Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-08 11:00 UTC
Certificate-log entries · 24 h
322.8M
from 84 distinct feeds
Unique certificates · 24 h
31.6M
each reviewed
Names resolved · 24 h
20.2M
15.1M with an address
Findings · 24 h
5,714
209 of 1,061 brands targeted

5,714 hostnames from the last 24 hours.

  1. axynefzbhdi.topMinistry of Internal Affairs and Communications (MIC)
    ListedListed by JPCERT/CC as imitating 総務省MX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    axynefzbhdi.top
    First seen
    2026-11-08 10:41 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-30 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 02:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:37 UTC to 2027-02-06 09:37 UTC
    Logged 2026-11-08 10:36 UTC in Google ParcelYard2027h1, entry 675,991,931
    SHA-256 79e39956e404c9d32abbae255542841606744cccf5e4b8acfab58a035d6d1902
    Public key SHA-256 3f414c457485d5fb0fb612145a6ea5092e6f1110e8ccf80ac5e7b352ae61ea7a
    Brand
    Ministry of Internal Affairs and Communications (MIC)
    Domain
    axynefzbhdi.top
    Registered
    2025-12-20 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  2. basisfyle.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    basisfyle.com
    First seen
    2026-11-08 10:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:40 UTC to 2027-02-06 10:39 UTC
    Logged 2026-11-08 10:40 UTC in DigiCert Wyvern2027h1, entry 453,027,245
    SHA-256 8bd800538ae80f6c80fee5a59b9cb679894777ac5276a045c15d95b57cac0739
    Public key SHA-256 920c19aa38002a237df95f860ba2c52e7e3e59135548adaa9045968ffdd19130
    Addresses
    104.21.54.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.81 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.54.90, 172.67.137.81): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    basisfyle.com
    Registered
    2026-07-13 · Ultahost, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  3. czwqddaostue.topMinistry of Internal Affairs and Communications (MIC)
    ListedListed by JPCERT/CC as imitating 総務省MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    czwqddaostue.top
    First seen
    2026-11-08 10:41 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-30 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 02:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 09:38 UTC to 2027-02-06 09:38 UTC
    Logged 2026-11-08 10:36 UTC in Google PlumbersArms2027h1, entry 676,306,371
    SHA-256 4cbd8e53da550d5b2695b2ceb388f937f51fd16cda249c1ff9eaa0c4ebfd3ca0
    Public key SHA-256 bfc6d1acf18c235a82035a08eff3b9c4045db1a687ab2b330ca13217233ffebb
    Brand
    Ministry of Internal Affairs and Communications (MIC)
    Domain
    czwqddaostue.top
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:43 UTC

    Suggest a correction

  4. goldenstarcasinos-ca.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    goldenstarcasinos-ca.com
    First seen
    2026-11-08 10:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:37 UTC to 2027-02-06 09:37 UTC
    Logged 2026-11-08 10:36 UTC in Let's Encrypt Sycamore2027h1, entry 1,045,215,972
    SHA-256 82fb84a807d858f0f7bb00487098ea61a37917af34f0b572287f53c6e4c1aec6
    Public key SHA-256 b723beef8f8ebe149c5799bf7851a2fb06eaaf2441f474f200bdd8cf00a3c298
    PhishDestroy
    Addresses
    104.21.53.144 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.137 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.144, 172.67.213.137): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    goldenstarcasinos-ca.com
    Registered
    2025-12-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  5. merit-king-dogru10.sbs US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    merit-king-dogru10.sbs
    First seen
    2026-11-08 10:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:35 UTC to 2027-02-06 10:34 UTC
    Logged 2026-11-08 10:35 UTC in DigiCert Sphinx2027h1, entry 400,789,253
    SHA-256 1f39207265a73bd417e0ce54f49b1faf9cfabf204e6089921bbf0d534a9e8177
    Public key SHA-256 b571d375f498517fd6a233fd19e1241621b533062f67eb27ca087a3d08c687d6
    PhishDestroy
    Addresses
    104.21.45.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.45.97, 172.67.212.221): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    merit-king-dogru10.sbs
    Registered
    2026-07-10 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  6. nykebilvotkfcf.top US · AS13335 · Cloudflare, Inc.2 addressesMinistry of Internal Affairs and Communications (MIC)
    ListedCloudflareListed by JPCERT/CC as imitating 総務省MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    nykebilvotkfcf.top
    First seen
    2026-11-08 10:41 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-31 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 02:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:39 UTC to 2027-02-06 09:39 UTC
    Logged 2026-11-08 10:38 UTC in Geomys Tuscolo2027h1, entry 526,821,482
    SHA-256 2481823b1786aea1c14b8a7b727e0989d906cdb2b3a59d7360db5637c1391200
    Public key SHA-256 1d92da615153c30bc35b29def453a184a5acf9bb3b1a5c47269b0c5e450861c6
    Brand
    Ministry of Internal Affairs and Communications (MIC)
    Addresses
    104.21.59.183 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.65 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.59.183, 172.67.182.65): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nykebilvotkfcf.top
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:43 UTC

    Suggest a correction

  7. rwjptgalcfbgvi.topMinistry of Internal Affairs and Communications (MIC)
    ListedListed by JPCERT/CC as imitating 総務省MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    rwjptgalcfbgvi.top
    First seen
    2026-11-08 10:41 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-30 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 02:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:41 UTC to 2027-02-06 09:41 UTC
    Logged 2026-11-08 10:40 UTC in Google ParcelYard2027h1, entry 676,044,181
    SHA-256 8310ee478b9276d70799cbd8aaa8a7048def9a4d0dd7e768a00f9d7ba2944e56
    Public key SHA-256 6c406a40375b1e2dd69fec850c095a48ff1fc2c1d4c7bdc46cf78ec3ba9fe0f1
    Brand
    Ministry of Internal Affairs and Communications (MIC)
    Domain
    rwjptgalcfbgvi.top
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:43 UTC

    Suggest a correction

  8. stage.x-swap.org US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder x-swap.org, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 21 mo ago
    DetailsHide
    Hostname
    stage.x-swap.org
    First seen
    2026-11-08 10:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing x-swap.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 09:39 UTC to 2027-02-06 09:39 UTC
    Logged 2026-11-08 10:37 UTC in IPng Networks Gouda2027h1, entry 353,087,372
    SHA-256 2adf732949754435eea493e34935e4ca6ae5f8e0d9a1f6d8b3caa903a6c93705
    Public key SHA-256 9fc916e6d33c0e7a7c03cba12989540cafc0a4f3941be55a17aa50f9d4436c14
    PhishDestroy
    Addresses
    66.33.60.34 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.76.21.164 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (66.33.60.34, 76.76.21.164): a cloud provider. It rents servers and addresses to its customers.
    Domain
    x-swap.org
    Registered
    2025-02-27 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 20:00 UTC

    Suggest a correction

  9. xhamsternft.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    xhamsternft.com
    First seen
    2026-11-08 10:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:40 UTC to 2027-02-06 10:38 UTC
    Logged 2026-11-08 10:40 UTC in IPng Networks Gouda2027h1, entry 353,113,331
    SHA-256 94dac90b6f9cb0cf51db81e9141195d2e9bade2eb409c327b2d3c48c59a64750
    Public key SHA-256 301a2221b6bba83137a898f1158c606c22579eb7a1d436ad6fa54e53a58ec362
    PhishDestroy
    Addresses
    104.21.89.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.53 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.89.219, 172.67.165.53): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xhamsternft.com
    Registered
    2022-09-16 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  10. zdxpilpaslv.topMinistry of Internal Affairs and Communications (MIC)
    ListedListed by JPCERT/CC as imitating 総務省MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    zdxpilpaslv.top
    First seen
    2026-11-08 10:41 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-30 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 02:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 09:39 UTC to 2027-02-06 09:39 UTC
    Logged 2026-11-08 10:37 UTC in Google ParcelYard2027h1, entry 676,011,608
    SHA-256 3418697d476f03aece8eb6b0feb30bc8942c798b7551c025304c8bb330abbfcb
    Public key SHA-256 3db2ca540dc03540cec66e7bc638b42fdd914601677269ef337afbee1c6cf72e
    Brand
    Ministry of Internal Affairs and Communications (MIC)
    Domain
    zdxpilpaslv.top
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:43 UTC

    Suggest a correction

  11. www.edit-whatsapp.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…WhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.edit-whatsapp.com
    First seen
    2026-11-08 10:36 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    Certificate
    Issued by YR1
    Valid 2026-11-08 09:33 UTC to 2027-02-06 09:33 UTC
    Logged 2026-11-08 10:31 UTC in Google ParcelYard2027h1, entry 675,927,894
    SHA-256 776f3019bcc3e90c62a4c8ba665af85d4c6677a23f9864dc015fa95c2d156254
    Public key SHA-256 ea3a6f7f702da99601509acdc8abe559bb09d53947695235c0b9bead29e171f6
    Brand
    WhatsApp
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  12. www.view-whatsapp.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…WhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.view-whatsapp.com
    First seen
    2026-11-08 10:36 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 09:33 UTC to 2027-02-06 09:33 UTC
    Logged 2026-11-08 10:31 UTC in Let's Encrypt Sycamore2027h1, entry 1,045,116,005
    SHA-256 1174890b0d4692f230f88b3f0e1f678fbb813837e8a5c924edc0c3eba40d22b1
    Public key SHA-256 b07c62d434263e5f574d070c07062611876c7bb08b92723781d63fd5c823c892
    Brand
    WhatsApp
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  13. zh.edit-whatsapp.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…WhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    zh.edit-whatsapp.com
    First seen
    2026-11-08 10:36 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    Certificate
    Issued by YR1
    Valid 2026-11-08 09:33 UTC to 2027-02-06 09:33 UTC
    Logged 2026-11-08 10:31 UTC in Google ParcelYard2027h1, entry 675,927,894
    SHA-256 776f3019bcc3e90c62a4c8ba665af85d4c6677a23f9864dc015fa95c2d156254
    Public key SHA-256 ea3a6f7f702da99601509acdc8abe559bb09d53947695235c0b9bead29e171f6
    Brand
    WhatsApp
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  14. zh.view-whatsapp.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…WhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    zh.view-whatsapp.com
    First seen
    2026-11-08 10:36 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 09:33 UTC to 2027-02-06 09:33 UTC
    Logged 2026-11-08 10:31 UTC in Let's Encrypt Sycamore2027h1, entry 1,045,116,005
    SHA-256 1174890b0d4692f230f88b3f0e1f678fbb813837e8a5c924edc0c3eba40d22b1
    Public key SHA-256 b07c62d434263e5f574d070c07062611876c7bb08b92723781d63fd5c823c892
    Brand
    WhatsApp
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  15. api.crypto.dk DK · AS203953 · Hiper Hiper A/S
    ListedUnder crypto.dk, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    api.crypto.dk
    First seen
    2026-11-08 10:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask, listing crypto.dk and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:34 UTC to 2027-02-06 09:34 UTC
    Logged 2026-11-08 10:32 UTC in Google ParcelYard2027h1, entry 675,941,301
    SHA-256 13070c6ecc1dde47ebcb3036b1798dee5a99ba0e731b1de485a8a30ba9df1483
    Public key SHA-256 208c45d647cd4d8dd4b15f59558c4181a463a6c6baef10b376c30fe61201139f
    Addresses
    213.32.245.165 · Denmark · AS203953 Hiper Hiper A/S
    Domain
    crypto.dk
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:28 UTC

    Suggest a correction

  16. apps.raptool.ai US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder raptool.ai, listed by MetaMaskMX presentSPF -allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    apps.raptool.ai
    First seen
    2026-11-08 10:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing raptool.ai and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 09:33 UTC to 2027-02-06 09:33 UTC
    Logged 2026-11-08 10:32 UTC in IPng Networks Halloumi2027h1, entry 410,344,934
    SHA-256 3d06c51ca2a66bb68c16ba76900d15ee544bf5bf379a47518dc49997f4f9b699
    Public key SHA-256 4ed67607cf851720c2490b6f7c0203c8bfc52406ee5d18acb9b15d2aac69cf0f
    Addresses
    104.21.51.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.132, 172.67.180.159): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    raptool.ai
    Registered
    2026-05-09 · Cloudflare, Inc
    MX
    Receives mail at mail.raptool.ai
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 07:32 UTC

    Suggest a correction

  17. arc-gc-ca.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    arc-gc-ca.com
    First seen
    2026-11-08 10:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 09:35 UTC to 2027-02-06 09:35 UTC
    Logged 2026-11-08 10:33 UTC in Google ParcelYard2027h1, entry 675,958,089
    SHA-256 cf3976308d03f36bad60ab37d30221270a6eb92baefc857e78d92fd96b9bcdb9
    Public key SHA-256 d66c546efeacd780992408e8352413256286ac5c182f04d3f517d42adb3b388c
    PhishDestroy
    Addresses
    104.21.16.137 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.137, 172.67.212.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    arc-gc-ca.com
    Registered
    2026-03-17 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  18. freefireapk.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 21 mo ago
    DetailsHide
    Hostname
    freefireapk.pro
    First seen
    2026-11-08 10:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:35 UTC to 2027-02-06 09:35 UTC
    Logged 2026-11-08 10:34 UTC in Let's Encrypt Willow2027h1, entry 1,001,617,579
    SHA-256 74313b6d96e5916e12ee4486561a5999c87204cfdcd0c4f331465558e22d2401
    Public key SHA-256 21a99856cf549908766a0ca3a646f7206aa2ee58643ec2df2cfaaa823b0120b5
    PhishDestroy
    Addresses
    104.21.5.15 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.132.187 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.5.15, 172.67.132.187): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    freefireapk.pro
    Registered
    2025-02-05 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:38 UTC

    Suggest a correction

  19. kra45------at.ru US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    kra45------at.ru
    First seen
    2026-11-08 10:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:31 UTC to 2027-02-06 10:30 UTC
    Logged 2026-11-08 10:31 UTC in Let's Encrypt Willow2027h1, entry 1,001,579,352
    SHA-256 0fb62da1318e38f0d21dd920942d42e448c92b71854f11291a88e9da11a1a0c1
    Public key SHA-256 829e5f5e669d38f2903eb50d280455c1358b9093ca50a0d9e917c9674405e854
    PhishDestroy
    Addresses
    104.21.5.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.133.223 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.5.216, 172.67.133.223): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kra45------at.ru
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:38 UTC

    Suggest a correction

  20. spk-pushtan.com US · AS6461 · Zayo Bandwidth
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    spk-pushtan.com
    First seen
    2026-11-08 10:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:32 UTC to 2027-02-06 10:29 UTC
    Logged 2026-11-08 10:32 UTC in Google PlumbersArms2027h1, entry 676,242,663
    SHA-256 7f2ab516976591993ed1db95776eedc655ce2d241dadb65d9aaccd95ad096ed7
    Public key SHA-256 6415b6bc5732bd77575d616b48fe3e52ae0d0199e2737d3c6e547d045209bbfc
    Addresses
    158.94.211.203 · United States · AS6461 ZAYO-6461 - Zayo Bandwidth
    Domain
    spk-pushtan.com
    Registered
    2026-06-29 · MAT BAO CORPORATION
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  21. swiftcasino-ca.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    swiftcasino-ca.com
    First seen
    2026-11-08 10:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 09:36 UTC to 2027-02-06 09:36 UTC
    Logged 2026-11-08 10:34 UTC in Google PlumbersArms2027h1, entry 676,277,697
    SHA-256 6c82542d6fb35d209ca011fe506832611b133ea0afd2464c846e526135f7f3e3
    Public key SHA-256 d19af5c4eaf888fff6e7437c29cd3c19fd2669bec94e952bdb4fc6e5b67a8f09
    PhishDestroy
    Addresses
    104.21.6.131 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.220 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.131, 172.67.154.220): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    swiftcasino-ca.com
    Registered
    2025-12-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  22. ultr-wave.site US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    ultr-wave.site
    First seen
    2026-11-08 10:36 UTC
    Listing
    CERT Polska listed it 2026-08-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 09:34 UTC to 2027-02-06 09:34 UTC
    Logged 2026-11-08 10:32 UTC in DigiCert Sphinx2027h1, entry 400,767,131
    SHA-256 0292e09649cd60db708e7cf6d474d1a1a8d956464161efab7d4d6df348625a12
    Public key SHA-256 c328bee2af2025f8c37174729c8e30c6e65774f04cfe1eebfcba7c5c4e181f54
    Addresses
    104.21.15.231 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.208.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.15.231, 172.67.208.112): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ultr-wave.site
    Registered
    2026-05-15 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  23. zyijws.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    zyijws.asia
    First seen
    2026-11-08 10:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:34 UTC to 2027-02-06 10:31 UTC
    Logged 2026-11-08 10:34 UTC in DigiCert Wyvern2027h1, entry 452,967,661
    SHA-256 f09f6c9af702df09abc7e961ed78dea8292e3278ed0e88f38a0ecb775dca6746
    Public key SHA-256 adc99d37daac50c84b1f56afe69f929376ef128097f208746251b0b4903fb6f3
    Addresses
    104.21.28.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.16 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.28.39, 172.67.144.16): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zyijws.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  24. aktywa24.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    aktywa24.com
    First seen
    2026-11-08 10:31 UTC
    Listing
    CERT Polska listed it 2026-05-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:28 UTC to 2027-02-06 09:27 UTC
    Logged 2026-11-08 10:26 UTC in Google ParcelYard2027h1, entry 675,843,172
    SHA-256 a200f5a9128f569a4140d3bab3a6ccff9be636d52a1f60361a75ce02cc5d041b
    Public key SHA-256 0b274dcbe16cad9d4fe366a91264ef7b506e96192c43459b5519c65c42c40217
    Addresses
    104.21.0.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.0.175, 172.67.128.39): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aktywa24.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  25. blockchaingoldrush.net SG · AS59253 · LEASEWEB SINGAPORE PTE. LTD.
    ListedListed by CERT PolskaMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    blockchaingoldrush.net
    First seen
    2026-11-08 10:31 UTC
    Listing
    CERT Polska listed it 2026-06-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:30 UTC to 2027-02-06 09:30 UTC
    Logged 2026-11-08 10:29 UTC in IPng Networks Halloumi2027h1, entry 410,312,685
    SHA-256 145be4e0416369dbd8c7d626b8194feed53de6e4d8ba4a99ed2434cca5285d8d
    Public key SHA-256 d6825c673c78ce2ba0a37b81c7c8fa783ec486d7a4392f4bf1ceafe0783f04f9
    Addresses
    103.21.221.6 · Singapore · AS59253 LEASEWEB-APAC-SIN-11 - LEASEWEB SINGAPORE PTE. LTD.
    Domain
    blockchaingoldrush.net
    MX
    Receives mail at blockchaingoldrush.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  26. carprimp.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX presentSPF ~allDMARC policy noneRegistered 8 mo ago
    DetailsHide
    Hostname
    carprimp.info
    First seen
    2026-11-08 10:31 UTC
    Listing
    CERT Polska listed it 2026-07-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:28 UTC to 2027-02-06 09:28 UTC
    Logged 2026-11-08 10:26 UTC in IPng Networks Gouda2027h1, entry 353,002,389
    SHA-256 6895282d925d6c6ef7188edee6852f215f193310a6c21fd64b448a516e8000b3
    Public key SHA-256 ed3c58345b45cde684d270d53b1aa19c2ec728f05badf1c3422f89d4d8a973f2
    Addresses
    104.21.26.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.26.157, 172.67.137.35): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    carprimp.info
    Registered
    2026-03-16 · NameSilo, LLC
    MX
    Receives mail at pongal-smtp1.carprimp.info
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  27. caygyj.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    caygyj.asia
    First seen
    2026-11-08 10:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:26 UTC to 2027-02-06 10:25 UTC
    Logged 2026-11-08 10:26 UTC in Geomys Tuscolo2027h1, entry 526,699,603
    SHA-256 7be1f78b7597eeaddaaea1626ac4b01e828766a13c91a08236ba4da1b29f8bd4
    Public key SHA-256 76ea011d7d5f549a19361f35754bafb77bfc6302c761e3abc647213f6475739e
    Addresses
    104.21.31.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.181.226 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.31.254, 172.67.181.226): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    caygyj.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  28. chatwootecho.love-u.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder love-u.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 24 d ago
    DetailsHide
    Hostname
    chatwootecho.love-u.xyz
    First seen
    2026-11-08 10:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-06 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing love-u.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:30 UTC to 2027-02-06 09:30 UTC
    Logged 2026-11-08 10:29 UTC in Let's Encrypt Sycamore2027h1, entry 1,045,054,947
    SHA-256 8c29deade0488f9bb9315bc6f90a5e908069fe018cac12b0056ec40dc9df3887
    Public key SHA-256 6ab537180af3cec7f7374ba33adb743220cd7633d67e4a557f4f70ba3bb7f73e
    Addresses
    104.21.53.215 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.215, 172.67.218.219): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    love-u.xyz
    Registered
    2026-10-15 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  29. chcecho.love-u.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder love-u.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 24 d ago
    DetailsHide
    Hostname
    chcecho.love-u.xyz
    First seen
    2026-11-08 10:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-06 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing love-u.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:31 UTC to 2027-02-06 09:31 UTC
    Logged 2026-11-08 10:30 UTC in Geomys Tuscolo2027h1, entry 526,743,886
    SHA-256 283982ac4fab22839be57164c1241f461d57ed6237e1757e44f28f2d702e0885
    Public key SHA-256 ff5439888290e689d02581bc2319485c938b0ec7acb1ede5a177eba23a802986
    Addresses
    104.21.53.215 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.215, 172.67.218.219): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    love-u.xyz
    Registered
    2026-10-15 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  30. detect.money CN · AS132203 · Tencent Building, Kejizhong…
    ListedTencent CloudListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    detect.money
    First seen
    2026-11-08 10:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 09:31 UTC to 2027-02-06 09:31 UTC
    Logged 2026-11-08 10:30 UTC in DigiCert Wyvern2027h1, entry 452,930,113
    SHA-256 fc93e56f0db8711fddca94bbb23b002b2f8b3caaf89e148357893c39c2598abd
    Public key SHA-256 43d2cb0be1465c5cb47a3e1db42ceb6a0dbc7c3ce945b886175235cc4c11963f
    Addresses
    43.167.9.254 · China · AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue · Tencent Cloud (cloud provider)
    Tencent Cloud
    Tencent Cloud (43.167.9.254): a cloud provider. It rents servers and addresses to its customers.
    Domain
    detect.money
    Registered
    2026-05-14 · Porkbun LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  31. djxhwl.com HK · AS132839 · POWER LINE DATACENTERSaison Card
    ListedListed by JPCERT/CC as imitating SAISON CARDMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    djxhwl.com
    First seen
    2026-11-08 10:31 UTC
    Listing
    JPCERT/CC confirmed it 2026-09-03 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 02:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 09:28 UTC to 2027-02-06 09:28 UTC
    Logged 2026-11-08 10:27 UTC in DigiCert Wyvern2027h1, entry 452,895,588
    SHA-256 abef8da23e5c36c517f20f50d481d8717c226f2c5575869fe003d2d74cba89b0
    Public key SHA-256 21db8a04ce48561e59355a61df038dc268cf05fa4fce4720ac1db4331ac72e3d
    Brand
    Saison Card
    Addresses
    154.216.61.70 · Hong Kong · AS132839 POWERLINE-AS-AP - POWER LINE DATACENTER
    Domain
    djxhwl.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  32. dsasd.sbs
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    dsasd.sbs
    First seen
    2026-11-08 10:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:28 UTC to 2027-02-06 10:27 UTC
    Logged 2026-11-08 10:28 UTC in IPng Networks Halloumi2027h1, entry 410,307,122
    SHA-256 6cdd47ffc58c0629b10e4f38c9b68abe23cda3d7b95716f66884286ae7ab105b
    Public key SHA-256 911cd1b22c41a162c13d15fb82607e480c157753b99cb91861e664c5cfa67ada
    Domain
    dsasd.sbs
    Registered
    2026-09-10 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  33. fraudgpts.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    fraudgpts.com
    First seen
    2026-11-08 10:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:28 UTC to 2027-02-06 09:28 UTC
    Logged 2026-11-08 10:26 UTC in Google PlumbersArms2027h1, entry 676,157,656
    SHA-256 7ff151c13eb73246877a52d42703b8d4d780a9a5e6a15a8055e604a67029644f
    Public key SHA-256 919d9d2d3192aba91be0da9f8d816c82a974bcc49a4d03481952fd6e01ee2ded
    PhishDestroy
    Addresses
    104.21.34.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.53 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.34.195, 172.67.164.53): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fraudgpts.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  34. gammonef.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    gammonef.com
    First seen
    2026-11-08 10:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:30 UTC to 2027-02-06 09:30 UTC
    Logged 2026-11-08 10:29 UTC in Google PlumbersArms2027h1, entry 676,198,387
    SHA-256 355469106ee027e2793269f7b2d0384bcf2d2f68f7fda3537183a2263b6be990
    Public key SHA-256 7a91902111ac06e0b877bc823033df6bca9e052ddfb9b96cbf3b372f46e9f8fd
    PhishDestroy
    Addresses
    104.21.83.192 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.222 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.83.192, 172.67.180.222): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gammonef.com
    MX
    Receives mail at _dc-mx.d031fc697637.gammonef.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  35. gdvujw.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    gdvujw.asia
    First seen
    2026-11-08 10:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:29 UTC to 2027-02-06 10:28 UTC
    Logged 2026-11-08 10:29 UTC in Google PlumbersArms2027h1, entry 676,206,955
    SHA-256 88e8639c0741d03056110a99acceace4540c2cd282956b23ee82c0da7275b3f6
    Public key SHA-256 fb823d6fe41dce7cba12c8ea375ee646a2ebc43bdaa5ec1634f36f72a48677cf
    Addresses
    104.21.24.129 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.24.129, 172.67.218.237): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gdvujw.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  36. goldendeerpet.com HK · AS132839 · POWER LINE DATACENTER
    ListedListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    goldendeerpet.com
    First seen
    2026-11-08 10:31 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:29 UTC to 2027-02-06 09:29 UTC
    Logged 2026-11-08 10:28 UTC in Let's Encrypt Willow2027h1, entry 1,001,527,028
    SHA-256 a3cd33cf6841cd039280debe95881bae68dd1d534b691ac752c0b9257b29fe0d
    Public key SHA-256 48441de6f2859acb46b2427db3c2cff10a14cb386e62d232300bcc76947c0d48
    Addresses
    154.220.44.149 · Hong Kong · AS132839 POWERLINE-AS-AP - POWER LINE DATACENTER
    Domain
    goldendeerpet.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  37. instant-lonoxcap.pro NL · AS62370 · Snel Snel.com B.V.
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    instant-lonoxcap.pro
    First seen
    2026-11-08 10:31 UTC
    Listing
    CERT Polska listed it 2026-07-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:28 UTC to 2027-02-06 09:28 UTC
    Logged 2026-11-08 10:27 UTC in Google ParcelYard2027h1, entry 675,851,601
    SHA-256 298610fc75e2107a4e5d3a010aa9dbd285999f6625c0bcf38b6c4fff030f3a93
    Public key SHA-256 ab3098df15209c97ef7427146154b7cdd9227b544bc95ebd3dbdcba8d8f8a0e5
    Addresses
    185.62.58.179 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    instant-lonoxcap.pro
    Registered
    2026-03-17 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  38. m.goldendeerpet.com HK · AS132839 · POWER LINE DATACENTER
    ListedUnder goldendeerpet.com, listed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    m.goldendeerpet.com
    First seen
    2026-11-08 10:31 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska, listing goldendeerpet.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:29 UTC to 2027-02-06 09:29 UTC
    Logged 2026-11-08 10:28 UTC in Let's Encrypt Willow2027h1, entry 1,001,527,028
    SHA-256 a3cd33cf6841cd039280debe95881bae68dd1d534b691ac752c0b9257b29fe0d
    Public key SHA-256 48441de6f2859acb46b2427db3c2cff10a14cb386e62d232300bcc76947c0d48
    Addresses
    154.220.44.149 · Hong Kong · AS132839 POWERLINE-AS-AP - POWER LINE DATACENTER
    Domain
    goldendeerpet.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  39. mbstr.xyz US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    mbstr.xyz
    First seen
    2026-11-08 10:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-08 09:30 UTC to 2027-02-06 10:27 UTC
    Logged 2026-11-08 10:30 UTC in DigiCert Wyvern2027h1, entry 452,929,868
    SHA-256 ddc584a2cae7e74ed8b10270f582d205fedd5a2faafb98abf3cc53fe92910151
    Public key SHA-256 c103dac2d56c5dbcb210002fb0a53e829853ea3be985cf99c906712598dfe948
    Addresses
    185.158.133.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (185.158.133.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mbstr.xyz
    Registered
    2026-09-10 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  40. thenovelo.app US · AS16509 · Amazon.com, Inc.
    ReportedAmazon Web ServicesReported by PhishDestroyMX presentSPF -allDMARC quarantineRegistered 9 mo ago
    DetailsHide
    Hostname
    thenovelo.app
    First seen
    2026-11-08 10:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:27 UTC to 2027-02-06 09:27 UTC
    Logged 2026-11-08 10:26 UTC in Google ParcelYard2027h1, entry 675,842,866
    SHA-256 6cadeea06d20a309f23c0b995b035611b75502259e467a0f4d50a65a4f6496cf
    Public key SHA-256 188cadb2369261a12a06c014b382ca50efe96b84756513007a7c3d1826ee6c88
    PhishDestroy
    Addresses
    216.150.1.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    thenovelo.app
    Registered
    2026-02-25 · GoDaddy.com, LLC
    MX
    Receives mail at smtp.secureserver.net, mailstore1.secureserver.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  41. v-pl-402918.eu.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    v-pl-402918.eu.cc
    First seen
    2026-11-08 10:31 UTC
    Listing
    CERT Polska listed it 2026-09-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:27 UTC to 2027-02-06 10:25 UTC
    Logged 2026-11-08 10:27 UTC in Geomys Tuscolo2027h1, entry 526,704,498
    SHA-256 0c05834723e25ca6c6a58ea5c74e53583d18db8ffea2beff361344be9a6e814f
    Public key SHA-256 0ca5e939a6019003e482ab0f0f83e91741e2df973e8bef4c65226c545ad3ad60
    Addresses
    104.21.5.192 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.5.192, 172.67.154.173): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  42. wmpd.shop US · AS16509 · Amazon.com, Inc.4 addresses
    ListedAmazon Web ServicesListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    wmpd.shop
    First seen
    2026-11-08 10:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 S22 · precertificate
    Valid 2026-11-08 09:27 UTC to 2027-05-25 10:27 UTC
    Logged 2026-11-08 10:27 UTC in DigiCert Wyvern2027h1, entry 452,904,590
    SHA-256 8df46520af86f6bb1ea550e327bc3d2239b4ac8fc39fd7ef27a3dcacca55589a
    Public key SHA-256 4325b9e2dc3983b6bcb493ccf630e0052ef187bce600dc93b9caf6f0855c7968
    Addresses
    143.204.55.30 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    143.204.55.89 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    143.204.55.91 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    143.204.55.124 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (143.204.55.30, 143.204.55.89, 143.204.55.91, 143.204.55.124): a cloud provider. It rents servers and addresses to its customers.
    Domain
    wmpd.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  43. www.gammonef.com GB · AS200514 · KnownSRV KnownSRV Ltd.
    ReportedUnder gammonef.com, reported by PhishDestroyMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.gammonef.com
    First seen
    2026-11-08 10:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing gammonef.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:30 UTC to 2027-02-06 09:30 UTC
    Logged 2026-11-08 10:29 UTC in Google PlumbersArms2027h1, entry 676,198,387
    SHA-256 355469106ee027e2793269f7b2d0384bcf2d2f68f7fda3537183a2263b6be990
    Public key SHA-256 7a91902111ac06e0b877bc823033df6bca9e052ddfb9b96cbf3b372f46e9f8fd
    PhishDestroy
    Addresses
    89.248.67.182 · United Kingdom · AS200514 KnownSRV KnownSRV Ltd.
    Domain
    gammonef.com
    MX
    Receives mail at _dc-mx.d031fc697637.gammonef.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  44. www.goldendeerpet.com HK · AS132839 · POWER LINE DATACENTER
    ListedUnder goldendeerpet.com, listed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.goldendeerpet.com
    First seen
    2026-11-08 10:31 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska, listing goldendeerpet.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:29 UTC to 2027-02-06 09:29 UTC
    Logged 2026-11-08 10:28 UTC in Let's Encrypt Willow2027h1, entry 1,001,527,028
    SHA-256 a3cd33cf6841cd039280debe95881bae68dd1d534b691ac752c0b9257b29fe0d
    Public key SHA-256 48441de6f2859acb46b2427db3c2cff10a14cb386e62d232300bcc76947c0d48
    Addresses
    154.220.44.149 · Hong Kong · AS132839 POWERLINE-AS-AP - POWER LINE DATACENTER
    Domain
    goldendeerpet.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:33 UTC

    Suggest a correction

  45. www.zefix.is EE · AS49604 · ZONE Zone Media OUZefix
    Phishing hostRegistrar page · Zone.euAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    www.zefix.is
    First seen
    2026-11-08 10:26 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.31.240.240.
    1. Certificate logged in CT
    2. Resolved to 185.31.240.240
    3. Phishing-host list fetched with the address
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:24 UTC to 2027-02-06 09:24 UTC
    Logged 2026-11-08 10:23 UTC in Geomys Tuscolo2027h1, entry 526,662,364
    SHA-256 a3aa92d3b7f5fc75c58286b4b30e6dfb4539ed689ad722d1a80935151f010e26
    Public key SHA-256 be6b29d62ff556611d72367a37c6f4d06b6de4a486b51b94c7d95ca8b3319eba
    Brand
    Zefix
    Addresses
    185.31.240.240 · Estonia · AS49604 ZONE Zone Media OU · Zone.eu (registrar page)
    Registrar page · Zone.eu
    Zone.eu (185.31.240.240): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    zefix.is
    Registered
    2026-01-10
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 05:55 UTC

    Suggest a correction

  46. www.zefix.nl EE · AS49604 · ZONE Zone Media OUZefix
    Phishing hostRegistrar page · Zone.euAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    www.zefix.nl
    First seen
    2026-11-08 10:26 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.31.240.240.
    1. Certificate logged in CT
    2. Resolved to 185.31.240.240
    3. Phishing-host list fetched with the address
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:24 UTC to 2027-02-06 09:24 UTC
    Logged 2026-11-08 10:22 UTC in Google ParcelYard2027h1, entry 675,787,674
    SHA-256 768b480cd9e2c8cf4c5f2211f0c255afe659169614e50d4f931a8e719c6a685e
    Public key SHA-256 7c696c5d473589f5fa90123ae9ea54cce86619a56753e576c10f20cab22de0fc
    Brand
    Zefix
    Addresses
    185.31.240.240 · Estonia · AS49604 ZONE Zone Media OU · Zone.eu (registrar page)
    Registrar page · Zone.eu
    Zone.eu (185.31.240.240): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    zefix.nl
    Registered
    2026-01-10 · Zone Media
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 16:50 UTC

    Suggest a correction

  47. bright-lexicon.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    bright-lexicon.com
    First seen
    2026-11-08 10:26 UTC
    Listing
    CERT Polska listed it 2026-06-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:23 UTC to 2027-02-06 10:22 UTC
    Logged 2026-11-08 10:23 UTC in Let's Encrypt Willow2027h1, entry 1,001,467,061
    SHA-256 3f3f9f529cdc1225c1e347308f204303b39acf562af31da8a3b135feecc167a7
    Public key SHA-256 036f4c156f718709856b3a20892526476ff4566db272a5c1635e74ec6b3f4ae0
    Addresses
    104.21.28.126 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.46 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.28.126, 172.67.146.46): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bright-lexicon.com
    Registered
    2025-11-19 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:28 UTC

    Suggest a correction

  48. crypto.dk DK · AS203953 · Hiper Hiper A/S
    ListedListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    crypto.dk
    First seen
    2026-11-08 10:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:25 UTC to 2027-02-06 09:25 UTC
    Logged 2026-11-08 10:24 UTC in Google ParcelYard2027h1, entry 675,810,767
    SHA-256 19ffc782acce362b371e4a1ef99d0adab79b5f123072b2945b26d52b00a6f2be
    Public key SHA-256 4b9cdc5305d9a594714c4cb39ab28b02d425270b0d44b3b2476900f904fc35db
    Addresses
    213.32.245.165 · Denmark · AS203953 Hiper Hiper A/S
    Domain
    crypto.dk
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:28 UTC

    Suggest a correction

  49. ctkvhs.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ctkvhs.asia
    First seen
    2026-11-08 10:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 05:20 UTC to 2026-12-09 06:18 UTC
    Logged 2026-11-08 10:24 UTC in DigiCert Wyvern2026h2, entry 2,211,966,602
    SHA-256 3d0a5325681303b6f25a8865b7ad984cf6ba51b3d8dc0e24e440221fd5389796
    Public key SHA-256 4ba5c586a683136aa3bbb9d96736bb7221ab1d8b51cb004b476c4e1b33d2c2e6
    Addresses
    104.21.73.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.73.63, 172.67.188.229): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ctkvhs.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  50. dealpicks.de US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    dealpicks.de
    First seen
    2026-11-08 10:26 UTC
    Listing
    CERT Polska listed it 2026-09-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 09:23 UTC to 2027-02-06 09:23 UTC
    Logged 2026-11-08 10:22 UTC in DigiCert Wyvern2027h1, entry 452,844,856
    SHA-256 496a39cb834fd5f322f9ff1db042557df72f6bf25a15c7dd4100bc8d807f4c96
    Public key SHA-256 4f0650b889735b5b0df6fe04cf42450433531bc8395a1254863f95dc221fb4ad
    Addresses
    104.18.74.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.74.116): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    dealpicks.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:28 UTC

    Suggest a correction

  51. distribution-hyperbeat.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    distribution-hyperbeat.org
    First seen
    2026-11-08 10:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:26 UTC to 2027-02-06 09:26 UTC
    Logged 2026-11-08 10:24 UTC in Google ParcelYard2027h1, entry 675,816,992
    SHA-256 69fc5c11adb0b76f4e8d30f4a8cf9d43b59fc0456702902b35748536dca38337
    Public key SHA-256 401f56291ac795da8806e6d25c815d75895fa9c261b51c58c59bb6cfa1c87acf
    Addresses
    104.21.95.24 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.169.73 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.95.24, 172.67.169.73): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    distribution-hyperbeat.org
    Registered
    2026-05-15 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  52. elitesholdingsng.com AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicReported by PhishDestroyMX presentSPF ~allRegistered 3 y ago
    DetailsHide
    Hostname
    elitesholdingsng.com
    First seen
    2026-11-08 10:26 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-08 · still listed at the last successful feed check 2026-11-08 05:57 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-07 (13 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:23 UTC to 2027-02-06 09:23 UTC
    Logged 2026-11-08 10:22 UTC in Google PlumbersArms2027h1, entry 676,091,263
    SHA-256 6287d3ef0b79246bc9044c6eb1816de434e591716f5db19465be0c46dfacbac9
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    elitesholdingsng.com
    Registered
    2023-11-08 · NameSilo, LLC
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with ~all: other senders soft-fail
    Checked
    2026-11-07 11:10 UTC

    Suggest a correction

  53. h9z6f0v3zsxip5dg.fyxgbjsw.avspjcgn.feloxngb.csuwtnrg.ptgsxzo0wi87qbv2.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    h9z6f0v3zsxip5dg.fyxgbjsw.avspjcgn.feloxngb.csuwtnrg.ptgsxzo0wi87qbv2.gatewaylearning.ezgateway.net
    First seen
    2026-11-08 10:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 10:05 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 09:26 UTC to 2027-02-06 09:26 UTC
    Logged 2026-11-08 10:25 UTC in Google PlumbersArms2027h1, entry 676,131,761
    SHA-256 087f88fdeadaed4b967bc0016d1933a0e4a8d386ee9dbf4e3e5cd1812598403a
    Public key SHA-256 6749b979c7f9332984a0f597fbec956870f5f0b263fc996b17a8c58307983072
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  54. macrtqkz.txyukdin.tlchyjoq.ijdyvoge.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    macrtqkz.txyukdin.tlchyjoq.ijdyvoge.gatewaylearning.ezgateway.net
    First seen
    2026-11-08 10:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 10:05 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 09:26 UTC to 2027-02-06 09:26 UTC
    Logged 2026-11-08 10:25 UTC in Google PlumbersArms2027h1, entry 676,131,602
    SHA-256 821e3aa00e2b5cefc6d3c609f4dc1e50a0f399273b68f6428ef9becd546627e8
    Public key SHA-256 250db6f2baf15f178ee2cb6fa6b74f01a735949d5bc3650f66fe4dae66f6d068
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  55. nanqq.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    nanqq.com
    First seen
    2026-11-08 10:26 UTC
    Listing
    CERT Polska listed it 2026-07-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 09:25 UTC to 2027-02-06 09:25 UTC
    Logged 2026-11-08 10:24 UTC in IPng Networks Halloumi2027h1, entry 410,257,365
    SHA-256 7df7b76bdf5e2cee7d45121d7277b565792916fe686a4d99dfd50a7fb8478926
    Public key SHA-256 e0262b79d0e4843b4c2b1e9dcaed9d6c39d020226cffc261f171f0ef480f43fa
    Addresses
    104.21.43.151 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.165 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.43.151, 172.67.180.165): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nanqq.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:28 UTC

    Suggest a correction

  56. owlstoryweapon.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    owlstoryweapon.com
    First seen
    2026-11-08 10:26 UTC
    Listing
    USOM listed it 2026-05-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 10:05 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 09:25 UTC to 2027-02-06 09:25 UTC
    Logged 2026-11-08 10:23 UTC in Google PlumbersArms2027h1, entry 676,111,690
    SHA-256 9b2f746f8712367af4478eef303a93cae957f47f4472c386bb22a0d556ce37fe
    Public key SHA-256 330e2aebc16d05e4eb8f50b7a779de081aff9609bf39b2221901dace320ad1c1
    Addresses
    104.21.40.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.203 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.40.246, 172.67.188.203): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    owlstoryweapon.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:28 UTC

    Suggest a correction

  57. panels-firelight.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    panels-firelight.xyz
    First seen
    2026-11-08 10:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:24 UTC to 2027-02-06 09:24 UTC
    Logged 2026-11-08 10:23 UTC in Google PlumbersArms2027h1, entry 676,103,633
    SHA-256 06dc3432bf7319467bf41ce4d6fc8581aee872708f81b206e0e8be2c9e7e8b83
    Public key SHA-256 5a8603683f748be043d734492456954a2a5b2d04171332ca3b4e61f47a26bdd6
    Addresses
    104.21.26.169 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.26.169, 172.67.137.101): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    panels-firelight.xyz
    Registered
    2026-05-15 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  58. soltoken.network US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    soltoken.network
    First seen
    2026-11-08 10:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:22 UTC to 2027-02-06 10:21 UTC
    Logged 2026-11-08 10:22 UTC in Google PlumbersArms2027h1, entry 676,091,939
    SHA-256 5bd740cacd195fe3e6ae5b98dfb3d008310b5f2fb4cfbdb2c6fd18cb4407402e
    Public key SHA-256 8bbbf3e76ddbf4acc11774635867d4f897853a8a6764c7b035f5bc4f38aaec1c
    Addresses
    104.21.82.222 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.82.222, 172.67.164.72): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    soltoken.network
    Registered
    2026-07-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  59. v-usluga-392018.eu.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    v-usluga-392018.eu.cc
    First seen
    2026-11-08 10:26 UTC
    Listing
    CERT Polska listed it 2026-09-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 09:26 UTC to 2027-02-06 09:26 UTC
    Logged 2026-11-08 10:24 UTC in Let's Encrypt Willow2027h1, entry 1,001,478,938
    SHA-256 b0af5d2352ecce518c77cf8fc2e5f626d38d06f0f8282440b0f4f6aaa0efd5e3
    Public key SHA-256 a58ec8ee092420fab9495b6552dea44f775f1d63940833b99dc1aab0734e2588
    Addresses
    104.21.94.191 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.139.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.94.191, 172.67.139.143): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  60. wikyzp.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    wikyzp.asia
    First seen
    2026-11-08 10:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:24 UTC to 2027-02-06 10:23 UTC
    Logged 2026-11-08 10:24 UTC in IPng Networks Gouda2027h1, entry 352,980,567
    SHA-256 4cf34bb787b74f1ff838400a2976b117a6bad503a6e9308b23188b89bb47433b
    Public key SHA-256 1ab95dc0bb801d0a05894b4ca4c8e831a95e439c0f24f97ee320eb4a5725cb77
    Addresses
    104.21.81.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.150 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.81.7, 172.67.136.150): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wikyzp.asia
    Registered
    2026-07-13 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  61. yhdlcber.zyxbnipg.epckarsg.rzfdoakh.onvgwjec.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    yhdlcber.zyxbnipg.epckarsg.rzfdoakh.onvgwjec.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-08 10:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 10:05 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:26 UTC to 2027-02-06 09:26 UTC
    Logged 2026-11-08 10:25 UTC in DigiCert Sphinx2027h1, entry 400,693,418
    SHA-256 643e4fe5a9bb57f7ba92d6cf4b4b2c920749dd7bd501534dbdd56af366961976
    Public key SHA-256 47fd858389a0100272288e96ef2c460c6b9829fa3283e69d37e2f3335d481ffe
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  62. yvqfmehi.ghwojfzp.pyqsxnlk.adoqexmhg.zecjmvnx.xegjcpbw.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    yvqfmehi.ghwojfzp.pyqsxnlk.adoqexmhg.zecjmvnx.xegjcpbw.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-08 10:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 10:05 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:26 UTC to 2027-02-06 09:26 UTC
    Logged 2026-11-08 10:25 UTC in IPng Networks Gouda2027h1, entry 352,985,160
    SHA-256 bd8ba982aa347b995ca298b5777a2717faef0dd75c1af9f20495a2adc9c50765
    Public key SHA-256 46f247e9ee82aa543169363c7e0510bead554665799cda8a9e0679d2dc4070c6
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  63. a.cupkit.app US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder cupkit.app, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    a.cupkit.app
    First seen
    2026-11-08 10:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing cupkit.app and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4
    Valid 2026-09-10 05:33 UTC to 2026-12-09 05:42 UTC
    Logged 2026-11-08 10:19 UTC in DigiCert Wyvern2026h2, entry 2,211,958,605
    SHA-256 4162a934449a769774021396842c93d10a0b5c658c02a4dcdd4bc056aac5bc34
    Public key SHA-256 2854a7d882726516b368b5b90f5e5328045242dac638f7765cf878b1b054a08b
    PhishDestroy
    Addresses
    104.20.29.105 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.171.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.20.29.105, 172.66.171.25): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cupkit.app
    Registered
    2018-06-07 · Namecheap Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:11 UTC

    Suggest a correction

  64. aave.com.aaveoriginal.co.com US · AS13335 · Cloudflare, Inc.4 addressesAave
    ListedCloudflareUnder aaveoriginal.co.com, listed by MetaMask
    DetailsHide
    Hostname
    aave.com.aaveoriginal.co.com
    First seen
    2026-11-08 10:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing aaveoriginal.co.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 10:07 UTC to 2027-02-06 10:15 UTC
    Logged 2026-11-08 10:17 UTC in DigiCert Wyvern2027h1, entry 452,792,471
    SHA-256 1bc714069b5750476a3a9fd4a6ba0f5bc4a02b762181da87d3002ef192d2bc1d
    Public key SHA-256 7fe72d651ff8a30aa761332eb5ff730bec542d8543a850086c46bfc4cef317e7
    Brand
    Aave
    Addresses
    104.21.2.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:8182
    2606:4700:3035::6815:2af
    Cloudflare
    Cloudflare (104.21.2.175, 172.67.129.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  65. cleanr.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    cleanr.work
    First seen
    2026-11-08 10:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:18 UTC to 2027-02-06 10:17 UTC
    Logged 2026-11-08 10:18 UTC in Geomys Tuscolo2027h1, entry 526,613,165
    SHA-256 d020b5cace2ff9afca612651349562bd818150fc4c30a20f77d30290c4af2367
    Public key SHA-256 42964b420fc5e46a47bdf9e7976e97d436fa6c0fad11098ccd1273bd21f31167
    Addresses
    104.21.90.146 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.157.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.90.146, 172.67.157.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cleanr.work
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:23 UTC

    Suggest a correction

  66. cpekdogr.sbadpnzo.jqaygvpe.wzvtlhbj.ijdyvoge.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    cpekdogr.sbadpnzo.jqaygvpe.wzvtlhbj.ijdyvoge.gatewaylearning.ezgateway.net
    First seen
    2026-11-08 10:21 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 10:05 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 09:19 UTC to 2027-02-06 09:19 UTC
    Logged 2026-11-08 10:17 UTC in Google ParcelYard2027h1, entry 675,718,067
    SHA-256 11c97783ed70eef2a6ea26a344cbc65262e1d178247866eaf4b982ab986e12d8
    Public key SHA-256 ded11393c680f85baa6723a5817ded7e750a45a2c42f6b6c134a131f1c8e57f9
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 17:16 UTC

    Suggest a correction

  67. footshop-pl.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    footshop-pl.shop
    First seen
    2026-11-08 10:21 UTC
    Listing
    CERT Polska listed it 2026-06-02 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:21 UTC to 2027-02-06 09:21 UTC
    Logged 2026-11-08 10:20 UTC in Google PlumbersArms2027h1, entry 676,059,145
    SHA-256 b0ec8b6bd3f441f4868f96816877c9ad41fa7a20c29744482b6a8f2cfd8fe14a
    Public key SHA-256 d21fc810ebad8b6a76dfaf46e2eb086743f0826431b50fb373adc6ac6d45a000
    Addresses
    104.21.31.151 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.177.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.31.151, 172.67.177.206): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    footshop-pl.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:23 UTC

    Suggest a correction

  68. m.heardgagas.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ListedHostingerListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    m.heardgagas.com
    First seen
    2026-11-08 10:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:17 UTC to 2027-02-06 09:17 UTC
    Logged 2026-11-08 10:16 UTC in Google ParcelYard2027h1, entry 675,693,300
    SHA-256 7e080b17c73bc0ba1594fdba1f5553c67278065d77393018d81e4b33e075fa27
    Public key SHA-256 46cd48202306dc598fe36a68e4e223a110f40803dcce9a2014fea481de400b52
    Addresses
    72.62.71.47 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (72.62.71.47): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    heardgagas.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:23 UTC

    Suggest a correction

  69. testminesgamb23234.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    testminesgamb23234.com
    First seen
    2026-11-08 10:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:17 UTC to 2027-02-06 10:14 UTC
    Logged 2026-11-08 10:17 UTC in Google ParcelYard2027h1, entry 675,706,377
    SHA-256 090366cebd4aa10acdd5e038cf3fa4c1058c301c3bdd489a0f0d007b80615757
    Public key SHA-256 e9dc77128a19e1ea1960f3deadcada0951739db9da2d47ef947579c6dd356f66
    Addresses
    104.21.57.103 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.162.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.57.103, 172.67.162.242): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    testminesgamb23234.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:23 UTC

    Suggest a correction

  70. uploads.tor.taxi RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder tor.taxi, reported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 5 y ago
    DetailsHide
    Hostname
    uploads.tor.taxi
    First seen
    2026-11-08 10:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing tor.taxi and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 09:18 UTC to 2027-02-06 09:18 UTC
    Logged 2026-11-08 10:17 UTC in Google ParcelYard2027h1, entry 675,712,355
    SHA-256 45aab207b20f2db06cab059eab0467c3be9f0e7027737d1fedbd2a3612680a68
    Public key SHA-256 fbb83cf5ee0a4dac1945f585e5fcae79bbc7915287a27340eb4930fe2d1e3eb7
    PhishDestroy
    Addresses
    185.129.100.227 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.129.100.227): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tor.taxi
    Registered
    2021-07-02 · Tucows Domains Inc.
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-07 20:52 UTC

    Suggest a correction

  71. verification-swiss.cfd US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    verification-swiss.cfd
    First seen
    2026-11-08 10:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 10:09 UTC to 2027-02-06 10:17 UTC
    Logged 2026-11-08 10:19 UTC in DigiCert Wyvern2027h1, entry 452,819,015
    SHA-256 7ce8ccc8056b9a85f439a2811dc10d34b871ee52ad36fcb583eabd7335621841
    Public key SHA-256 c2b45249c7c6805726e4e6bc1a21c323736214e2c841e2c97282e11029074784
    Addresses
    104.21.76.45 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.76.45, 172.67.187.173): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    verification-swiss.cfd
    Registered
    2026-10-22 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  72. www.disperstockspip.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder disperstockspip.net, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    www.disperstockspip.net
    First seen
    2026-11-08 10:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing disperstockspip.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL RSA DV SSL CA 2 · precertificate
    Valid 2026-11-08 00:00 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-08 10:20 UTC in DigiCert Wyvern2027h1, entry 452,820,633
    SHA-256 758449d929de7b50516f74e5ef98bd4a0c08052127ef42d81649b297444482b4
    Public key SHA-256 6c4895aa231f1fca751ded287de67122e5f1589ee24478db0994b9739f3cb722
    PhishDestroy
    Addresses
    104.21.27.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.169.8 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.27.68, 172.67.169.8): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    disperstockspip.net
    Registered
    2026-01-05 · Tucows Domains Inc.
    MX
    Receives mail at _dc-mx.9308c1313120.disperstockspip.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:53 UTC

    Suggest a correction

  73. zcat.hub-x.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder hub-x.live, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    zcat.hub-x.live
    First seen
    2026-11-08 10:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing hub-x.live and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:21 UTC to 2027-02-06 09:21 UTC
    Logged 2026-11-08 10:19 UTC in Google ParcelYard2027h1, entry 675,741,122
    SHA-256 6d447d1d586ae9bf4bf348a6780b79ba1e4629833d7d225bcb2fc8a3c6faaa6f
    Public key SHA-256 cf345c87fde78cd536ac816d228f27d9beaae5791291e2e55fc64f8c2da0f0e7
    Addresses
    104.21.50.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.185 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.50.178, 172.67.164.185): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hub-x.live
    Registered
    2026-09-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 13:25 UTC

    Suggest a correction

  74. aave.fr.aave-fr.co.com US · AS13335 · Cloudflare, Inc.4 addressesAave
    ListedCloudflareUnder aave-fr.co.com, listed by MetaMask
    DetailsHide
    Hostname
    aave.fr.aave-fr.co.com
    First seen
    2026-11-08 10:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing aave-fr.co.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:14 UTC to 2027-02-06 10:14 UTC
    Logged 2026-11-08 10:14 UTC in Google PlumbersArms2027h1, entry 675,984,022
    SHA-256 ab49cb18955db0f2edcd1328f1c53059bef61ac99008d8db553a2a577a7a7357
    Public key SHA-256 4126e14aa76474e0145af7e963e05d81e09a71cee3bd48ed8b11fc35ce036323
    Brand
    Aave
    Addresses
    104.21.2.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:8182
    2606:4700:3035::6815:2af
    Cloudflare
    Cloudflare (104.21.2.175, 172.67.129.130): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  75. claim-datagram.network
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    claim-datagram.network
    First seen
    2026-11-08 10:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:13 UTC to 2027-02-06 10:10 UTC
    Logged 2026-11-08 10:13 UTC in DigiCert Wyvern2027h1, entry 452,744,558
    SHA-256 53426fb725a7a92cfa8842c18c089c84f35cfe6f6cada9f05a7a5770f93aecc9
    Public key SHA-256 5261e64a411234442b267a7363095bd2e0156624c2bb8faffefa56d1568093a1
    Domain
    claim-datagram.network
    Registered
    2025-11-18 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  76. cryptogenisussoftware.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    cryptogenisussoftware.pro
    First seen
    2026-11-08 10:16 UTC
    Listing
    CERT Polska listed it 2026-09-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 08:19 UTC to 2026-12-09 09:19 UTC
    Logged 2026-11-08 10:13 UTC in Let's Encrypt Willow2026h2, entry 1,029,440,438
    SHA-256 0e00d356fd38a935488deb7cf0e8ec639c1a07714ae036d83c01c4a8eb93d660
    Public key SHA-256 9326fbfafe03fe5f50a78893810419122d7c25366ed7317dd9a80d02de45b832
    Addresses
    104.21.65.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.100 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.77, 172.67.189.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cryptogenisussoftware.pro
    Registered
    2026-09-10 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  77. download.btcpolicyinstitute.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder btcpolicyinstitute.org, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    download.btcpolicyinstitute.org
    First seen
    2026-11-08 10:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing btcpolicyinstitute.org and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:14 UTC to 2027-02-06 10:14 UTC
    Logged 2026-11-08 10:14 UTC in Google PlumbersArms2027h1, entry 675,981,201
    SHA-256 1d7f79d21e2ee7e623ac9324f73569ba9c48264edbf473028aea3f354f78913c
    Public key SHA-256 adc1cf6ef9eec504054c1d5eae2219479f5e010d28daf0b0975e2b26d9901c69
    Addresses
    104.21.54.24 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.222.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.54.24, 172.67.222.224): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    btcpolicyinstitute.org
    Registered
    2026-09-10 · Atak Domain Bilgi Teknolojileri A._.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 06:34 UTC

    Suggest a correction

  78. foodie-ingredients.com.in-house-sf.com FR · AS16276 · OVH OVH SAS
    ReportedOVHUnder in-house-sf.com, reported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    foodie-ingredients.com.in-house-sf.com
    First seen
    2026-11-08 10:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing in-house-sf.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:16 UTC to 2027-02-06 09:16 UTC
    Logged 2026-11-08 10:15 UTC in Google ParcelYard2027h1, entry 675,680,426
    SHA-256 ad7b4b0039444b58370d672a3b88f61de6d5bc26aaf656de13e9f306e6cfb690
    Public key SHA-256 46fbfa8e6b7b8d7f77bdf412e8ae2446bf4ccedbf8ad07573a5a050fd9b4e198
    PhishDestroy
    Addresses
    15.204.110.165 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.110.165): a cloud provider. It rents servers and addresses to its customers.
    Domain
    in-house-sf.com
    MX
    Receives mail at in-house-sf.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:18 UTC

    Suggest a correction

  79. lingzheng02.site US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    lingzheng02.site
    First seen
    2026-11-08 10:16 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:16 UTC to 2027-02-06 09:16 UTC
    Logged 2026-11-08 10:14 UTC in Google PlumbersArms2027h1, entry 675,986,032
    SHA-256 28a5743de7f1b17774779ed3efe176d9551f16c9698ea6a7fe4ec9e36f386bef
    Public key SHA-256 93ce3a661ac599b9d08ba69769a9d80f087d441e8e282181b109228e338bf841
    Addresses
    104.21.16.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.69 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.225, 172.67.216.69): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lingzheng02.site
    Registered
    2026-05-12 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  80. owa.polar-tensor.com DE · AS51167 · CONTABO Contabo GmbH4 addresses
    ListedContabo +1Under polar-tensor.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    owa.polar-tensor.com
    First seen
    2026-11-08 10:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask, listing polar-tensor.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 09:16 UTC to 2027-02-06 09:16 UTC
    Logged 2026-11-08 10:15 UTC in DigiCert Wyvern2027h1, entry 452,767,676
    SHA-256 cb1de98eae2a5e437be183cb454e60d792ee4d60dbe40ad2b3bf434177a92d9e
    Public key SHA-256 4ca2f49a2f823588970896c7033b00c4cfc80584ae4fc2d28e464592efce12e4
    Addresses
    5.189.134.86 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    57.128.187.75 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    57.129.49.179 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    193.242.211.59 · Germany · AS58329 SERVINGA-NL servinga GmbH
    Contabo +1
    Contabo (5.189.134.86): a cloud provider. It rents servers and addresses to its customers. OVH (57.128.187.75, 57.129.49.179): a cloud provider. It rents servers and addresses to its customers.
    Domain
    polar-tensor.com
    Registered
    2025-04-28 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 19:34 UTC

    Suggest a correction

  81. porcelana24official.com US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    porcelana24official.com
    First seen
    2026-11-08 10:16 UTC
    Listing
    CERT Polska listed it 2026-06-01 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:15 UTC to 2027-02-06 10:14 UTC
    Logged 2026-11-08 10:15 UTC in Let's Encrypt Sycamore2027h1, entry 1,044,675,147
    SHA-256 c50646f7dc37ed37d6682fd44e95ea91bbe96da2f950c5c7fa88e6f0d5023e17
    Public key SHA-256 f75bba049146e5958fc4f775ed40b6ba3ba059061342d87c8731bfa5cb188e2b
    Addresses
    104.18.26.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.26.78): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    porcelana24official.com
    Registered
    2026-05-14 · West263 International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 19:05 UTC

    Suggest a correction

  82. preprod.cookie-stock.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder cookie-stock.com, reported by PhishDestroyMX absentSPF missingDMARC policy noneRegistered 15 mo ago
    DetailsHide
    Hostname
    preprod.cookie-stock.com
    First seen
    2026-11-08 10:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing cookie-stock.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:15 UTC to 2027-02-06 09:15 UTC
    Logged 2026-11-08 10:13 UTC in Google PlumbersArms2027h1, entry 675,970,024
    SHA-256 8534e9202157a11fc1a833837171df300147416f6e57c91a895a964c6149aee6
    Public key SHA-256 85b35b10640c1fddaaec69d778bb458ce06d690bacfd7977853cc0f863baf282
    PhishDestroy
    Addresses
    185.178.208.177 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.177): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cookie-stock.com
    Registered
    2025-08-26 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-07 23:42 UTC

    Suggest a correction

  83. raffrintar.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    raffrintar.store
    First seen
    2026-11-08 10:16 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 09:32 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:10 UTC to 2027-02-06 10:09 UTC
    Logged 2026-11-08 10:10 UTC in Let's Encrypt Willow2027h1, entry 1,001,277,382
    SHA-256 6cac46e1488a863ec6bc7e9d22279821399d41a7e8631bd1fc048d4bc10477e9
    Public key SHA-256 bc93b68ae03d41aef79024a7d1b67251016557c9f0b216e837e700f0f63117c8
    Addresses
    104.21.87.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.59 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.87.206, 172.67.146.59): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    raffrintar.store
    Registered
    2026-09-10 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:06 UTC

    Suggest a correction

  84. rain-bet.me.uk US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    rain-bet.me.uk
    First seen
    2026-11-08 10:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-05 · still listed at the last successful feed check 2026-11-08 05:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 09:13 UTC to 2027-02-06 10:12 UTC
    Logged 2026-11-08 10:13 UTC in DigiCert Wyvern2027h1, entry 452,746,338
    SHA-256 21d5eccdc176d52285ea402d84e01b8398505c3ee290257974b7b9971bc61f8f
    Public key SHA-256 e6876adfdab37bfe7e763fc1386c4142d01db4478def651e9162ae12873993fa
    Addresses
    104.21.56.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.33 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.56.7, 172.67.175.33): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rain-bet.me.uk
    Registered
    2025-11-19 · Hosting Concepts B.V.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  85. www-cmc.app US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    www-cmc.app
    First seen
    2026-11-08 10:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-08 09:11 UTC to 2027-02-06 10:11 UTC
    Logged 2026-11-08 10:14 UTC in DigiCert Wyvern2027h1, entry 452,760,729
    SHA-256 233b40dc72988c1838112a729e146a0c887c8fe141a980c9897ee20630dc1e7e
    Public key SHA-256 94277120c29070d499cc82291328122c5cfabdbaba808cbd1b0b6b0ada6552b2
    PhishDestroy
    Addresses
    104.21.10.65 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.65, 172.67.144.184): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    www-cmc.app
    Registered
    2025-11-18 · CloudFlare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:05 UTC

    Suggest a correction

  86. www.foodie-ingredients.com.in-house-sf.com FR · AS16276 · OVH OVH SAS
    ReportedOVHUnder in-house-sf.com, reported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.foodie-ingredients.com.in-house-sf.com
    First seen
    2026-11-08 10:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 05:57 UTC
    Reported
    PhishDestroy, listing in-house-sf.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 09:16 UTC to 2027-02-06 09:16 UTC
    Logged 2026-11-08 10:15 UTC in Google ParcelYard2027h1, entry 675,680,426
    SHA-256 ad7b4b0039444b58370d672a3b88f61de6d5bc26aaf656de13e9f306e6cfb690
    Public key SHA-256 46fbfa8e6b7b8d7f77bdf412e8ae2446bf4ccedbf8ad07573a5a050fd9b4e198
    PhishDestroy
    Addresses
    15.204.110.165 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.110.165): a cloud provider. It rents servers and addresses to its customers.
    Domain
    in-house-sf.com
    MX
    Receives mail at in-house-sf.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:18 UTC

    Suggest a correction

  87. nrs.com.ng.springtimeflourish.com.ng BD · AS153568 · NEW DHAKA HARDWARE
    Same certificateSame certificate as www.utility.nrs.com.ng, reported by PhishDestroy (under utility.nrs.com.ng)MX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    nrs.com.ng.springtimeflourish.com.ng
    First seen
    2026-11-08 10:15 UTC
    Same certificate
    Same certificate as www.utility.nrs.com.ng: reported by PhishDestroy (under utility.nrs.com.ng)
    Listed: resolved to 163.61.188.7 on Spamhaus DROP
    2 of 2 domains on this certificate have their own listing evidence
    Certificate 3b3283f435e35b9a… · 2 domains on it · first seen 2026-11-08 10:15 UTC
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:09 UTC to 2027-02-06 09:09 UTC
    Logged 2026-11-08 10:08 UTC in DigiCert Wyvern2027h1, entry 452,698,412
    SHA-256 3b3283f435e35b9a60574b88a31fbc3ac11072b4a0f0f7a595c49d1c18dcb353
    Public key SHA-256 2553967f123101793bdd1af920843d7e4e059ffad17f6b42f80ab64d699ee4eb
    Addresses
    163.61.188.7 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    springtimeflourish.com.ng
    Registered
    2026-07-07 · Leads Globe
    MX
    Receives mail at springtimeflourish.com.ng
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server springtimeflourish.com.ng at 163.61.188.7 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.7 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-07 14:32 UTC

    Suggest a correction

  88. www.ach-linkedin.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…LinkedIn
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.ach-linkedin.com
    First seen
    2026-11-08 10:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:08 UTC to 2027-02-06 09:08 UTC
    Logged 2026-11-08 10:06 UTC in Google PlumbersArms2027h1, entry 675,871,712
    SHA-256 2ced9253fda3a85d710ed7bc72dc677c9edf3d1ab16b621bab07d0f19dab9e21
    Public key SHA-256 c6bc52e076addfd6a3e3aba1d416761e518f2863cac45354352664dcd455232a
    Brand
    LinkedIn
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    ach-linkedin.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:12 UTC

    Suggest a correction

  89. www.allianz-global-investors.cn HK · AS138415 · Yancy Limited10 addressesAllianz
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.allianz-global-investors.cn
    First seen
    2026-11-08 10:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 156.234.67.9.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 156.234.67.9
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 156.247.54.171.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 156.247.54.171
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:11 UTC to 2027-02-06 09:11 UTC
    Logged 2026-11-08 10:10 UTC in DigiCert Sphinx2027h1, entry 400,541,476
    SHA-256 24fe37050e57c463ca0a01e5640763fac9860aa22081144c682111a4633818f7
    Public key SHA-256 b95f154852f98cccf8ce2a2d74099e6e9bc12373bbd0a81e169e154653a0d5dd
    Brand
    Allianz
    Addresses
    156.234.67.9 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.10 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.11 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.152 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.153 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.154 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.155 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.171 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.172 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.173 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    allianz-global-investors.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:12 UTC

    Suggest a correction

  90. www.allianz-investors.cn HK · AS138415 · Yancy Limited10 addressesAllianz
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.allianz-investors.cn
    First seen
    2026-11-08 10:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 156.234.67.9.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 156.234.67.9
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 156.247.54.171.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 156.247.54.171
    Certificate
    Issued by YR1
    Valid 2026-11-08 09:11 UTC to 2027-02-06 09:11 UTC
    Logged 2026-11-08 10:10 UTC in Google ParcelYard2027h1, entry 675,608,711
    SHA-256 7172b5091c2119dde8a5cf5c381b7d13dcaeea0739e15187cabd939a506cb130
    Public key SHA-256 ecd541378316083a894f51719e4f914bd6f22dc6d251364d936ee2fd96aa73ca
    Brand
    Allianz
    Addresses
    156.234.67.9 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.10 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.11 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.152 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.153 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.154 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.155 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.171 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.172 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.173 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    allianz-investors.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:12 UTC

    Suggest a correction

  91. www.contactus-linkedin.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…LinkedIn
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.contactus-linkedin.com
    First seen
    2026-11-08 10:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:08 UTC to 2027-02-06 09:08 UTC
    Logged 2026-11-08 10:07 UTC in Google PlumbersArms2027h1, entry 675,873,396
    SHA-256 2fcb5bb9148789354dbb70ae4c0d166e1c21456e0e6a20f8dee3c5633709cec4
    Public key SHA-256 3ffd63e936459c15ec70995743c1d767ecf144e2f3c2c0f0c95dd960037d889e
    Brand
    LinkedIn
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    contactus-linkedin.com
    MX
    Receives mail at mx1.titan.email, mx2.titan.email
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:18 UTC

    Suggest a correction

  92. pay.pochta.sbermarket.backend-cdek.rhxyvcq9vvts2ld9.r.mail.leankoala.com FR · AS200484 · SENDINBLUE-ASN Sendinblue S…Russian Post
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 11 y ago
    DetailsHide
    Hostname
    pay.pochta.sbermarket.backend-cdek.rhxyvcq9vvts2ld9.r.mail.leankoala.com
    First seen
    2026-11-08 10:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.246.243.65.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.246.243.65
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:07 UTC to 2027-02-06 09:07 UTC
    Logged 2026-11-08 10:05 UTC in Let's Encrypt Sycamore2027h1, entry 1,044,471,604
    SHA-256 21de0469bbc19dd184112c26459f21d6176dd3651181524f0d51f3e7dbe70c92
    Public key SHA-256 63c5fe7bc14b2a97fd1ea8c44ab61b25b7ff26bb92bae85939d41341fc0e5459
    Brand
    Russian Post
    Addresses
    172.246.243.65 · France · AS200484 SENDINBLUE-ASN Sendinblue SAS
    Domain
    leankoala.com
    Registered
    2016-03-15 · united-domains GmbH
    MX
    Receives mail at mx00.udag.de, mx01.udag.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-07 22:30 UTC

    Suggest a correction

  93. m.allianz-global-investors.cn HK · AS138415 · Yancy Limited10 addressesAllianz
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    m.allianz-global-investors.cn
    First seen
    2026-11-08 10:13 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 156.234.67.9.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 156.234.67.9
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 156.247.54.171.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 156.247.54.171
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:11 UTC to 2027-02-06 09:11 UTC
    Logged 2026-11-08 10:10 UTC in DigiCert Sphinx2027h1, entry 400,541,476
    SHA-256 24fe37050e57c463ca0a01e5640763fac9860aa22081144c682111a4633818f7
    Public key SHA-256 b95f154852f98cccf8ce2a2d74099e6e9bc12373bbd0a81e169e154653a0d5dd
    Brand
    Allianz
    Addresses
    156.234.67.9 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.10 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.11 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.152 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.153 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.154 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.155 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.171 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.172 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.173 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    allianz-global-investors.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:12 UTC

    Suggest a correction

  94. m.allianz-investors.cn HK · AS138415 · Yancy Limited10 addressesAllianz
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    m.allianz-investors.cn
    First seen
    2026-11-08 10:13 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 156.234.67.9.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 156.234.67.9
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 156.247.54.171.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 156.247.54.171
    Certificate
    Issued by YR1
    Valid 2026-11-08 09:11 UTC to 2027-02-06 09:11 UTC
    Logged 2026-11-08 10:10 UTC in Google ParcelYard2027h1, entry 675,608,711
    SHA-256 7172b5091c2119dde8a5cf5c381b7d13dcaeea0739e15187cabd939a506cb130
    Public key SHA-256 ecd541378316083a894f51719e4f914bd6f22dc6d251364d936ee2fd96aa73ca
    Brand
    Allianz
    Addresses
    156.234.67.9 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.10 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.11 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.152 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.153 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.154 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.155 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.171 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.172 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.173 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    allianz-investors.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:12 UTC

    Suggest a correction

  95. contactus-linkedin.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…LinkedIn
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    contactus-linkedin.com
    First seen
    2026-11-08 10:13 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:08 UTC to 2027-02-06 09:08 UTC
    Logged 2026-11-08 10:07 UTC in Google PlumbersArms2027h1, entry 675,873,396
    SHA-256 2fcb5bb9148789354dbb70ae4c0d166e1c21456e0e6a20f8dee3c5633709cec4
    Public key SHA-256 3ffd63e936459c15ec70995743c1d767ecf144e2f3c2c0f0c95dd960037d889e
    Brand
    LinkedIn
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    contactus-linkedin.com
    MX
    Receives mail at mx1.titan.email, mx2.titan.email
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:18 UTC

    Suggest a correction

  96. www.google-site.cn HK · AS138415 · Yancy Limited10 addressesGoogle
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.google-site.cn
    First seen
    2026-11-08 10:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 156.234.67.9.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 156.234.67.9
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 156.247.54.171.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 156.247.54.171
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 09:01 UTC to 2027-02-06 09:01 UTC
    Logged 2026-11-08 10:00 UTC in Geomys Tuscolo2027h1, entry 526,417,460
    SHA-256 517383496f9b0aa6b789e7e413ca3b81b815ec526ce8ec6ac29dab649a9a6265
    Public key SHA-256 7077076de1b10055f2c031a45fe751a8fe49c72cbda9cdecb3853a10e87ef7ac
    Brand
    Google
    Addresses
    156.234.67.9 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.10 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.11 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.152 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.153 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.154 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.155 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.171 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.172 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.173 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    google-site.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:18 UTC

    Suggest a correction

  97. m.google-site.cn HK · AS138415 · Yancy Limited10 addressesGoogle
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    m.google-site.cn
    First seen
    2026-11-08 10:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 156.234.67.9.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 156.234.67.9
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 156.247.54.171.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 156.247.54.171
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 09:01 UTC to 2027-02-06 09:01 UTC
    Logged 2026-11-08 10:00 UTC in Geomys Tuscolo2027h1, entry 526,417,460
    SHA-256 517383496f9b0aa6b789e7e413ca3b81b815ec526ce8ec6ac29dab649a9a6265
    Public key SHA-256 7077076de1b10055f2c031a45fe751a8fe49c72cbda9cdecb3853a10e87ef7ac
    Brand
    Google
    Addresses
    156.234.67.9 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.10 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.11 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.152 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.153 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.154 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.155 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.171 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.172 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.173 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    google-site.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:18 UTC

    Suggest a correction

  98. google-site.cn HK · AS138415 · Yancy Limited10 addressesGoogle
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    google-site.cn
    First seen
    2026-11-08 10:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 156.234.67.9.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 156.234.67.9
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 156.247.54.171.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 156.247.54.171
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 09:01 UTC to 2027-02-06 09:01 UTC
    Logged 2026-11-08 10:00 UTC in Geomys Tuscolo2027h1, entry 526,417,460
    SHA-256 517383496f9b0aa6b789e7e413ca3b81b815ec526ce8ec6ac29dab649a9a6265
    Public key SHA-256 7077076de1b10055f2c031a45fe751a8fe49c72cbda9cdecb3853a10e87ef7ac
    Brand
    Google
    Addresses
    156.234.67.9 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.10 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.11 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.152 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.153 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.154 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.155 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.171 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.172 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.173 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    google-site.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:18 UTC

    Suggest a correction

  99. ach-linkedin.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…LinkedIn
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    ach-linkedin.com
    First seen
    2026-11-08 10:11 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1
    Valid 2026-11-08 09:08 UTC to 2027-02-06 09:08 UTC
    Logged 2026-11-08 10:06 UTC in Google PlumbersArms2027h1, entry 675,871,712
    SHA-256 2ced9253fda3a85d710ed7bc72dc677c9edf3d1ab16b621bab07d0f19dab9e21
    Public key SHA-256 c6bc52e076addfd6a3e3aba1d416761e518f2863cac45354352664dcd455232a
    Brand
    LinkedIn
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    ach-linkedin.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:12 UTC

    Suggest a correction

  100. allianz-global-investors.cn HK · AS138415 · Yancy Limited10 addressesAllianz
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    allianz-global-investors.cn
    First seen
    2026-11-08 10:11 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 156.234.67.9.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 156.234.67.9
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 156.247.54.171.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 156.247.54.171
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 09:11 UTC to 2027-02-06 09:11 UTC
    Logged 2026-11-08 10:10 UTC in DigiCert Sphinx2027h1, entry 400,541,476
    SHA-256 24fe37050e57c463ca0a01e5640763fac9860aa22081144c682111a4633818f7
    Public key SHA-256 b95f154852f98cccf8ce2a2d74099e6e9bc12373bbd0a81e169e154653a0d5dd
    Brand
    Allianz
    Addresses
    156.234.67.9 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.10 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.67.11 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.152 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.153 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.154 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.234.84.155 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.171 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.172 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    156.247.54.173 · Hong Kong · AS138415 YANCYLIMITED-AS-HK - Yancy Limited
    Domain
    allianz-global-investors.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 10:12 UTC

    Suggest a correction

Showing 101–200 of 5,714 hostnames.Back to the start
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources