Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-09 01:53 UTC
Certificate-log entries · 24 h
348.6M
from 84 distinct feeds
Unique certificates · 24 h
33.5M
each reviewed
Names resolved · 24 h
22.0M
16.7M with an address
Findings · 24 h
5,707
202 of 1,061 brands targeted

4,828 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. 295893-ledger.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    295893-ledger.com
    First seen
    2026-11-09 01:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:50 UTC to 2027-02-07 00:50 UTC
    Logged 2026-11-09 01:49 UTC in IPng Networks Halloumi2027h1, entry 419,252,192
    SHA-256 22297a32d4f3e3f2c5a6918efb9f47d49cdfdee0be9d03d8e2dca360064f5680
    Public key SHA-256 b720b94fbc2d43bb9deba1169f3c60f97419f9e0185d07e505ae780ec61d4203
    Addresses
    104.21.1.57 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.161 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.1.57, 172.67.128.161): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    295893-ledger.com
    Registered
    2026-05-15 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  2. aegetkki.com
    ListedListed by NPA 165 (finance and insurance)MX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    aegetkki.com
    First seen
    2026-11-09 01:51 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:47 UTC to 2027-02-07 01:46 UTC
    Logged 2026-11-09 01:47 UTC in IPng Networks Halloumi2027h1, entry 419,235,971
    SHA-256 0bd89d032cb25f3a5a55737d42d84ac8381c2307e891233df5da32eb33ee8cbd
    Public key SHA-256 98144a21755ad0e55af655d83cd950a6b3f423c93171892782b96dd9b2050084
    Domain
    aegetkki.com
    Registered
    2025-11-19 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  3. coinpokercasino.es US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    coinpokercasino.es
    First seen
    2026-11-09 01:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 23:17 UTC to 2026-12-10 00:15 UTC
    Logged 2026-11-09 01:46 UTC in IPng Networks Gouda2026h2, entry 1,248,046,774
    SHA-256 21caa23d107be22f71e39946426eb7b0197ed5750e37dab8a5fd8237758c7e80
    Public key SHA-256 2650b5e05b965bb76d49b54ff3ee416043be442202862ad92b595b5303074d9d
    PhishDestroy
    Addresses
    104.21.91.176 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.177.27 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.176, 172.67.177.27): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    coinpokercasino.es
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:58 UTC

    Suggest a correction

  4. mhy.6jbs.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under 6jbs.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    mhy.6jbs.com
    First seen
    2026-11-09 01:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask, listing 6jbs.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 00:48 UTC to 2027-02-07 00:48 UTC
    Logged 2026-11-09 01:47 UTC in Google PlumbersArms2027h1, entry 688,655,505
    SHA-256 3a7c30b053f73c3b816ac485d923681a165dc3b26709a951889cbb761d4ea035
    Public key SHA-256 996b6779ae8e3603471cfa010b00e1c87c325502dc7972b1add60ed8d74ade2d
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    6jbs.com
    Registered
    2023-06-21 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 19:34 UTC

    Suggest a correction

  5. wpswss.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    wpswss.com
    First seen
    2026-11-09 01:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 00:51 UTC to 2027-02-07 00:51 UTC
    Logged 2026-11-09 01:50 UTC in Let's Encrypt Willow2027h1, entry 1,023,031,865
    SHA-256 1fa17a5f1d840c5aadfae75a42b62b5dc6d9e336dcbdfc44af882a25959e69a1
    Public key SHA-256 036004f7e5a266c72eb679d35b1e5dbc383c7a71d14cc5b6411c27540977bbc5
    PhishDestroy
    Addresses
    104.21.95.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.95.38, 172.67.142.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wpswss.com
    Registered
    2026-05-15 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  6. koiswap.biz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    koiswap.biz
    First seen
    2026-11-09 01:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 00:44 UTC to 2027-02-07 01:42 UTC
    Logged 2026-11-09 01:44 UTC in DigiCert Sphinx2027h1, entry 408,604,294
    SHA-256 2275ae0aaaadd02c49c0d560acf460561f9a2032280cb3c5eab38bccea07d6a2
    Public key SHA-256 6d01e87dfd56bb003133058fa793eb2df3d0ce87547234f16ba9244b3d741ad3
    Addresses
    104.21.30.231 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.30.231, 172.67.173.247): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    koiswap.biz
    Registered
    2026-05-14 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 09:15 UTC

    Suggest a correction

  7. permutofin.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    permutofin.com
    First seen
    2026-11-09 01:46 UTC
    Listing
    CERT Polska listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:46 UTC to 2027-02-07 00:46 UTC
    Logged 2026-11-09 01:44 UTC in DigiCert Wyvern2027h1, entry 461,535,602
    SHA-256 652f732c5e7ce80577d3a7537343867792ebe03fe284de500421658540e95214
    Public key SHA-256 5e629aebc37a4b609e625d61c2ccceeed86bb5f582dc22b46670289eb9be7ab7
    Addresses
    104.21.51.22 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.181 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.22, 172.67.218.181): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    permutofin.com
    Registered
    2026-08-18 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  8. saylyapp.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    saylyapp.com
    First seen
    2026-11-09 01:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 23:16 UTC to 2026-12-10 00:15 UTC
    Logged 2026-11-09 01:43 UTC in DigiCert Wyvern2026h2, entry 2,213,343,174
    SHA-256 5081436f6d1c86b8f7d27f9a16eacedabed854fd2c94ce221b098e6f007d1935
    Public key SHA-256 ea78fbfae9c64d358af0032b005584228ef7bd12fb92eff8c28500bb423021a6
    PhishDestroy
    Addresses
    104.21.58.212 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.181 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.58.212, 172.67.207.181): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    saylyapp.com
    Registered
    2026-07-13 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  9. teams-meeting-join-attendance.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by MetaMaskMX absentSPF missingDMARC quarantineRegistered 5 mo ago
    DetailsHide
    Hostname
    teams-meeting-join-attendance.com
    First seen
    2026-11-09 01:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-09 01:40 UTC to 2027-05-26 01:40 UTC
    Logged 2026-11-09 01:40 UTC in Sectigo Elephant2027h1, entry 789,019,037
    SHA-256 8da84e4c402066ab374f9e2ea74f39e8f12985138ca799c86aa8010f1c5615a9
    Public key SHA-256 4651a9051fd68e5703967e10d238d30bd5b56f3d915ce8f8d195181d587f89ee
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    teams-meeting-join-attendance.com
    Registered
    2026-06-17 · Wild West Domains, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  10. www.roobetofficials.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder roobetofficials.com, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    www.roobetofficials.com
    First seen
    2026-11-09 01:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask, listing roobetofficials.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 00:46 UTC to 2027-02-07 00:46 UTC
    Logged 2026-11-09 01:45 UTC in Geomys Tuscolo2027h1, entry 536,489,766
    SHA-256 27fce5c723a9e47b9358180052297bdeaee5bfdbc59fc8c10062bf1c3576275d
    Public key SHA-256 b1bc2f007cac50d954516ae644182f1e4738752403c2b337a7874be39b9e3ccb
    Addresses
    104.21.64.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.181.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.104, 172.67.181.25): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    roobetofficials.com
    Registered
    2026-07-25 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Receives mail at roobetofficials.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 23:39 UTC

    Suggest a correction

  11. 3imr.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    3imr.org
    First seen
    2026-11-09 01:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:40 UTC to 2027-02-07 01:37 UTC
    Logged 2026-11-09 01:40 UTC in IPng Networks Halloumi2027h1, entry 419,124,822
    SHA-256 aaa4b07fdc3695c286c3b6d9fa04b8f58445c7a37bb3be2208b1f309ad98e2ee
    Public key SHA-256 b9457226178a984d1072712e26222be52d71147aa9ed22462852cbcd543b9870
    PhishDestroy
    Addresses
    104.21.60.115 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.33 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.60.115, 172.67.196.33): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    3imr.org
    Registered
    2026-01-17 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  12. abacus.tor.taxi RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder tor.taxi, reported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 5 y ago
    DetailsHide
    Hostname
    abacus.tor.taxi
    First seen
    2026-11-09 01:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing tor.taxi and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 00:39 UTC to 2027-02-07 00:39 UTC
    Logged 2026-11-09 01:38 UTC in Google PlumbersArms2027h1, entry 688,526,326
    SHA-256 b3b8fcc82e7db3070a93ad243a30f43cd643ee199f7d87e4e7ec58439c96fcbe
    Public key SHA-256 aaf5f82dcc0fae22123785ea032a08ade90dc909cea6d44318c289158fd43f3d
    PhishDestroy
    Addresses
    185.129.100.227 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.129.100.227): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tor.taxi
    Registered
    2021-07-02 · Tucows Domains Inc.
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 20:53 UTC

    Suggest a correction

  13. api.tor.taxi RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder tor.taxi, reported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 5 y ago
    DetailsHide
    Hostname
    api.tor.taxi
    First seen
    2026-11-09 01:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing tor.taxi and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 00:39 UTC to 2027-02-07 00:39 UTC
    Logged 2026-11-09 01:38 UTC in Google PlumbersArms2027h1, entry 688,526,326
    SHA-256 b3b8fcc82e7db3070a93ad243a30f43cd643ee199f7d87e4e7ec58439c96fcbe
    Public key SHA-256 aaf5f82dcc0fae22123785ea032a08ade90dc909cea6d44318c289158fd43f3d
    PhishDestroy
    Addresses
    185.129.100.227 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.129.100.227): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tor.taxi
    Registered
    2021-07-02 · Tucows Domains Inc.
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 20:53 UTC

    Suggest a correction

  14. app.hyperlipuid.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder hyperlipuid.xyz, reported by PhishDestroyMX absentSPF missingDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    app.hyperlipuid.xyz
    First seen
    2026-11-09 01:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing hyperlipuid.xyz and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 23:45 UTC to 2026-12-10 00:45 UTC
    Logged 2026-11-09 01:37 UTC in Let's Encrypt Willow2026h2, entry 1,033,480,267
    SHA-256 073b87c75bb92bf8cfddbb22cc6ee18b93641dc3aa954172b316dae6fe32d032
    Public key SHA-256 4a432e4c35f9d49ee397f6ef72f73fcb9229a7123a5655efaff01ae36b499ad0
    PhishDestroy
    Addresses
    104.21.73.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.73.42, 172.67.140.30): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperlipuid.xyz
    Registered
    2026-08-31 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 01:44 UTC

    Suggest a correction

  15. claim-fi.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    claim-fi.com
    First seen
    2026-11-09 01:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 00:38 UTC to 2027-02-07 00:38 UTC
    Logged 2026-11-09 01:36 UTC in Let's Encrypt Sycamore2027h1, entry 1,066,672,531
    SHA-256 d80cfffc2a77fbe4b4e99fde7ee7704c70c6146f6e9cf380ec853c835680af36
    Public key SHA-256 79017d7e1a60e7be0949d5aa4c7caf696218b69c963f2d9c327434c7c5e9e7ed
    Addresses
    104.21.10.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.232 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.74, 172.67.144.232): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    claim-fi.com
    Registered
    2026-05-15 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  16. dmcaqueue-x.com
    ListedListed by MetaMaskMX absentSPF missingDMARC rejectRegistered 4 mo ago
    DetailsHide
    Hostname
    dmcaqueue-x.com
    First seen
    2026-11-09 01:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:39 UTC to 2027-02-07 01:37 UTC
    Logged 2026-11-09 01:39 UTC in Let's Encrypt Sycamore2027h1, entry 1,066,755,248
    SHA-256 147ecfb5b6a38e56c27473a4b6dec4e49a2ef78a6be7123c5affe12609353a7e
    Public key SHA-256 340f354c0dbe8380993aca949d19095cd47e2ef7f743efa6964c4cec7e30e6d6
    Domain
    dmcaqueue-x.com
    Registered
    2026-07-13 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  17. foxphone.co US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    foxphone.co
    First seen
    2026-11-09 01:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 22:24 UTC to 2026-12-09 23:21 UTC
    Logged 2026-11-09 01:37 UTC in DigiCert Wyvern2026h2, entry 2,213,329,859
    SHA-256 206cf957bb71e87f85bc8456dcc76b31f234c4a9fdb80f85d33aedab4f30f1f5
    Public key SHA-256 a393121cce95033c22c9a35c56743d46eb8764f1f830cb5b374bd8577d251870
    PhishDestroy
    Addresses
    104.21.72.92 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.179.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.72.92, 172.67.179.118): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    foxphone.co
    Registered
    2025-10-10 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:44 UTC

    Suggest a correction

  18. hyperlipuid.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    hyperlipuid.xyz
    First seen
    2026-11-09 01:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 23:45 UTC to 2026-12-10 00:45 UTC
    Logged 2026-11-09 01:37 UTC in Let's Encrypt Willow2026h2, entry 1,033,480,267
    SHA-256 073b87c75bb92bf8cfddbb22cc6ee18b93641dc3aa954172b316dae6fe32d032
    Public key SHA-256 4a432e4c35f9d49ee397f6ef72f73fcb9229a7123a5655efaff01ae36b499ad0
    PhishDestroy
    Addresses
    104.21.73.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.73.42, 172.67.140.30): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperlipuid.xyz
    Registered
    2026-08-31 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 01:44 UTC

    Suggest a correction

  19. mbnhdfste.asia US · AS16509 · Amazon.com, Inc.4 addresses
    ListedAmazon Web ServicesListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    mbnhdfste.asia
    First seen
    2026-11-09 01:41 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 S22 · precertificate
    Valid 2026-11-09 00:40 UTC to 2027-05-26 01:40 UTC
    Logged 2026-11-09 01:40 UTC in DigiCert Wyvern2027h1, entry 461,472,779
    SHA-256 2d1863ab1db9b90bbd0e36c65759f40f7bceaceed9881127d3887f7c1b9447c5
    Public key SHA-256 2d3c57b5a4c81abd76c8f1c1bd2d8b57fac548406564fdb0ecb22255a195a904
    Addresses
    18.239.69.3 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.69.56 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.69.103 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.69.120 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (18.239.69.3, 18.239.69.56, 18.239.69.103, 18.239.69.120): a cloud provider. It rents servers and addresses to its customers.
    Domain
    mbnhdfste.asia
    Registered
    2026-06-09 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  20. polymarket.not-today.work US · AS13335 · Cloudflare, Inc.2 addressesPolymarket
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    polymarket.not-today.work
    First seen
    2026-11-09 01:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:36 UTC to 2027-02-07 01:36 UTC
    Logged 2026-11-09 01:36 UTC in Google ParcelYard2027h1, entry 688,210,370
    SHA-256 13d4ce70fe077cca055f91642f66cc084b4b2c6e7258a7d16f52e6369d6ab23e
    Public key SHA-256 f8dcefa3be3e094d38f191e18d05fbe6063b9fcd1c06e8b140398f648e598792
    Brand
    Polymarket
    Addresses
    104.21.41.162 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.148.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.41.162, 172.67.148.58): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    not-today.work
    Registered
    2023-03-20 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  21. surefx.live US · AS53667 · FranTech Solutions
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    surefx.live
    First seen
    2026-11-09 01:41 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-10-30 · still listed at the last successful feed check 2026-11-08 23:58 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-29 (4 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:38 UTC to 2027-02-07 00:38 UTC
    Logged 2026-11-09 01:36 UTC in Geomys Tuscolo2027h1, entry 536,361,698
    SHA-256 0fdcdaa41a1467a637e955690c49be93cc1d8194f7977799fa43c50edae5e948
    Public key SHA-256 dae1e6eaa8deb7baf8544c8d264faf0f74d44b360fbd9f56ff7a8b882109975a
    PhishDestroy
    Addresses
    198.251.84.236 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    surefx.live
    Registered
    2026-09-11 · Sav.com, LLC
    MX
    Receives mail at mail.surefx.live
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  22. darknetnews.com US · AS14618 · Amazon.com, Inc.4 addresses
    ReportedParking page · HugeDomainsReported by PhishDestroyMX absentSPF -allDMARC missingRegistered 7 y ago
    DetailsHide
    Hostname
    darknetnews.com
    First seen
    2026-11-09 01:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:34 UTC to 2027-02-07 00:34 UTC
    Logged 2026-11-09 01:33 UTC in DigiCert Wyvern2027h1, entry 461,389,215
    SHA-256 0607367e168047a9c930f629b18a1808b0afb2fb4c3a26c1a69cf8f7f50c266d
    Public key SHA-256 81bfebebb50251e379ebf8001b1d53eabc9eabb6d3ea55bb4ef56ee41b66cf02
    PhishDestroy
    Addresses
    13.223.25.84 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    54.243.117.197 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    2600:1f18:4ae:c605:dd5d:b838:5816:d7fb
    2600:1f18:4ae:c606:78d4:4260:db4e:aeee
    Parking page · HugeDomains
    HugeDomains (13.223.25.84, 54.243.117.197): a parking service. It answers for names that are typically for sale or unused.
    Domain
    darknetnews.com
    Registered
    2020-04-19 · TurnCommerce, Inc. DBA NameBright.com
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  23. dwpvxp.daunt.link RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder daunt.link, reported by PhishDestroyMX absentSPF ~allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    dwpvxp.daunt.link
    First seen
    2026-11-09 01:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing daunt.link and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:34 UTC to 2027-02-07 00:34 UTC
    Logged 2026-11-09 01:32 UTC in Google PlumbersArms2027h1, entry 688,449,459
    SHA-256 12440182dfb4ad391e555850c0df4070df77bac82fe2bd5513dbf54166623fee
    Public key SHA-256 01a5f540cde4361b314bbcbe7ec742975d59d030240c1f9d8c4610088a4ffae6
    PhishDestroy
    Addresses
    185.149.120.195 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.149.120.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    daunt.link
    Registered
    2022-09-25 · Key-Systems, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 20:53 UTC

    Suggest a correction

  24. gjrbgw.daunt.link RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder daunt.link, reported by PhishDestroyMX absentSPF ~allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    gjrbgw.daunt.link
    First seen
    2026-11-09 01:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing daunt.link and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:34 UTC to 2027-02-07 00:34 UTC
    Logged 2026-11-09 01:32 UTC in Google PlumbersArms2027h1, entry 688,449,459
    SHA-256 12440182dfb4ad391e555850c0df4070df77bac82fe2bd5513dbf54166623fee
    Public key SHA-256 01a5f540cde4361b314bbcbe7ec742975d59d030240c1f9d8c4610088a4ffae6
    PhishDestroy
    Addresses
    185.149.120.195 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.149.120.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    daunt.link
    Registered
    2022-09-25 · Key-Systems, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 20:53 UTC

    Suggest a correction

  25. localpokiesau.online US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by CERT PolskaMX absentSPF missingDMARC quarantineRegistered 12 mo ago
    DetailsHide
    Hostname
    localpokiesau.online
    First seen
    2026-11-09 01:36 UTC
    Listing
    CERT Polska listed it 2026-10-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-09 01:32 UTC to 2027-05-26 01:32 UTC
    Logged 2026-11-09 01:32 UTC in Sectigo Elephant2027h1, entry 788,902,531
    SHA-256 3a8bcc1e337f8f141ac99bbed579e3b79876735198665b7784a47af59b7db85f
    Public key SHA-256 41a80d15cf950c859e1c4b516d1ac276364ec84e0213211a4eed2bd3ae2575a1
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    localpokiesau.online
    Registered
    2025-11-03 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  26. nexthorizonjournal.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    nexthorizonjournal.com
    First seen
    2026-11-09 01:36 UTC
    Listing
    CERT Polska listed it 2026-07-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:32 UTC to 2027-02-07 01:30 UTC
    Logged 2026-11-09 01:32 UTC in Geomys Tuscolo2027h1, entry 536,298,261
    SHA-256 22636d607f3d8ecf3f3018dc2c1ca0d70695b06315968d0367a97a76abb17626
    Public key SHA-256 1d76bfc404347f81da3083836334f3b568abc04d38ba89b9c45221011b42691a
    Addresses
    104.21.35.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.181.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.251, 172.67.181.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nexthorizonjournal.com
    Registered
    2026-07-13 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  27. safe-pdf.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    safe-pdf.net
    First seen
    2026-11-09 01:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 00:34 UTC to 2027-02-07 00:34 UTC
    Logged 2026-11-09 01:32 UTC in IPng Networks Halloumi2027h1, entry 419,026,460
    SHA-256 12a848e8dfb23204b6307fc51d2ace25feab07e392b36f1eeea51e38f55210bd
    Public key SHA-256 25875f96431cd0fef14eae1bafb55b257c1e6df419f82099360a2042a7222e45
    PhishDestroy
    Addresses
    104.21.81.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.81.39, 172.67.188.42): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    safe-pdf.net
    Registered
    2026-03-17 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  28. web2.daunt.link RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder daunt.link, reported by PhishDestroyMX absentSPF ~allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    web2.daunt.link
    First seen
    2026-11-09 01:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing daunt.link and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:34 UTC to 2027-02-07 00:34 UTC
    Logged 2026-11-09 01:32 UTC in Google PlumbersArms2027h1, entry 688,449,459
    SHA-256 12440182dfb4ad391e555850c0df4070df77bac82fe2bd5513dbf54166623fee
    Public key SHA-256 01a5f540cde4361b314bbcbe7ec742975d59d030240c1f9d8c4610088a4ffae6
    PhishDestroy
    Addresses
    185.149.120.195 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.149.120.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    daunt.link
    Registered
    2022-09-25 · Key-Systems, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 20:53 UTC

    Suggest a correction

  29. www.beta.wordpress.androidloading.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder androidloading.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    www.beta.wordpress.androidloading.com
    First seen
    2026-11-09 01:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing androidloading.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 00:34 UTC to 2027-02-07 00:34 UTC
    Logged 2026-11-09 01:33 UTC in Google PlumbersArms2027h1, entry 688,454,270
    SHA-256 0770c201806a2ed142e46c26d03a2845d4fcbc1dd9c8274f2f0d45342f1709d0
    Public key SHA-256 8d4df9444f99eb9a482b1261d32236af49ac82aa567f2e219de2f2a360707bfe
    PhishDestroy
    Addresses
    185.178.208.191 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.191): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    androidloading.com
    Registered
    2023-04-19 · Center of Ukrainian Internet Names (UKRNAMES)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 22:34 UTC

    Suggest a correction

  30. www.elitesholdingsng.com AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicUnder elitesholdingsng.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    www.elitesholdingsng.com
    First seen
    2026-11-09 01:36 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-08 · still listed at the last successful feed check 2026-11-08 23:58 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-07 (13 days)
    Reported
    PhishDestroy, listing elitesholdingsng.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 00:34 UTC to 2027-02-07 00:34 UTC
    Logged 2026-11-09 01:33 UTC in Google ParcelYard2027h1, entry 688,165,066
    SHA-256 48739f62d45a0622b6d8fbf1397e780258360e9661b485760d82a0524776f43f
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates elitesholdingsng.com to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    elitesholdingsng.com
    Registered
    2023-11-08 · NameSilo, LLC
    MX
    Receives mail at mail.eye-mail.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:15 UTC

    Suggest a correction

  31. arcxray.com.au AU · AS38719 · Dreamscape Networks Limited
    ReportedReported by PhishTankMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    arcxray.com.au
    First seen
    2026-11-09 01:31 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 01:12 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by RapidSSL TLS RSA CA G1 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-05-26 23:59 UTC
    Logged 2026-11-09 01:25 UTC in Let's Encrypt Sycamore2027h1, entry 1,066,427,098
    SHA-256 0d6f62fdf15652e2c447e98b6b165954619282dd89c6428780c612ada70f7644
    Public key SHA-256 2e6b84b4087c63b4e0dbef82ad733ba045e985f1d7b0be91cce477db0fd9d6e6
    PhishTank
    PhishTank report #8096865
    Addresses
    27.124.119.225 · Australia · AS38719 DREAMSCAPE-AS-AP - Dreamscape Networks Limited
    Domain
    arcxray.com.au
    MX
    Receives mail at arcxray-com-au.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 01:34 UTC

    Suggest a correction

  32. ferienhaeuserg.de AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    ferienhaeuserg.de
    First seen
    2026-11-09 01:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:28 UTC to 2027-02-07 00:28 UTC
    Logged 2026-11-09 01:27 UTC in Geomys Tuscolo2027h1, entry 536,253,391
    SHA-256 9db7af2cc152b42f116e212f8e060ec2521bed8564da63999ed7877a501cc5f3
    Public key SHA-256 4fc3fa2093ddfedab887371041dfcb38ba56a233203846219ad5115514decaa6
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates ferienhaeuserg.de to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ferienhaeuserg.de
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:34 UTC

    Suggest a correction

  33. foxphone.cn US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    foxphone.cn
    First seen
    2026-11-09 01:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:26 UTC to 2027-02-07 01:24 UTC
    Logged 2026-11-09 01:26 UTC in DigiCert Wyvern2027h1, entry 461,354,946
    SHA-256 7d04698e205a4b3b73fb6f54b409edc8acb75906fdfec110ccd02b46d5c918ba
    Public key SHA-256 beb6ced55b78d6445e6614e5e64c48a1cca46005971728757de1c08a8d28bd35
    PhishDestroy
    Addresses
    104.21.45.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.45.207, 172.67.218.221): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    foxphone.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:34 UTC

    Suggest a correction

  34. inscribirse-ayuda.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    inscribirse-ayuda.com
    First seen
    2026-11-09 01:31 UTC
    Listing
    CERT Polska listed it 2026-08-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:28 UTC to 2027-02-07 01:27 UTC
    Logged 2026-11-09 01:28 UTC in Let's Encrypt Willow2027h1, entry 1,022,491,770
    SHA-256 e1238bdffee29805de983ffc4c7ba2ed73c07a576b57086e3958276aa786002d
    Public key SHA-256 bcd7c3911e3e10de57ecbb4c64b9de486b88a4348a7d752fd23bac97cfe88f68
    Addresses
    104.21.39.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.171.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.39.237, 172.67.171.216): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    inscribirse-ayuda.com
    Registered
    2026-07-13 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  35. partnersss.com US · AS26496 · GoDaddy.com, LLC
    ListedGoDaddyListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC quarantineRegistered 12 mo ago
    DetailsHide
    Hostname
    partnersss.com
    First seen
    2026-11-09 01:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 00:31 UTC to 2027-02-07 00:31 UTC
    Logged 2026-11-09 01:30 UTC in Google PlumbersArms2027h1, entry 688,416,975
    SHA-256 2dd576c75ca073deeec2a27274eff48789c765af9d5ff31ecf2c72922f86d534
    Public key SHA-256 bfdf0c8af1f62fed13b5b74108c839f54e9f49242f4f067f53129f1c895178cb
    Addresses
    68.178.160.226 · United States · AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC · GoDaddy (shared hosting)
    GoDaddy
    GoDaddy (68.178.160.226): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    partnersss.com
    Registered
    2025-11-17 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  36. pofazjyekjqqiqfjxttqoyxgpj.cryptopayment.xyz US · AS14061 · DigitalOcean, LLC
    ListedDigitalOceanUnder cryptopayment.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    pofazjyekjqqiqfjxttqoyxgpj.cryptopayment.xyz
    First seen
    2026-11-09 01:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask, listing cryptopayment.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 00:27 UTC to 2027-02-07 00:27 UTC
    Logged 2026-11-09 01:25 UTC in Google ParcelYard2027h1, entry 688,076,551
    SHA-256 2ded889d0df3fe2e240140a2c84041af65ac1aaf144753770f2c48ff564959ce
    Public key SHA-256 8dcadfd7dc772fdea4e1a1dfdc5793eb90cf9af265f017a7aeda0e3520c58e6b
    Addresses
    143.244.211.82 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (143.244.211.82): a cloud provider. It rents servers and addresses to its customers.
    Domain
    cryptopayment.xyz
    Registered
    2020-11-20 · Interstellar Registrar Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  37. rucabit.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    rucabit.com
    First seen
    2026-11-09 01:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:30 UTC to 2027-02-07 01:28 UTC
    Logged 2026-11-09 01:30 UTC in DigiCert Sphinx2027h1, entry 408,461,924
    SHA-256 d34058d830ceb45cab7507166d372de7d0db01b6f857af9c1e8807df61565ecb
    Public key SHA-256 02899e17abab3b79f15da33dc953eaea3c06d4fde106c2bdb2fd87c21f776e2a
    PhishDestroy
    Addresses
    104.21.36.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.36.44, 172.67.185.49): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rucabit.com
    Registered
    2026-07-13 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  38. tevecorly.fit US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tevecorly.fit
    First seen
    2026-11-09 01:31 UTC
    Listing
    CERT Polska listed it 2026-06-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 00:30 UTC to 2027-02-07 00:30 UTC
    Logged 2026-11-09 01:28 UTC in Google ParcelYard2027h1, entry 688,105,486
    SHA-256 568b541988f3449306c7e773b703c9c86b32cbab4fed42a91cd2e71ae1e7c386
    Public key SHA-256 3453bbc6cedd59bed1ff9fb9de5c1d4de60530175de7e370738c8a823ae8d3f8
    Addresses
    104.21.82.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.161.113 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.82.182, 172.67.161.113): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevecorly.fit
    Registered
    2026-05-14 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  39. alexandroshopping.shop
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    alexandroshopping.shop
    First seen
    2026-11-09 01:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:23 UTC to 2027-02-07 00:23 UTC
    Logged 2026-11-09 01:22 UTC in Let's Encrypt Willow2027h1, entry 1,022,368,518
    SHA-256 13ff204b4e93ee88520df4ce067cde56a59fa39fff5002b5ac2c696eef738d6c
    Public key SHA-256 2b15ffd24197ae976efb47e694d9d33c168fdb08dfb8cb376591770fcd8f5c36
    Domain
    alexandroshopping.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:29 UTC

    Suggest a correction

  40. event.psalmistglobalsolutions.com BD · AS153568 · NEW DHAKA HARDWARE
    ReportedUnder psalmistglobalsolutions.com, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy noneRegistered 10 mo ago
    DetailsHide
    Hostname
    event.psalmistglobalsolutions.com
    First seen
    2026-11-09 01:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing psalmistglobalsolutions.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 00:26 UTC to 2027-02-07 00:26 UTC
    Logged 2026-11-09 01:24 UTC in DigiCert Sphinx2027h1, entry 408,437,839
    SHA-256 1f360df1a38d24512b0929f4c2987ea8a4e4170c1cbcdf5b463b3786e9a64332
    Public key SHA-256 c9a2d87fd7f22552667332a784122189df9b41f4062bfaa28ecade51e4a0321c
    PhishDestroy
    Addresses
    163.61.188.2 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    psalmistglobalsolutions.com
    Registered
    2026-01-15 · IONOS SE
    MX
    Receives mail at psalmistglobalsolutions.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server psalmistglobalsolutions.com at 163.61.188.2 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.2 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-08 17:02 UTC

    Suggest a correction

  41. forviewer.com BD · AS153947 · FAST ZONE IT
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    forviewer.com
    First seen
    2026-11-09 01:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:23 UTC to 2027-02-07 00:23 UTC
    Logged 2026-11-09 01:22 UTC in Google PlumbersArms2027h1, entry 688,328,832
    SHA-256 0de50a7f3d3be7cad59a6fe069271d92580920a578a7d279be6847e27eaf3d6d
    Public key SHA-256 16f5d0230dbf74ea155b5b14f19d31396ca8bfb73d24c7bea5500dc1f9bd362a
    PhishDestroy
    Addresses
    193.187.110.18 · Bangladesh · AS153947 FASTZONEIT-AS-AP - FAST ZONE IT
    Domain
    forviewer.com
    Registered
    2026-07-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  42. fyr.1doc-shop.com AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder 1doc-shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    fyr.1doc-shop.com
    First seen
    2026-11-09 01:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing 1doc-shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:22 UTC to 2027-02-07 00:22 UTC
    Logged 2026-11-09 01:20 UTC in Google ParcelYard2027h1, entry 688,016,388
    SHA-256 a8ee52afae126db8698ef3cf219b0491061fe021296b95f557dc27749bb106b9
    Public key SHA-256 1993ea6383f2a342c35474d7a41a09b5ab2421e546a9a2736bcfb2bba87ca886
    PhishDestroy
    Addresses
    186.2.175.208 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    1doc-shop.com
    Registered
    2026-05-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  43. gozawin.com KN · AS402253 · SKN Subnet & Telecom Ltd
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    gozawin.com
    First seen
    2026-11-09 01:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 00:22 UTC to 2027-02-07 00:22 UTC
    Logged 2026-11-09 01:21 UTC in Let's Encrypt Willow2027h1, entry 1,022,352,085
    SHA-256 2c6ac5ff5efaa5b53e3202931086514f733d41b121ce710cbd5d67b50cc9fd93
    Public key SHA-256 bd8bbedcd220b998b9d56ac9bcfa15fe3e1cbd7a30852a5d05e510dc9c49e3a4
    Addresses
    66.198.225.39 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    gozawin.com
    Registered
    2026-07-03 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  44. kitaprota.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    kitaprota.com
    First seen
    2026-11-09 01:26 UTC
    Listing
    USOM listed it 2026-06-06 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:09 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 00:25 UTC to 2027-02-07 00:25 UTC
    Logged 2026-11-09 01:24 UTC in DigiCert Sphinx2027h1, entry 408,434,611
    SHA-256 9e180aae4636e9394d60b70b5724341b444fd0c4ca26e6335f34d5aec4a9a37f
    Public key SHA-256 be2454f2dd9a59d12daa04203e4cf672146d990f7dfedb5576b4cacdd48bdb18
    Addresses
    104.21.63.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.150.92 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.63.207, 172.67.150.92): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kitaprota.com
    Registered
    2026-05-15 · Realtime Register B.V.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  45. rinanze.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    rinanze.com
    First seen
    2026-11-09 01:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:24 UTC to 2027-02-07 01:23 UTC
    Logged 2026-11-09 01:24 UTC in Let's Encrypt Sycamore2027h1, entry 1,066,403,600
    SHA-256 fc20334eeb64e860eff654e0765c4bb301b3b11567d1f6d4fb324a4f1acb240c
    Public key SHA-256 12e72707af6965602fb969c9ce20d46415582286e13b12319dbbb8bed694a9c9
    PhishDestroy
    Addresses
    104.21.35.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.149 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.184, 172.67.178.149): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rinanze.com
    MX
    Receives mail at mx1-hosting.jellyfish.systems, mx2-hosting.jellyfish.systems, mx3-hosting.jellyfish.systems
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 01:29 UTC

    Suggest a correction

  46. transporteslakes.cl CL · AS263702 · GRUPO ZGH SPA
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    transporteslakes.cl
    First seen
    2026-11-09 01:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:24 UTC to 2027-02-07 00:24 UTC
    Logged 2026-11-09 01:22 UTC in Google ParcelYard2027h1, entry 688,041,342
    SHA-256 af950a0f62a9027eaa4ac92de43c3d6ec089d17f2be603f9ebeca15db117a990
    Public key SHA-256 ff01e2fc4683f918738d394fc15d038b47872ced92c76ba7be47959d41c8b25b
    PhishDestroy
    Addresses
    207.210.83.100 · Chile · AS263702 AS263702 - GRUPO ZGH SPA
    Domain
    transporteslakes.cl
    MX
    Receives mail at mail.transporteslakes.cl
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 01:29 UTC

    Suggest a correction

  47. useksteady.click US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    useksteady.click
    First seen
    2026-11-09 01:26 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:21 UTC to 2027-02-07 01:20 UTC
    Logged 2026-11-09 01:21 UTC in DigiCert Wyvern2027h1, entry 461,332,673
    SHA-256 e90e461ae0111e4464801198649799c16c442ab23960b89c687fbd17500b6274
    Public key SHA-256 5935dae46a41c53f5550fc1ef0547f70e8ea60ea44febe59a3ce472d02a229b4
    Addresses
    104.21.4.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.4.148, 172.67.154.38): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    useksteady.click
    Registered
    2026-07-13 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  48. velocitumedia.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    velocitumedia.com
    First seen
    2026-11-09 01:26 UTC
    Listing
    USOM listed it 2026-05-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:09 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 00:26 UTC to 2027-02-07 00:26 UTC
    Logged 2026-11-09 01:25 UTC in Let's Encrypt Willow2027h1, entry 1,022,424,014
    SHA-256 5f30e7825dd51d0c0d08afda7a2911f26aac61083c282850d286cf288f2ca202
    Public key SHA-256 25aba02aaaa14fce06c92015bdc1f8ac60ae9ffcd0a2214be267c68665058fcf
    Addresses
    104.21.51.23 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.23, 172.67.218.182): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    velocitumedia.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:29 UTC

    Suggest a correction

  49. www.event.psalmistglobalsolutions.com BD · AS153568 · NEW DHAKA HARDWARE
    ReportedUnder psalmistglobalsolutions.com, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy noneRegistered 10 mo ago
    DetailsHide
    Hostname
    www.event.psalmistglobalsolutions.com
    First seen
    2026-11-09 01:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing psalmistglobalsolutions.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 00:26 UTC to 2027-02-07 00:26 UTC
    Logged 2026-11-09 01:24 UTC in DigiCert Sphinx2027h1, entry 408,437,839
    SHA-256 1f360df1a38d24512b0929f4c2987ea8a4e4170c1cbcdf5b463b3786e9a64332
    Public key SHA-256 c9a2d87fd7f22552667332a784122189df9b41f4062bfaa28ecade51e4a0321c
    PhishDestroy
    Addresses
    163.61.188.2 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    psalmistglobalsolutions.com
    Registered
    2026-01-15 · IONOS SE
    MX
    Receives mail at psalmistglobalsolutions.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server psalmistglobalsolutions.com at 163.61.188.2 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.2 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-08 17:02 UTC

    Suggest a correction

  50. app.dev.kidenai.com US · AS16509 · Amazon.com, Inc.4 addresses
    ListedAmazon Web ServicesUnder kidenai.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    app.dev.kidenai.com
    First seen
    2026-11-09 01:20 UTC
    Listing
    CERT Polska listed it 2026-06-24 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska, listing kidenai.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 S19 · precertificate
    Valid 2026-11-09 00:15 UTC to 2027-05-26 01:15 UTC
    Logged 2026-11-09 01:15 UTC in Geomys Tuscolo2027h1, entry 536,133,793
    SHA-256 3544ea355332aac03f41bb68c8d1c73534a217a1c6958470997c590766f82561
    Public key SHA-256 6a4ab07013b12fceebe81c214cbdf9d2ca638a0336d0d1f3f3dc02a3dc7bf58e
    Addresses
    18.239.36.44 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.36.100 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.36.108 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.36.127 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (18.239.36.44, 18.239.36.100, 18.239.36.108, 18.239.36.127): a cloud provider. It rents servers and addresses to its customers.
    Domain
    kidenai.com
    Registered
    2026-03-26 · Realtime Register B.V.
    MX
    Receives mail at kidenai.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:18 UTC

    Suggest a correction

  51. hostmaster.ibersat.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder ibersat.com, reported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    hostmaster.ibersat.com
    First seen
    2026-11-09 01:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing ibersat.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:20 UTC to 2027-02-07 00:20 UTC
    Logged 2026-11-09 01:19 UTC in Let's Encrypt Willow2027h1, entry 1,022,298,732
    SHA-256 53b3a93b2485be7c656f36a4c0dda9a8a8580cbbae27f954ec0af3726348261b
    Public key SHA-256 88658e1d485c85de28499b5e85d8a863cff18058eb54151c47c5ada23d3e91f4
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates ibersat.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ibersat.com
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:24 UTC

    Suggest a correction

  52. houxz.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    houxz.com
    First seen
    2026-11-09 01:20 UTC
    Listing
    CERT Polska listed it 2026-05-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:18 UTC to 2027-02-07 00:18 UTC
    Logged 2026-11-09 01:16 UTC in IPng Networks Gouda2027h1, entry 358,936,573
    SHA-256 59fed5f308a28b43e837dafa7eb62dc3e1cb2eb8eef3bda213a462184282a318
    Public key SHA-256 8b16c3773dda67612b00638bb15b2c16d9d687db36cae43a1bac5579dc2214e5
    Addresses
    104.21.11.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.11.17, 172.67.147.142): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    houxz.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:24 UTC

    Suggest a correction

  53. ibersat.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    ibersat.com
    First seen
    2026-11-09 01:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:20 UTC to 2027-02-07 00:20 UTC
    Logged 2026-11-09 01:19 UTC in Let's Encrypt Willow2027h1, entry 1,022,298,732
    SHA-256 53b3a93b2485be7c656f36a4c0dda9a8a8580cbbae27f954ec0af3726348261b
    Public key SHA-256 88658e1d485c85de28499b5e85d8a863cff18058eb54151c47c5ada23d3e91f4
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates ibersat.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ibersat.com
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:24 UTC

    Suggest a correction

  54. tww18.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    tww18.cc
    First seen
    2026-11-09 01:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:15 UTC to 2027-02-07 01:14 UTC
    Logged 2026-11-09 01:15 UTC in Geomys Tuscolo2027h1, entry 536,132,281
    SHA-256 1f6050e38e34436290034e9c6cfac5e00862bfe7627aa72b96fda506af9617cf
    Public key SHA-256 4cdc45eb0c829dc9c2a87881297b942d0114f8f4edde98e428fb5fc73e4833b2
    PhishDestroy
    Addresses
    104.21.83.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.214.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.83.63, 172.67.214.247): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tww18.cc
    Registered
    2022-03-15 · DotWee Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  55. admin.btcagi.vip AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder btcagi.vip, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    admin.btcagi.vip
    First seen
    2026-11-09 01:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing btcagi.vip and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:13 UTC to 2027-02-07 00:13 UTC
    Logged 2026-11-09 01:12 UTC in IPng Networks Halloumi2027h1, entry 418,845,854
    SHA-256 97742832a583b43d803e57b1cdf6d3949845afc40990784feecbf63514c75c7b
    Public key SHA-256 9631bdc577b1e49cd89e2aae25432f6595ac680de9d4c3fddf3ad6903a866991
    PhishDestroy
    Addresses
    103.224.182.216 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates btcagi.vip to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.216): a parking service. It answers for names that are typically for sale or unused.
    Domain
    btcagi.vip
    Registered
    2026-07-30 · CommuniGal Communication Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  56. app.btcagi.vip AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder btcagi.vip, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    app.btcagi.vip
    First seen
    2026-11-09 01:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing btcagi.vip and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:13 UTC to 2027-02-07 00:13 UTC
    Logged 2026-11-09 01:12 UTC in IPng Networks Halloumi2027h1, entry 418,845,854
    SHA-256 97742832a583b43d803e57b1cdf6d3949845afc40990784feecbf63514c75c7b
    Public key SHA-256 9631bdc577b1e49cd89e2aae25432f6595ac680de9d4c3fddf3ad6903a866991
    PhishDestroy
    Addresses
    103.224.182.216 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates btcagi.vip to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.216): a parking service. It answers for names that are typically for sale or unused.
    Domain
    btcagi.vip
    Registered
    2026-07-30 · CommuniGal Communication Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  57. btcagi.vip AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    btcagi.vip
    First seen
    2026-11-09 01:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:13 UTC to 2027-02-07 00:13 UTC
    Logged 2026-11-09 01:12 UTC in IPng Networks Halloumi2027h1, entry 418,845,854
    SHA-256 97742832a583b43d803e57b1cdf6d3949845afc40990784feecbf63514c75c7b
    Public key SHA-256 9631bdc577b1e49cd89e2aae25432f6595ac680de9d4c3fddf3ad6903a866991
    PhishDestroy
    Addresses
    103.224.182.216 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates btcagi.vip to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.216): a parking service. It answers for names that are typically for sale or unused.
    Domain
    btcagi.vip
    Registered
    2026-07-30 · CommuniGal Communication Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  58. design.gives AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · Sav.comReported by PhishDestroyMX absentSPF -allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    design.gives
    First seen
    2026-11-09 01:15 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-10-29 · still listed at the last successful feed check 2026-11-08 23:58 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-28 (3 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 00:16 UTC to 2027-02-07 00:16 UTC
    Logged 2026-11-09 01:15 UTC in Google PlumbersArms2027h1, entry 688,239,000
    SHA-256 500ace37886f8f0feaad091c38cae29a93800880c821ae704818a53d99b74e2c
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.251 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · Sav.com
    The registry delegates design.gives to Sav.com’s nameservers, which answer for it. Sav.com: a parking service. It answers for names that are typically for sale or unused. ParkLogic (162.4.84.251): a parking service. It answers for names that are typically for sale or unused.
    Domain
    design.gives
    Registered
    2024-10-19 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  59. dev.btcagi.vip AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder btcagi.vip, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    dev.btcagi.vip
    First seen
    2026-11-09 01:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing btcagi.vip and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:13 UTC to 2027-02-07 00:13 UTC
    Logged 2026-11-09 01:12 UTC in IPng Networks Halloumi2027h1, entry 418,845,854
    SHA-256 97742832a583b43d803e57b1cdf6d3949845afc40990784feecbf63514c75c7b
    Public key SHA-256 9631bdc577b1e49cd89e2aae25432f6595ac680de9d4c3fddf3ad6903a866991
    PhishDestroy
    Addresses
    103.224.182.216 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates btcagi.vip to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.216): a parking service. It answers for names that are typically for sale or unused.
    Domain
    btcagi.vip
    Registered
    2026-07-30 · CommuniGal Communication Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  60. ipoers.vip AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX absentSPF -allDMARC missingRegistered today
    DetailsHide
    Hostname
    ipoers.vip
    First seen
    2026-11-09 01:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:12 UTC to 2027-02-07 00:12 UTC
    Logged 2026-11-09 01:10 UTC in IPng Networks Halloumi2027h1, entry 418,826,142
    SHA-256 b61d0922b066a52009b4c5c15d18649c698e63f8a6b5664048cf90761f03d810
    Public key SHA-256 f26a2010020ea7c47064e38efca41df882ebc54a708a8116129f79406a238e0a
    PhishDestroy
    Addresses
    103.224.182.250 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates ipoers.vip to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.250): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ipoers.vip
    Registered
    2026-11-09 · CommuniGal Communication Ltd.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  61. kra-39cc.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    kra-39cc.net
    First seen
    2026-11-09 01:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-10-23 10:52 UTC to 2027-01-21 11:50 UTC
    Logged 2026-11-09 01:14 UTC in Geomys Trastevere2027h1, entry 38,873,597
    SHA-256 0ea77daf58b14b3c690738ed5f64d8c1056a535d5418ec177eef1ee4879043e3
    Public key SHA-256 367e0ccc08049c3dd7832311e129839d47830eba6c725a22a2c4cb994d6f11c1
    Addresses
    104.21.92.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.92.72, 172.67.188.159): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kra-39cc.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:19 UTC

    Suggest a correction

  62. q3-openserv.claims US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    q3-openserv.claims
    First seen
    2026-11-09 01:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:10 UTC to 2027-02-07 01:07 UTC
    Logged 2026-11-09 01:10 UTC in Google ParcelYard2027h1, entry 687,879,066
    SHA-256 086c54cc7a7175ad1ada7f0070d479ddbe8e4cfc60a21dcccd2c63c160ab539c
    Public key SHA-256 388adc2acd314439ddd8e7a3befc4a37e60a21ab22cae190b76450b86ab99401
    Addresses
    104.21.68.34 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.34, 172.67.185.219): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    q3-openserv.claims
    Registered
    2026-07-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  63. rdpidpapp.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    rdpidpapp.com
    First seen
    2026-11-09 01:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:14 UTC to 2027-02-07 01:13 UTC
    Logged 2026-11-09 01:15 UTC in Let's Encrypt Willow2027h1, entry 1,022,198,054
    SHA-256 aac4ab6e6b379eb3249b049d12ff2834d3396bdd58b87ed29d35a44dec557255
    Public key SHA-256 e718397a13e0833931484780e31cb91f2a84de70f63a4b0ee7f1f0b7635ba6b0
    PhishDestroy
    Addresses
    104.21.62.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.204 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.76, 172.67.221.204): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rdpidpapp.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:19 UTC

    Suggest a correction

  64. sm-shopmebest.top HK · AS152194 · CTG Server Limited
    ListedListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    sm-shopmebest.top
    First seen
    2026-11-09 01:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-09 01:10 UTC in Google Argon2027h1, entry 936,647,824
    SHA-256 e701fc0c59aea934d56305d5e5c49c8c1a070fa63aa89146b0da48ca42fb7469
    Public key SHA-256 9c9a1d6a3b2faf4ec0a0e25ee00795c822a7cecd821190b0d71f3945546e53e9
    Addresses
    27.124.12.154 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    sm-shopmebest.top
    Registered
    2026-03-14 · Web Commerce Communications Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  65. stark-vardeborg.pro NL · AS62370 · Snel Snel.com B.V.
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    stark-vardeborg.pro
    First seen
    2026-11-09 01:15 UTC
    Listing
    CERT Polska listed it 2026-07-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 00:13 UTC to 2027-02-07 00:13 UTC
    Logged 2026-11-09 01:12 UTC in Google ParcelYard2027h1, entry 687,905,884
    SHA-256 96e61c1ffa8bbd0f6848fd452fc277b4f294e3bdb7ce8bc212f20026835610ca
    Public key SHA-256 adb71f1ea5da83e67fbede6d20c7e48350bbf3206abb65faa2e0d6cded2908ba
    Addresses
    185.62.58.179 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    stark-vardeborg.pro
    Registered
    2026-03-17 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  66. test.btcagi.vip AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder btcagi.vip, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    test.btcagi.vip
    First seen
    2026-11-09 01:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing btcagi.vip and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 00:13 UTC to 2027-02-07 00:13 UTC
    Logged 2026-11-09 01:12 UTC in IPng Networks Halloumi2027h1, entry 418,845,854
    SHA-256 97742832a583b43d803e57b1cdf6d3949845afc40990784feecbf63514c75c7b
    Public key SHA-256 9631bdc577b1e49cd89e2aae25432f6595ac680de9d4c3fddf3ad6903a866991
    PhishDestroy
    Addresses
    103.224.182.216 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates btcagi.vip to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.216): a parking service. It answers for names that are typically for sale or unused.
    Domain
    btcagi.vip
    Registered
    2026-07-30 · CommuniGal Communication Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  67. kameran5554.duckdns.org SC · AS403005 · Blatant2 addresses
    ListedListed by USOM
    DetailsHide
    Hostname
    kameran5554.duckdns.org
    First seen
    2026-11-09 01:10 UTC
    Listing
    USOM listed it 2026-11-08 · first observed in the feed 2026-11-09 · still listed at the last successful feed check 2026-11-09 01:09 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 13:16 UTC to 2027-02-06 13:16 UTC
    Logged 2026-11-08 14:15 UTC in Geomys Tuscolo2027h1, entry 529,166,785
    SHA-256 a61689ecce6ca280c7b08e87e8e6bd159949f5c58002b25c87e88b068ee7cb50
    Public key SHA-256 c3e6ef1a59a919cfda697aeb2ccf38fe77f8a301ed4cc9e80dd5387034f72a15
    Addresses
    64.89.160.238 · Seychelles · AS403005 BLATANTHOST - Blatant
    192.169.69.25 · United States · AS27323 SERVERSTADIUM - Wowrack.com

    Suggest a correction

  68. maga-zine-luiza.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    maga-zine-luiza.com
    First seen
    2026-11-09 01:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 00:06 UTC to 2027-02-07 00:06 UTC
    Logged 2026-11-09 01:05 UTC in Google PlumbersArms2027h1, entry 688,109,343
    SHA-256 27b697371885b23feae38f082bdbfd3cec8c1c169b6e0f87986fa5953b3970fa
    Public key SHA-256 2e5fd9747ea269aa319f2cf1c7e8edde921a5d22d307d8435a576c02f51418ca
    PhishDestroy
    Addresses
    104.21.28.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.170.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.28.153, 172.67.170.229): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    maga-zine-luiza.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:14 UTC

    Suggest a correction

  69. novustradefin.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    novustradefin.com
    First seen
    2026-11-09 01:10 UTC
    Listing
    CERT Polska listed it 2026-09-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 00:11 UTC to 2027-02-07 00:11 UTC
    Logged 2026-11-09 01:09 UTC in Google ParcelYard2027h1, entry 687,870,023
    SHA-256 1dc6768e786f47b376fbe87cbf187e09106125f6e66bdf16bab17c01fd894863
    Public key SHA-256 d9ffcbe76a68ead9da540ff479b26f06bdd7e61c0f8e9485d7fbe51773b3cf05
    Addresses
    104.21.51.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.21 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.152, 172.67.182.21): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    novustradefin.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:14 UTC

    Suggest a correction

  70. theshoppingexpress.com AU · AS133618 · Trellian Pty. LimitedJapan Post
    ListedParking page · Above.comListed by JPCERT/CC as imitating 日本郵便MX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    theshoppingexpress.com
    First seen
    2026-11-09 01:10 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 14:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 00:07 UTC to 2027-02-07 00:07 UTC
    Logged 2026-11-09 01:06 UTC in Google PlumbersArms2027h1, entry 688,121,490
    SHA-256 6a5411be0fb72c3daa6fdf02c92b2cadccc2cd71a806fcc075a2086631a9d076
    Public key SHA-256 e6cb7cbb2ba6d18f259cd3ab971f970ea2084669925a211288eaa0e1bc829e32
    Brand
    Japan Post
    Addresses
    103.224.212.211 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates theshoppingexpress.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.211): a parking service. It answers for names that are typically for sale or unused.
    Domain
    theshoppingexpress.com
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:14 UTC

    Suggest a correction

  71. acs.kingdom-dmc.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder kingdom-dmc.com, listed by MetaMaskMX presentSPF all omittedDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    acs.kingdom-dmc.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask, listing kingdom-dmc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:03 UTC to 2027-02-07 00:03 UTC
    Logged 2026-11-09 01:01 UTC in Google PlumbersArms2027h1, entry 688,069,307
    SHA-256 543fd75690f1dbabd05507c3d77816bd41015f7d6c466742b5d4cf4f612323a2
    Public key SHA-256 ef61150943a08bb67ba2849470291dcf7323ba2296e049cc254ae7498726b137
    Addresses
    185.215.4.42 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.215.4.42): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kingdom-dmc.com
    Registered
    2022-12-16 · NameSilo, LLC
    MX
    Receives mail at mail.kingdom-dmc.com
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:11 UTC

    Suggest a correction

  72. airdrop-pepenode.io US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    airdrop-pepenode.io
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:03 UTC to 2027-02-07 01:00 UTC
    Logged 2026-11-09 01:03 UTC in Google ParcelYard2027h1, entry 687,794,570
    SHA-256 2e41e8ffe2ca825a2783e974860c7d37f28a641f95a9fa07477ab62dda32069f
    Public key SHA-256 cfc513eab2a0a0f05027b6bb1549cbe4dfe3acb071b11d0dc7a10c6cdb4923c4
    PhishDestroy
    Addresses
    104.21.12.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.132.96 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.12.193, 172.67.132.96): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    airdrop-pepenode.io
    Registered
    2025-11-19 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  73. allowcapital.sbs US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    allowcapital.sbs
    First seen
    2026-11-09 01:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:03 UTC to 2027-02-07 01:01 UTC
    Logged 2026-11-09 01:03 UTC in Let's Encrypt Willow2027h1, entry 1,021,952,621
    SHA-256 c4af642c6b609fd77ac92af2aab33f4d55212d3578f69fef06f06c50270434c8
    Public key SHA-256 9f484716d7d1851a3af2ac4528133c4c8c6e4fd111f63189d09cd58421221a78
    Addresses
    104.21.25.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.223.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.25.64, 172.67.223.107): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    allowcapital.sbs
    Registered
    2026-07-13 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  74. analytics.kingdom-dmc.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder kingdom-dmc.com, listed by MetaMaskMX presentSPF all omittedDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    analytics.kingdom-dmc.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask, listing kingdom-dmc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:03 UTC to 2027-02-07 00:03 UTC
    Logged 2026-11-09 01:01 UTC in Google PlumbersArms2027h1, entry 688,069,307
    SHA-256 543fd75690f1dbabd05507c3d77816bd41015f7d6c466742b5d4cf4f612323a2
    Public key SHA-256 ef61150943a08bb67ba2849470291dcf7323ba2296e049cc254ae7498726b137
    Addresses
    185.215.4.42 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.215.4.42): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kingdom-dmc.com
    Registered
    2022-12-16 · NameSilo, LLC
    MX
    Receives mail at mail.kingdom-dmc.com
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:11 UTC

    Suggest a correction

  75. api.arbionis-system-com-gent.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    api.arbionis-system-com-gent.financecryptoworld.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-02-07 00:59 UTC
    Logged 2026-11-09 01:00 UTC in DigiCert Sphinx2027h1, entry 408,271,261
    SHA-256 69f9a3c7719179292bd18d40597cafb6f6cf5cbbae74ff0ed7b01c025a8d2d57
    Public key SHA-256 b9687e3542dd34734e9e8b7762c0df907dbdadd7946610a4ef297fe484f80ea0
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  76. api.sol-reclaim.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder sol-reclaim.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    api.sol-reclaim.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask, listing sol-reclaim.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 00:05 UTC to 2027-02-07 00:05 UTC
    Logged 2026-11-09 01:04 UTC in Google PlumbersArms2027h1, entry 688,095,123
    SHA-256 8ffe6b7966e25349300edf60d7acbe228ec4cb84141b0010b220ede4e5a5e8b3
    Public key SHA-256 5bf9e67b355c15fbc0f28f423281895cd6ed9178c3fbf3face6d3c3e53e5b464
    Addresses
    104.21.48.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.157.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.48.251, 172.67.157.25): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sol-reclaim.com
    Registered
    2026-07-11 · IONOS SE
    MX
    Receives mail at mx00.ionos.it, mx01.ionos.it
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:01 UTC

    Suggest a correction

  77. bandotgg.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    bandotgg.org
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 00:06 UTC to 2027-02-07 00:06 UTC
    Logged 2026-11-09 01:05 UTC in DigiCert Sphinx2027h1, entry 408,289,687
    SHA-256 3905ede784a5049c33137f50170a4da7926b3b93e63a7fbc1f1392f8f8d74106
    Public key SHA-256 4451266e652ab98df4cb627ee66ccaacf675caf9f924503eaef04231167370b9
    PhishDestroy
    Addresses
    104.21.16.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.219, 172.67.216.63): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bandotgg.org
    Registered
    2026-09-10 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  78. cloudemulator.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 18 y ago
    DetailsHide
    Hostname
    cloudemulator.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:04 UTC to 2027-02-07 01:03 UTC
    Logged 2026-11-09 01:04 UTC in Geomys Tuscolo2027h1, entry 536,015,497
    SHA-256 81696c47c1407f70e1c80b12dc72409cf135c9a81b52af1d8e4549b4c98386fe
    Public key SHA-256 6a135c91979369db6aa42654fe704c6c66917031b3eb72363f5ff96da042fa27
    PhishDestroy
    Addresses
    104.21.46.174 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.168.205 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.46.174, 172.67.168.205): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloudemulator.com
    Registered
    2008-11-23 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  79. cpanel.kingdom-dmc.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder kingdom-dmc.com, listed by MetaMaskMX presentSPF all omittedDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    cpanel.kingdom-dmc.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask, listing kingdom-dmc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:03 UTC to 2027-02-07 00:03 UTC
    Logged 2026-11-09 01:01 UTC in Google PlumbersArms2027h1, entry 688,069,307
    SHA-256 543fd75690f1dbabd05507c3d77816bd41015f7d6c466742b5d4cf4f612323a2
    Public key SHA-256 ef61150943a08bb67ba2849470291dcf7323ba2296e049cc254ae7498726b137
    Addresses
    185.215.4.42 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.215.4.42): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kingdom-dmc.com
    Registered
    2022-12-16 · NameSilo, LLC
    MX
    Receives mail at mail.kingdom-dmc.com
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:11 UTC

    Suggest a correction

  80. genesis-debridge.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    genesis-debridge.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:02 UTC to 2027-02-07 01:00 UTC
    Logged 2026-11-09 01:02 UTC in Google PlumbersArms2027h1, entry 688,078,103
    SHA-256 8feedb96aae86c758ce321e886cf915202ba9abc193cc178e16d5e79555780e0
    Public key SHA-256 a7030c55e683c3bf6e9247dab6103178f3064ceee6a23b8bcc5429454f18871b
    PhishDestroy
    Addresses
    104.21.91.71 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.211.96 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.71, 172.67.211.96): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    genesis-debridge.com
    Registered
    2025-11-19 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  81. go.bybitget.com SG · AS139341 · ACE2 addresses
    ReportedUnder bybitget.com, reported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    go.bybitget.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing bybitget.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by TrustAsia DV TLS RSA CA 2025 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-09 01:03 UTC in Let's Encrypt Sycamore2027h1, entry 1,065,941,936
    SHA-256 8681e8bd5e0e7e3035fa1f8eb9a1325f3112853d73fa307fbac5e87b4776f59f
    Public key SHA-256 792a9a934007414087b40d44439d4f1d0a13644d93d466f536b0e61c27aaac35
    PhishDestroy
    Addresses
    43.174.246.42 · Singapore · AS139341 ACE-AS-AP - ACE
    43.174.247.42 · Singapore · AS139341 ACE-AS-AP - ACE
    Domain
    bybitget.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  82. home.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    home.fresh-focus.pro
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:04 UTC to 2027-02-07 00:04 UTC
    Logged 2026-11-09 01:03 UTC in Google ParcelYard2027h1, entry 687,792,356
    SHA-256 af6cac980d2a7e8716bddbadd8219762d51c623509bf06151eb54ba150208bc2
    Public key SHA-256 5fb20470e7f44418fce5ad28b7c3880819cd06d99d8e185350e01fdc083f5000
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  83. mail.rockstarlimitedpro.com BD · AS153568 · NEW DHAKA HARDWARE
    ReportedUnder rockstarlimitedpro.com, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy none
    DetailsHide
    Hostname
    mail.rockstarlimitedpro.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing rockstarlimitedpro.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:06 UTC to 2027-02-07 00:06 UTC
    Logged 2026-11-09 01:04 UTC in Google PlumbersArms2027h1, entry 688,104,250
    SHA-256 8e85d5ca015359689b5517bedae11f01044765167bc187e864f6c0fd6339d489
    Public key SHA-256 9f12dd56d12c80b667889a4ae8f2ca5aeb6760a6a62e196c0d45198358da2cbb
    PhishDestroy
    Addresses
    163.61.188.7 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    rockstarlimitedpro.com
    MX
    Receives mail at rockstarlimitedpro.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server rockstarlimitedpro.com at 163.61.188.7 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.7 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  84. mailadmin.kingdom-dmc.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder kingdom-dmc.com, listed by MetaMaskMX presentSPF all omittedDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    mailadmin.kingdom-dmc.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask, listing kingdom-dmc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:03 UTC to 2027-02-07 00:03 UTC
    Logged 2026-11-09 01:01 UTC in Google PlumbersArms2027h1, entry 688,069,307
    SHA-256 543fd75690f1dbabd05507c3d77816bd41015f7d6c466742b5d4cf4f612323a2
    Public key SHA-256 ef61150943a08bb67ba2849470291dcf7323ba2296e049cc254ae7498726b137
    Addresses
    185.215.4.42 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.215.4.42): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kingdom-dmc.com
    Registered
    2022-12-16 · NameSilo, LLC
    MX
    Receives mail at mail.kingdom-dmc.com
    SPF
    SPF record without an "all" mechanism
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 03:11 UTC

    Suggest a correction

  85. metehi-yepuzo.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    metehi-yepuzo.info
    First seen
    2026-11-09 01:05 UTC
    Listing
    CERT Polska listed it 2026-09-01 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 00:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:01 UTC to 2027-02-07 01:00 UTC
    Logged 2026-11-09 01:01 UTC in Geomys Tuscolo2027h1, entry 535,986,276
    SHA-256 e33dfd30fde6237576c8dcd8d44bf1bbcea30f2735c374ddc165da1393110680
    Public key SHA-256 69f96ad50bb58abaa1be08e065d6013590504f1faccaa7192df948acb3dcf9ff
    Addresses
    104.21.33.70 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.137 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.70, 172.67.159.137): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metehi-yepuzo.info
    Registered
    2026-07-13 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  86. openauthentication.cyou US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    openauthentication.cyou
    First seen
    2026-11-09 01:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 00:04 UTC to 2027-02-07 01:02 UTC
    Logged 2026-11-09 01:04 UTC in Google PlumbersArms2027h1, entry 688,098,179
    SHA-256 a15e941d3357cecc8d91a45a31a03c130451e570fdb7eba2340ad1a48b604914
    Public key SHA-256 8f9dd01fbb1109f18c071d5e9cfd45bda6b7f6a513060305cae1245f0354ee8e
    Addresses
    104.21.61.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.61.118, 172.67.210.68): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    openauthentication.cyou
    Registered
    2026-07-13 · Spaceship, Inc.
    MX
    Receives mail at route3.mx.cloudflare.net, route2.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  87. rainbetslots.net US · AS62468 · VpsQuan L.L.C.
    ListedListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    rainbetslots.net
    First seen
    2026-11-09 01:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 00:03 UTC to 2027-02-07 00:03 UTC
    Logged 2026-11-09 01:01 UTC in Google PlumbersArms2027h1, entry 688,069,445
    SHA-256 59e663c71f8407f2e6900553af56f2b9e80da414c5b09f2af9becdf4d8578757
    Public key SHA-256 fab154c7d1b09f4de750dff3fd296c424f3b51e1970b529d14cc521ed1c015d4
    Addresses
    69.165.75.129 · United States · AS62468 HKCLOUDX - VpsQuan L.L.C.
    Domain
    rainbetslots.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  88. rockstarlimitedpro.com BD · AS153568 · NEW DHAKA HARDWARE
    ReportedReported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy none
    DetailsHide
    Hostname
    rockstarlimitedpro.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:06 UTC to 2027-02-07 00:06 UTC
    Logged 2026-11-09 01:04 UTC in Google PlumbersArms2027h1, entry 688,104,250
    SHA-256 8e85d5ca015359689b5517bedae11f01044765167bc187e864f6c0fd6339d489
    Public key SHA-256 9f12dd56d12c80b667889a4ae8f2ca5aeb6760a6a62e196c0d45198358da2cbb
    PhishDestroy
    Addresses
    163.61.188.7 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    rockstarlimitedpro.com
    MX
    Receives mail at rockstarlimitedpro.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server rockstarlimitedpro.com at 163.61.188.7 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.7 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  89. www.rockstarlimitedpro.com BD · AS153568 · NEW DHAKA HARDWARE
    ReportedUnder rockstarlimitedpro.com, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy none
    DetailsHide
    Hostname
    www.rockstarlimitedpro.com
    First seen
    2026-11-09 01:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing rockstarlimitedpro.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 00:06 UTC to 2027-02-07 00:06 UTC
    Logged 2026-11-09 01:04 UTC in Google PlumbersArms2027h1, entry 688,104,250
    SHA-256 8e85d5ca015359689b5517bedae11f01044765167bc187e864f6c0fd6339d489
    Public key SHA-256 9f12dd56d12c80b667889a4ae8f2ca5aeb6760a6a62e196c0d45198358da2cbb
    PhishDestroy
    Addresses
    163.61.188.7 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    rockstarlimitedpro.com
    MX
    Receives mail at rockstarlimitedpro.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server rockstarlimitedpro.com at 163.61.188.7 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.7 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-09 01:09 UTC

    Suggest a correction

  90. app-commander.com US · AS54113 · Fastly, Inc.4 addresses
    ListedFastlyListed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    app-commander.com
    First seen
    2026-11-09 01:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 23:59 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-09 00:58 UTC in Let's Encrypt Willow2027h1, entry 1,021,831,357
    SHA-256 c8e1487ece7dd81588e5f6d5c9f8e68887de9dbef777a771510b7bed2f2e9a63
    Public key SHA-256 0d073b9b73b4b0ee16e3f580e521c7b6c7aa20a48a764a758e1b31dff5043d90
    Addresses
    185.199.108.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.109.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.110.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.111.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    app-commander.com
    MX
    Receives mail at route3.mx.cloudflare.net, route2.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:04 UTC

    Suggest a correction

  91. blosk.io US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    blosk.io
    First seen
    2026-11-09 01:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-08 23:59 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-09 00:58 UTC in Let's Encrypt Willow2027h1, entry 1,021,837,783
    SHA-256 f5d12692c936197996027ce5667221d886a43cdb159a2bcd7ceccedd6c066d63
    Public key SHA-256 e754b4cb2892ade5a0da2d46dd408b3a11d3b26e1a566857bdac109ccfd7f38d
    Addresses
    104.21.16.156 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.156, 172.67.213.172): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    blosk.io
    Registered
    2024-11-04 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:59 UTC

    Suggest a correction

  92. chicagobuzz.net US · AS32244 · Liquid Web, L.L.C
    ReportedReported by PhishTankMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    chicagobuzz.net
    First seen
    2026-11-09 01:00 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 01:12 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 23:58 UTC to 2027-02-06 23:58 UTC
    Logged 2026-11-09 00:57 UTC in Google PlumbersArms2027h1, entry 688,010,063
    SHA-256 2cd1cb66c88c953714443787b855c375bc961ad94947ca789495cd7e950ae23b
    Public key SHA-256 290d48e57bea94c95365a7b279af256e6fbc2b5c3ae69df8c4197c114a6565a2
    PhishTank
    PhishTank report #9482015
    Addresses
    67.225.133.94 · United States · AS32244 LIQUIDWEB - Liquid Web, L.L.C
    Domain
    chicagobuzz.net
    MX
    Receives mail at mail.chicagobuzz.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:04 UTC

    Suggest a correction

  93. listener.aurum.foundation US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder aurum.foundation, listed by FSMA (cryptocurrency fraud)MX presentSPF -allDMARC policy noneRegistered 2 y ago
    DetailsHide
    Hostname
    listener.aurum.foundation
    First seen
    2026-11-09 01:00 UTC
    Listing
    FSMA warned about it 2026-07-06 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 21:43 UTC
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    FSMA, listing aurum.foundation and the names under it
    1. Warning by FSMA
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 23:57 UTC to 2027-02-07 00:57 UTC
    Logged 2026-11-09 00:57 UTC in Google PlumbersArms2027h1, entry 688,011,952
    SHA-256 2d75c5df62db827349cd336ec4a2b9d2c375bab357dc4340a987f7b506b8cd93
    Public key SHA-256 1862c5443310e9d63593f46963776de29b38d894943bdff8cc4c65eeb1ff97e3
    Addresses
    104.21.38.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.38.184, 172.67.137.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aurum.foundation
    Registered
    2024-08-01 · NameCheap, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 05:15 UTC

    Suggest a correction

  94. polymarketapp.info US · AS62468 · VpsQuan L.L.C.Polymarket
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    polymarketapp.info
    First seen
    2026-11-09 01:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.165.75.129.
    1. Phishing-host list fetched with the address
    2. Resolved to 69.165.75.129
    Certificate
    Issued by YR2
    Valid 2026-11-08 23:59 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-09 00:58 UTC in Google ParcelYard2027h1, entry 687,729,596
    SHA-256 0798b849434250dbf691fffbb259052453bc30c80ac50ba211adbb66ba488d9c
    Public key SHA-256 c716e7c3d53c53fcf09dcf0a19d384d61a16517f815a2ccb0a49e02b7f754238
    Brand
    Polymarket
    Addresses
    69.165.75.129 · United States · AS62468 HKCLOUDX - VpsQuan L.L.C.
    Domain
    polymarketapp.info
    Registered
    2026-06-29 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:04 UTC

    Suggest a correction

  95. teams9web.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    teams9web.com
    First seen
    2026-11-09 01:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-08 23:56 UTC to 2027-02-07 00:54 UTC
    Logged 2026-11-09 00:56 UTC in Let's Encrypt Willow2027h1, entry 1,021,779,379
    SHA-256 3488a947a451cdf8b78b98e966afc4b9bd7102ffa32a7a1d8a6ac495824371c3
    Public key SHA-256 e4a3a4e82dbd2b8c548c9d3efc82947149b12888675ce1e1215882ba0d9ef3e9
    Addresses
    104.21.50.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.206.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.50.143, 172.67.206.254): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    teams9web.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:04 UTC

    Suggest a correction

  96. tslatlsstock.com US · AS32561 · Aquiryn LLC
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    tslatlsstock.com
    First seen
    2026-11-09 01:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 23:59 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-09 00:57 UTC in Geomys Tuscolo2027h1, entry 535,949,156
    SHA-256 26ed33f6f36b56415e0ee8d6d46d04a6698377cf4934bfcad37c8d60b338079c
    Public key SHA-256 5c777aeb68a5c65adae93f9c26958910a43b29e8a9781455e573668a93e08622
    PhishDestroy
    Addresses
    23.153.104.17 · United States · AS32561 AQUIRYN-LLC - Aquiryn LLC
    Domain
    tslatlsstock.com
    MX
    Receives mail at tslatlsstock.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 01:04 UTC

    Suggest a correction

  97. universalsavefinance.com US · AS32561 · Aquiryn LLC
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    universalsavefinance.com
    First seen
    2026-11-09 01:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 00:01 UTC to 2027-02-07 00:01 UTC
    Logged 2026-11-09 00:59 UTC in IPng Networks Halloumi2027h1, entry 418,739,147
    SHA-256 3c140ab6b14d45b4b971d667308f4d44382bf86a8f15f2afe9705d05a775a738
    Public key SHA-256 77adb7e88df633f45ba45feabb8d148e2f3e8abc6a1dae4acd0a06ec9e8c818a
    PhishDestroy
    Addresses
    23.153.104.17 · United States · AS32561 AQUIRYN-LLC - Aquiryn LLC
    Domain
    universalsavefinance.com
    MX
    Receives mail at universalsavefinance.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 01:04 UTC

    Suggest a correction

  98. user.indexprotraders.com AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicUnder indexprotraders.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 18 mo ago
    DetailsHide
    Hostname
    user.indexprotraders.com
    First seen
    2026-11-09 01:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing indexprotraders.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 23:58 UTC to 2027-02-06 23:58 UTC
    Logged 2026-11-09 00:56 UTC in Google PlumbersArms2027h1, entry 688,006,350
    SHA-256 47bf13ab31b731348ed14e6b487f175a34cf77220527d7aae95087780b736d98
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.241 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates indexprotraders.com to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.241): a parking service. It answers for names that are typically for sale or unused.
    Domain
    indexprotraders.com
    Registered
    2025-05-11 · Dynadot Inc
    MX
    Receives mail at mx156.hostedmxserver.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  99. www.app-commander.com US · AS54113 · Fastly, Inc.4 addresses
    ListedFastlyUnder app-commander.com, listed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.app-commander.com
    First seen
    2026-11-09 01:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-08 23:59 UTC
    Listed
    MetaMask, listing app-commander.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-08 23:59 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-09 00:58 UTC in Let's Encrypt Willow2027h1, entry 1,021,831,357
    SHA-256 c8e1487ece7dd81588e5f6d5c9f8e68887de9dbef777a771510b7bed2f2e9a63
    Public key SHA-256 0d073b9b73b4b0ee16e3f580e521c7b6c7aa20a48a764a758e1b31dff5043d90
    Addresses
    185.199.108.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.109.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.110.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.111.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    app-commander.com
    MX
    Receives mail at route3.mx.cloudflare.net, route2.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 01:04 UTC

    Suggest a correction

  100. www.defiaeth.com US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder defiaeth.com, reported by PhishDestroyMX absentSPF missingDMARC quarantineRegistered 13 mo ago
    DetailsHide
    Hostname
    www.defiaeth.com
    First seen
    2026-11-09 01:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-08 23:58 UTC
    Reported
    PhishDestroy, listing defiaeth.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-09 00:57 UTC to 2027-05-26 00:57 UTC
    Logged 2026-11-09 00:57 UTC in GoDaddy Aquamarine2027h1, entry 198,147,325
    SHA-256 76a45d93620ad35f48fc6dcc68fb3a0fdeeaab1c0a504d2c997bfe3a8ee52cc3
    Public key SHA-256 eb0621914b458d569c6f339f397f40e49740455048aaf714128571fcdb04008d
    PhishDestroy
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    defiaeth.com
    Registered
    2025-10-24 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-08 08:26 UTC

    Suggest a correction

Showing 1–100 of 4,828 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources