bb487a33c98443d5c150c0f2f4cc843e6c90598ab
    Domain
    vsignal.app
    Registered
    2026-05-15 · CloudFlare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  63. wafati.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    wafati.asia
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:17 UTC to 2027-02-06 08:24 UTC
    Logged 2026-11-08 08:27 UTC in DigiCert Wyvern2027h1, entry 451,670,120
    SHA-256 200bf14c3cac0021feb00105a838c9d0a238e65b89b5c8601fecd1c0a5016582
    Public key SHA-256 e270e5f48e519943832f7a9d432e5620dc075d8c66097de093d847ed965d19c8
    Addresses
    104.21.65.95 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.95, 172.67.189.186): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wafati.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  64. yznipy.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    yznipy.asia
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:28 UTC to 2027-02-06 08:27 UTC
    Logged 2026-11-08 08:28 UTC in Google ParcelYard2027h1, entry 674,139,760
    SHA-256 7cbc5d2dfb042e7f129bf65c2155efc1c96f73e56cc27016c009d9e1886c3f89
    Public key SHA-256 cb57394b33cae314a653b1b70d7b2f350f7a1339335d5d87084a36f28afa18ea
    Addresses
    104.21.42.4 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.197.223 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.42.4, 172.67.197.223): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    yznipy.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  65. zwt3mq54.shop CA · AS25820 · IT7 Networks Inc
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    zwt3mq54.shop
    First seen
    2026-11-08 08:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 07:30 UTC to 2027-02-06 07:30 UTC
    Logged 2026-11-08 08:29 UTC in Google ParcelYard2027h1, entry 674,145,470
    SHA-256 5eecae33a33c55e4f9a6db6f60100d1b0149558aa38767dbdde1db99f05b21d5
    Public key SHA-256 409c3bc99334b12e4cf3bca36826625771a3f3025709e195062d1a87851f4004
    Addresses
    74.82.196.142 · Canada · AS25820 IT7NET - IT7 Networks Inc
    Domain
    zwt3mq54.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  66. www.ela-valorant.com US · AS14061 · DigitalOcean, LLCValorant
    Phishing hostDigitalOceanAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    www.ela-valorant.com
    First seen
    2026-11-08 08:30 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 139.59.232.1.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 139.59.232.1
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:26 UTC to 2027-02-06 07:26 UTC
    Logged 2026-11-08 08:25 UTC in IPng Networks Gouda2027h1, entry 352,001,173
    SHA-256 362734cd53f39e8cb7b96968d2323465793b3d807ba2054af0629d077adc4764
    Public key SHA-256 6a8310bd977b8be8a0adbb57453f7fd121f172c30f72487b5a30f8ab39457cfc
    Brand
    Valorant
    Addresses
    139.59.232.1 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (139.59.232.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ela-valorant.com
    Registered
    2024-06-14 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  67. ela-valorant.com US · AS14061 · DigitalOcean, LLCValorant
    Phishing hostDigitalOceanAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    ela-valorant.com
    First seen
    2026-11-08 08:30 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 139.59.232.1.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 139.59.232.1
    Certificate
    Issued by YE2
    Valid 2026-11-08 07:26 UTC to 2027-02-06 07:26 UTC
    Logged 2026-11-08 08:25 UTC in Google ParcelYard2027h1, entry 674,092,681
    SHA-256 6b56660bdf252fbc9d45b6e0efe192e2a61b87986b3c74eb27781e6b13e82f7c
    Public key SHA-256 74a98eb207675443838d373f61d60e6f9dcbafa996ae64d79164ee8844fdd884
    Brand
    Valorant
    Addresses
    139.59.232.1 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (139.59.232.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ela-valorant.com
    Registered
    2024-06-14 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  68. api.mirflectgainplatform-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    api.mirflectgainplatform-com.financecryptoworld.com
    First seen
    2026-11-08 08:26 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 07:22 UTC to 2027-02-06 08:21 UTC
    Logged 2026-11-08 08:22 UTC in IPng Networks Halloumi2027h1, entry 409,110,474
    SHA-256 2a24dfb37fce1880a54a9915ad5c1bd829633f4e428ef36330f28c7b34e04760
    Public key SHA-256 7fa0e6b8ae2d72b17cc9369e733f576d285344d5531e6d8766d0ba06b98123e4
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  69. apteka.marketpl.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder marketpl.shop, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    apteka.marketpl.shop
    First seen
    2026-11-08 08:26 UTC
    Listing
    CERT Polska listed it 2026-07-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska, listing marketpl.shop and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 07:21 UTC to 2027-02-06 08:20 UTC
    Logged 2026-11-08 08:21 UTC in Let's Encrypt Willow2027h1, entry 999,737,048
    SHA-256 35fcd10ec2486a5959bffc828a3ba9f7aeab7612efe348e2c4b127a0d5e9aff6
    Public key SHA-256 8a5848e49c5c81a2f6067b82c9445cce50385aa9cad398d78d3835eefcaafaef
    Addresses
    104.21.14.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.15 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.14.164, 172.67.160.15): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    marketpl.shop
    Registered
    2026-07-10 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 11:36 UTC

    Suggest a correction

  70. arrwr.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    arrwr.work
    First seen
    2026-11-08 08:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 07:26 UTC to 2027-02-06 07:26 UTC
    Logged 2026-11-08 08:24 UTC in Google PlumbersArms2027h1, entry 674,399,599
    SHA-256 03ffb10bc97570986351150cfc31481693a9245127736f63365d748d26c5d402
    Public key SHA-256 968d929f0454334b3aae7419bea18ca7b9aceb5daf1a0d14d0ed87900b287802
    Addresses
    104.21.37.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.12 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.37.64, 172.67.205.12): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    arrwr.work
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:31 UTC

    Suggest a correction

  71. cor6k8.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    cor6k8.hdiv8jy.com
    First seen
    2026-11-08 08:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 07:25 UTC to 2027-02-06 07:25 UTC
    Logged 2026-11-08 08:23 UTC in Google PlumbersArms2027h1, entry 674,387,696
    SHA-256 10200e58652a547fbf385dd9743b933942d97b83f7939eb30120b0f2321c7929
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  72. econidspzae.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    econidspzae.com
    First seen
    2026-11-08 08:26 UTC
    Listing
    CERT Polska listed it 2026-07-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:21 UTC to 2027-02-06 08:19 UTC
    Logged 2026-11-08 08:21 UTC in IPng Networks Halloumi2027h1, entry 409,105,368
    SHA-256 f3a1453a3a0e565c37866ecd4501e26050ecc3a1c28267f2569ba57809ade6b5
    Public key SHA-256 433f99230cf3131fa2663d6ffe9876ce6045b755722ec7104decefd535d21d60
    Addresses
    104.21.13.160 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.156.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.13.160, 172.67.156.193): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    econidspzae.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:31 UTC

    Suggest a correction

  73. edockeds.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    edockeds.shop
    First seen
    2026-11-08 08:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:23 UTC to 2027-02-06 08:22 UTC
    Logged 2026-11-08 08:23 UTC in Google PlumbersArms2027h1, entry 674,383,742
    SHA-256 b6e3f09f533d9b3a08eaf8d75dc6c353d41dbd4fe56ac23204ffc8c3fd2a438c
    Public key SHA-256 d8d590ff169f4c72b66b084d911915fb420be9e331e220db3bddfe00f5efb241
    Addresses
    104.21.12.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.238 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.12.42, 172.67.131.238): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    edockeds.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:31 UTC

    Suggest a correction

  74. fermpandrecht-ai.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    fermpandrecht-ai.live
    First seen
    2026-11-08 08:26 UTC
    Listing
    CERT Polska listed it 2026-07-31 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:12 UTC to 2027-02-06 08:20 UTC
    Logged 2026-11-08 08:22 UTC in Let's Encrypt Sycamore2027h1, entry 1,041,946,479
    SHA-256 d0bbc9ac2bbecdb4c0882da96f3e2317803784ab01102b90114de2d15f4e1a18
    Public key SHA-256 510cacc181e1b69b288d29a0cc9d4e76bb9ff088a12df04083a6a2263456f6ef
    Addresses
    104.21.2.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.2.77, 172.67.128.229): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fermpandrecht-ai.live
    Registered
    2026-06-03 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  75. jetswap.pro
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    jetswap.pro
    First seen
    2026-11-08 08:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:12 UTC to 2027-02-06 08:20 UTC
    Logged 2026-11-08 08:22 UTC in DigiCert Wyvern2027h1, entry 451,628,844
    SHA-256 83e574543bc16a1903e48a329f3194031d14c33a85fc6e680361474abb9362bb
    Public key SHA-256 317d0f37846b5e86468d3b91e6bf488d1616e27fce82536c99d1ee38b20b04a0
    Domain
    jetswap.pro
    Registered
    2026-05-24 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  76. sawaypl-online.shop US · AS396982 · Google LLC
    ListedGoogle CloudListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    sawaypl-online.shop
    First seen
    2026-11-08 08:26 UTC
    Listing
    CERT Polska listed it 2026-10-06 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-08 07:21 UTC to 2027-02-06 08:14 UTC
    Logged 2026-11-08 08:21 UTC in Google PlumbersArms2027h1, entry 674,359,629
    SHA-256 8c56e0d21f2949fdce271914cdf49f9ccd342a54ce6471f6ad5fe517425230fa
    Public key SHA-256 014ac085ce13bb97874f923bf57c2e38c2ee973e40e6701ec22f7ad2e6d566a5
    Addresses
    34.8.165.143 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.8.165.143): a cloud provider. It rents servers and addresses to its customers.
    Domain
    sawaypl-online.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  77. three.philflex.com US · AS400304 · Redoubt Networks
    ListedUnder philflex.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 27 y ago
    DetailsHide
    Hostname
    three.philflex.com
    First seen
    2026-11-08 08:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask, listing philflex.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 07:22 UTC to 2027-02-06 07:22 UTC
    Logged 2026-11-08 08:20 UTC in DigiCert Wyvern2027h1, entry 451,612,156
    SHA-256 c21c719a67b63232ce5a070a06311eb67be813e75e5516e9da9f71e13b7c0bff
    Public key SHA-256 6e541b3c27a313b2be9103281cd0d49df3fcf17496d7e869e16042df68423f07
    Addresses
    167.17.73.168 · United States · AS400304 CRUNCHBITS - Redoubt Networks
    Domain
    philflex.com
    Registered
    1999-12-29 · DNC Holdings, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:36 UTC

    Suggest a correction

  78. twenty.ten.philflex.com US · AS400304 · Redoubt Networks
    ListedUnder philflex.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 27 y ago
    DetailsHide
    Hostname
    twenty.ten.philflex.com
    First seen
    2026-11-08 08:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask, listing philflex.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 07:23 UTC to 2027-02-06 07:23 UTC
    Logged 2026-11-08 08:22 UTC in Let's Encrypt Sycamore2027h1, entry 1,041,952,491
    SHA-256 6499b8b9d7706edbc3d0d636f4ec7f5a6874e446de254a4a65f7a04f159256b2
    Public key SHA-256 993c93e06b23d9593d54e42a38e0624c11d4cffe94e950c8b73a64b44fe16e1a
    Addresses
    167.17.73.168 · United States · AS400304 CRUNCHBITS - Redoubt Networks
    Domain
    philflex.com
    Registered
    1999-12-29 · DNC Holdings, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:36 UTC

    Suggest a correction

  79. underingru.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    underingru.store
    First seen
    2026-11-08 08:26 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:23 UTC to 2027-02-06 08:22 UTC
    Logged 2026-11-08 08:23 UTC in Geomys Tuscolo2027h1, entry 525,385,998
    SHA-256 79988aa9f80f63955871d65e161e6da15f71ad7db0cd36d16031725bd05d9b65
    Public key SHA-256 ab47ece3fd5edb3191647dce672fd7e20b89c7ecaa2da8da887e831442b1b082
    Addresses
    104.21.76.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.192.110 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.76.94, 172.67.192.110): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    underingru.store
    Registered
    2026-09-10 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  80. wgrtqh.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    wgrtqh.asia
    First seen
    2026-11-08 08:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:23 UTC to 2027-02-06 08:22 UTC
    Logged 2026-11-08 08:23 UTC in IPng Networks Halloumi2027h1, entry 409,113,284
    SHA-256 3afe761c6cbd8a41dc05d6b8ea28dfd8531455437848b66196239ea7e880aaa5
    Public key SHA-256 83ad9c0c860a4185cb10b59ed957d2c7a5fc903d7908016190b46e31f0cea30e
    Addresses
    104.21.51.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.177 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.237, 172.67.191.177): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wgrtqh.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  81. www.zoom-av.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ListedHostingerUnder zoom-av.com, listed by MetaMaskMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    www.zoom-av.com
    First seen
    2026-11-08 08:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask, listing zoom-av.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:25 UTC to 2027-02-06 07:25 UTC
    Logged 2026-11-08 08:23 UTC in DigiCert Wyvern2027h1, entry 451,636,869
    SHA-256 584f31c3101d4f985be753a126a607f06ec0093e471d7891abe035ef85977183
    Public key SHA-256 19e265bf959519fa063ecefe9fe818064ec1d7f729e83cb29498d20e833cc241
    Addresses
    77.37.53.54 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    91.108.98.62 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (77.37.53.54, 91.108.98.62): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    zoom-av.com
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:31 UTC

    Suggest a correction

  82. zero.philflex.com US · AS400304 · Redoubt Networks
    ListedUnder philflex.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 27 y ago
    DetailsHide
    Hostname
    zero.philflex.com
    First seen
    2026-11-08 08:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask, listing philflex.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 07:22 UTC to 2027-02-06 07:22 UTC
    Logged 2026-11-08 08:20 UTC in Let's Encrypt Willow2027h1, entry 999,732,134
    SHA-256 68d0fa9985f367e958b2104750a4f68cba2014f456efd624c56c1bb8fef8e045
    Public key SHA-256 efe418ef00a7309d26259e508d9b9b5d10ebb1984e8a94993a9a79d8de035c69
    Addresses
    167.17.73.168 · United States · AS400304 CRUNCHBITS - Redoubt Networks
    Domain
    philflex.com
    Registered
    1999-12-29 · DNC Holdings, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:36 UTC

    Suggest a correction

  83. zoom-av.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ListedHostingerListed by MetaMaskMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    zoom-av.com
    First seen
    2026-11-08 08:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:25 UTC to 2027-02-06 07:25 UTC
    Logged 2026-11-08 08:23 UTC in DigiCert Wyvern2027h1, entry 451,636,869
    SHA-256 584f31c3101d4f985be753a126a607f06ec0093e471d7891abe035ef85977183
    Public key SHA-256 19e265bf959519fa063ecefe9fe818064ec1d7f729e83cb29498d20e833cc241
    Addresses
    77.37.53.1 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    77.37.83.240 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (77.37.53.1, 77.37.83.240): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    zoom-av.com
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:31 UTC

    Suggest a correction

  84. www.kraljica.co.ba.iphone.ba BA · AS200698 · GLOBALHOST-BOSNIA-AS Global…Apple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantine
    DetailsHide
    Hostname
    www.kraljica.co.ba.iphone.ba
    First seen
    2026-11-08 08:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.156.250.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.156.250.161
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 07:20 UTC to 2027-02-06 07:20 UTC
    Logged 2026-11-08 08:18 UTC in Let's Encrypt Willow2027h1, entry 999,699,417
    SHA-256 658bf0bf17b096a7f4efe6b896eb4b842971444408959eabd2331aebe2adc76e
    Public key SHA-256 17ed7b49064dae04fa55fec1e682cfb2299f2153c4283223ed7c7b890b7b1b7a
    Brand
    Apple
    Addresses
    45.156.250.161 · Bosnia & Herzegovina · AS200698 GLOBALHOST-BOSNIA-AS Globalhost d.o.o.
    Domain
    iphone.ba
    MX
    Receives mail at iphone.ba
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-08 08:38 UTC

    Suggest a correction

  85. kraljica.co.ba.iphone.ba BA · AS200698 · GLOBALHOST-BOSNIA-AS Global…Apple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantine
    DetailsHide
    Hostname
    kraljica.co.ba.iphone.ba
    First seen
    2026-11-08 08:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.156.250.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.156.250.161
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 07:20 UTC to 2027-02-06 07:20 UTC
    Logged 2026-11-08 08:18 UTC in Let's Encrypt Willow2027h1, entry 999,699,417
    SHA-256 658bf0bf17b096a7f4efe6b896eb4b842971444408959eabd2331aebe2adc76e
    Public key SHA-256 17ed7b49064dae04fa55fec1e682cfb2299f2153c4283223ed7c7b890b7b1b7a
    Brand
    Apple
    Addresses
    45.156.250.161 · Bosnia & Herzegovina · AS200698 GLOBALHOST-BOSNIA-AS Globalhost d.o.o.
    Domain
    iphone.ba
    MX
    Receives mail at iphone.ba
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-08 08:38 UTC

    Suggest a correction

  86. 16bettelegram.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    16bettelegram.com
    First seen
    2026-11-08 08:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:17 UTC to 2027-02-06 08:15 UTC
    Logged 2026-11-08 08:17 UTC in DigiCert Wyvern2027h1, entry 451,583,472
    SHA-256 22a70f702628aa29bbf743d2b4716cf6c98d7cada0efe4fce532ef57bddd0dd4
    Public key SHA-256 67c71f03e02ded283141423cbb2f2b296862ead6f53b4d35fb7a3d9ce3a994b6
    PhishDestroy
    Addresses
    104.21.68.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.138, 172.67.195.237): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    16bettelegram.com
    Registered
    2025-07-22 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:25 UTC

    Suggest a correction

  87. bcynrr.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    bcynrr.asia
    First seen
    2026-11-08 08:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 04:03 UTC to 2026-12-09 05:01 UTC
    Logged 2026-11-08 08:16 UTC in DigiCert Wyvern2026h2, entry 2,211,788,620
    SHA-256 03f21ec02ca348e88c0367f20ee4dc19093b67879eb7c9c18f9d5f39504e297b
    Public key SHA-256 1d4e3ccfe2269e36de3363d89746505d1ef3d8aafb4b8ff3d9fb76e53147f003
    Addresses
    104.21.27.5 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.139.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.27.5, 172.67.139.206): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bcynrr.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  88. gmajxn.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    gmajxn.asia
    First seen
    2026-11-08 08:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:16 UTC to 2027-02-06 08:14 UTC
    Logged 2026-11-08 08:16 UTC in Geomys Tuscolo2027h1, entry 525,305,795
    SHA-256 09a61500f7d3d8584dd70005bcbed02bfab248d9f480a0dfe89408b2d67227bd
    Public key SHA-256 1486024c1852b686ab581377cf7049308b5612409e8ef5e7ca4942e4a1955b3c
    Addresses
    104.21.5.59 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.133.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.5.59, 172.67.133.6): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gmajxn.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  89. gmqcph.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    gmqcph.asia
    First seen
    2026-11-08 08:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:19 UTC to 2027-02-06 08:17 UTC
    Logged 2026-11-08 08:19 UTC in DigiCert Sphinx2027h1, entry 399,522,022
    SHA-256 22f553a5c8487888f0c23b3eb5173e35ad21513c014e74ccc9462af07718cc99
    Public key SHA-256 a1fd3b4ca2325ad687073836a8b45a116814c4f13d4cbe41d69846575058ea3a
    Addresses
    104.21.94.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.94.83, 172.67.221.72): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gmqcph.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  90. hub.mantra.finance US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder mantra.finance, reported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 5 y ago
    DetailsHide
    Hostname
    hub.mantra.finance
    First seen
    2026-11-08 08:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing mantra.finance and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 07:17 UTC to 2027-02-06 08:13 UTC
    Logged 2026-11-08 08:17 UTC in Google ParcelYard2027h1, entry 673,994,063
    SHA-256 0823137d1aa744a3543959c1211790e043a353061733ac28867182d4e0da59d1
    Public key SHA-256 c7425756811d5c3f8d7666f86f8edd04c5709736a485fae9c530997f4e8fc3c5
    PhishDestroy
    Addresses
    104.18.6.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.18.7.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.6.193, 104.18.7.193): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mantra.finance
    Registered
    2021-07-08 · GoDaddy.com, LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 22:50 UTC

    Suggest a correction

  91. mantra.finance US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 5 y ago
    DetailsHide
    Hostname
    mantra.finance
    First seen
    2026-11-08 08:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 07:17 UTC to 2027-02-06 08:13 UTC
    Logged 2026-11-08 08:17 UTC in Google ParcelYard2027h1, entry 673,994,063
    SHA-256 0823137d1aa744a3543959c1211790e043a353061733ac28867182d4e0da59d1
    Public key SHA-256 c7425756811d5c3f8d7666f86f8edd04c5709736a485fae9c530997f4e8fc3c5
    PhishDestroy
    Addresses
    104.18.6.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.18.7.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.6.193, 104.18.7.193): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mantra.finance
    Registered
    2021-07-08 · GoDaddy.com, LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 22:50 UTC

    Suggest a correction

  92. maplemju.com
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    maplemju.com
    First seen
    2026-11-08 08:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:18 UTC to 2027-02-06 08:16 UTC
    Logged 2026-11-08 08:18 UTC in DigiCert Wyvern2027h1, entry 451,589,839
    SHA-256 c5ccc6bbbfb62e62d97be21c5f7e100af14959efd9514ff93f830d807b79c79b
    Public key SHA-256 fee906e80c49d23573ad7655532cf77d5dd8e349e17eb1d524da603c03c6e570
    Domain
    maplemju.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:29 UTC

    Suggest a correction

  93. nuevoproyecto.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    nuevoproyecto.net
    First seen
    2026-11-08 08:20 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:08 UTC to 2027-02-06 08:17 UTC
    Logged 2026-11-08 08:18 UTC in DigiCert Wyvern2027h1, entry 451,594,200
    SHA-256 db3b554accdf6f81bb5beed23c609b7ee40668e4ba3ca0d1ab30ed50dffd16d1
    Public key SHA-256 8a48dea0acca5c4e3bdfd0faca197d7ff925d6535721e796e031ded43eec5ba4
    Addresses
    104.21.56.226 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.156.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.56.226, 172.67.156.63): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nuevoproyecto.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:29 UTC

    Suggest a correction

  94. policlania.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    policlania.store
    First seen
    2026-11-08 08:20 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:16 UTC to 2027-02-06 08:14 UTC
    Logged 2026-11-08 08:16 UTC in DigiCert Sphinx2027h1, entry 399,504,259
    SHA-256 d04867ebdb1243d576392e4c4532705a1e2eb0c1777f0954955f49534b795440
    Public key SHA-256 dff253dc4393e1ef37dc77b93c59b0b56b2b773752573853d52ca9564fd2bb6d
    Addresses
    104.21.59.114 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.160 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.59.114, 172.67.175.160): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    policlania.store
    Registered
    2026-09-10 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  95. pptqiv.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    pptqiv.asia
    First seen
    2026-11-08 08:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 09:38 UTC to 2026-12-09 10:38 UTC
    Logged 2026-11-08 08:19 UTC in Geomys Tuscolo2026h2, entry 1,045,972,647
    SHA-256 4cfe074c351c03fbc581474778c355ff5f421de8a2b298c36a9a542f6cdb7255
    Public key SHA-256 ed7bd22465714d586f8a05227f0da62216111aa39c0dc1d877e74a455e4486bc
    Addresses
    104.21.53.146 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.146, 172.67.213.139): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pptqiv.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  96. pretonixgroup.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    pretonixgroup.com
    First seen
    2026-11-08 08:20 UTC
    Listing
    USOM listed it 2026-05-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 08:36 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 07:21 UTC to 2027-02-06 07:21 UTC
    Logged 2026-11-08 08:19 UTC in Geomys Tuscolo2027h1, entry 525,346,129
    SHA-256 74e9522e0008f3f322129cbe623a8d5520fdb9f834d4bf2ff909845ab006e3e0
    Public key SHA-256 2bd8d910cabe843f8b5592797e65482f13461abac5f07d485de863a66b82c452
    Addresses
    104.21.52.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.197.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.52.90, 172.67.197.142): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pretonixgroup.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:29 UTC

    Suggest a correction

  97. qfsecurevault.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF -allDMARC reject
    DetailsHide
    Hostname
    qfsecurevault.com
    First seen
    2026-11-08 08:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 07:19 UTC to 2027-02-06 08:17 UTC
    Logged 2026-11-08 08:19 UTC in DigiCert Sphinx2027h1, entry 399,520,037
    SHA-256 ff7c25c08237a25d7ab02a079e7815afb48f87fb166cfb740e99122b8a6a6bca
    Public key SHA-256 a3d8a6b6bc533fb7e3bc68b1fe3f703a731642eb5592ece6016e7ca0495ce201
    PhishDestroy
    Addresses
    104.21.79.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.5 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.79.49, 172.67.142.5): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qfsecurevault.com
    MX
    Receives mail at igw08.site4now.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 08:29 UTC

    Suggest a correction

  98. rocashpinebridge.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    rocashpinebridge.com
    First seen
    2026-11-08 08:20 UTC
    Listing
    CERT Polska listed it 2026-07-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 06:31 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 08:08 UTC to 2027-02-06 08:14 UTC
    Logged 2026-11-08 08:18 UTC in DigiCert Wyvern2027h1, entry 451,589,710
    SHA-256 537dc644f65ef8e70618564426354ec42851605e956760600bad36eade7556e2
    Public key SHA-256 8e23eba71760a9f316f7aaf3a72ce57492da4e8c1ae3b3acd3e9a2c59803e9c5
    Addresses
    104.21.33.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.151.252 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.246, 172.67.151.252): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rocashpinebridge.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:29 UTC

    Suggest a correction

  99. testnet.fogolend.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder fogolend.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    testnet.fogolend.com
    First seen
    2026-11-08 08:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing fogolend.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 07:17 UTC to 2027-02-06 08:13 UTC
    Logged 2026-11-08 08:17 UTC in Google PlumbersArms2027h1, entry 674,306,847
    SHA-256 28a907755d3d02538bdade5e1d0be133352c33ca6ce6ae26f48c2600b8bc31f9
    Public key SHA-256 54f06036ee61e864eb94edf26721b377a764a276e0f73ea171fffcd524c52511
    PhishDestroy
    Addresses
    104.21.96.16 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.150.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.96.16, 172.67.150.64): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fogolend.com
    Registered
    2025-08-28 · NameCheap, Inc.
    MX
    Receives mail at route2.mx.cloudflare.net, route1.mx.cloudflare.net, route3.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 04:16 UTC

    Suggest a correction

  100. try.glek-panel.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder glek-panel.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    try.glek-panel.com
    First seen
    2026-11-08 08:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing glek-panel.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 07:18 UTC to 2027-02-06 07:18 UTC
    Logged 2026-11-08 08:16 UTC in IPng Networks Halloumi2027h1, entry 409,060,980
    SHA-256 1ca0dfce7b6d42abf216c565012b6d7c2060d658e0fe91162cd99d3c97399c0e
    Public key SHA-256 58483b3752fdb1a296a587d50833f6853a700a7620db1db0182dc4d4cb350a91
    PhishDestroy
    Addresses
    185.178.208.163 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.163): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    glek-panel.com
    Registered
    2026-04-21 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 00:44 UTC

    Suggest a correction

Showing 1–100 of 5,704 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources