Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-09 06:10 UTC
Certificate-log entries · 24 h
368.6M
from 84 distinct feeds
Unique certificates · 24 h
34.8M
each reviewed
Names resolved · 24 h
21.9M
16.6M with an address
Findings · 24 h
5,855
200 of 1,061 brands targeted

5,855 hostnames from the last 24 hours.

  1. www.blac.tradecradle.com FR · AS16276 · OVH OVH SAS
    ReportedOVHUnder tradecradle.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.blac.tradecradle.com
    First seen
    2026-11-09 05:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing tradecradle.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 04:38 UTC to 2027-02-07 04:38 UTC
    Logged 2026-11-09 05:36 UTC in Let's Encrypt Sycamore2027h1, entry 1,073,169,469
    SHA-256 49b08bb440facf5f726fc02fbc3de3f8e413242376d0b8e19790935b1d725915
    Public key SHA-256 19470a3dc6bda0748eb22265f073129d1157feeadd92c4b32932ef6b8f648915
    PhishDestroy
    Addresses
    51.38.123.251 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.38.123.251): a cloud provider. It rents servers and addresses to its customers.
    Domain
    tradecradle.com
    Registered
    2026-09-08 · Dominet (HK) Limited
    MX
    Receives mail at tradecradle.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:50 UTC

    Suggest a correction

  2. yukafilorent.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    yukafilorent.com
    First seen
    2026-11-09 05:41 UTC
    Listing
    USOM listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 05:40 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:37 UTC to 2027-02-07 05:35 UTC
    Logged 2026-11-09 05:37 UTC in Let's Encrypt Sycamore2027h1, entry 1,073,185,422
    SHA-256 2fec3b3e9bff4ede94e3e6ff2ee80d8ca2f4a94612b94e542e27c93af89418a6
    Public key SHA-256 b73cb412fd796443acd7ce95cd0b66ec00efd969f6c55d4133c7d080b994394b
    Addresses
    104.21.68.212 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.198.170 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.212, 172.67.198.170): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    yukafilorent.com
    Registered
    2026-08-24 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  3. app-jtx.trade US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    app-jtx.trade
    First seen
    2026-11-09 05:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:34 UTC to 2027-02-07 05:31 UTC
    Logged 2026-11-09 05:35 UTC in Google ParcelYard2027h1, entry 691,559,864
    SHA-256 0d0976fefc90115d4d67d28b4c7c4a8ef02e087668702e3843ff86f772c9bba1
    Public key SHA-256 0c9894828205ee8dbffc19d781255d546114b6a41638e8d2fb1ef190ad1fb92a
    PhishDestroy
    Addresses
    104.21.91.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.179.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.206, 172.67.179.90): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    app-jtx.trade
    Registered
    2026-07-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  4. casino-vave1.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    casino-vave1.com
    First seen
    2026-11-09 05:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:30 UTC to 2027-02-07 05:30 UTC
    Logged 2026-11-09 05:30 UTC in IPng Networks Gouda2027h1, entry 360,948,687
    SHA-256 628e0f38fc0ea9dd5b75fc57f8e96351ea2c5346ed0e34e4a999e32605b7fa0b
    Public key SHA-256 3ca0802c7450e7a431cba6d272ea2c5c0b8177f16513df78e5fed6abc4a5c102
    PhishDestroy
    Addresses
    104.21.4.150 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.4.150, 172.67.154.50): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    casino-vave1.com
    Registered
    2026-02-12 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  5. docsend.in US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    docsend.in
    First seen
    2026-11-09 05:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:30 UTC to 2027-02-07 05:26 UTC
    Logged 2026-11-09 05:30 UTC in IPng Networks Gouda2027h1, entry 360,946,506
    SHA-256 6ea5b72229b3eef80a1796b5b9495872368c5159337d2bd4417a005ba39c7f7e
    Public key SHA-256 f18c8ad4d9d367ac3cef4e66e1a244a44e00c5d7ae1d9e488ce0c6db87fb43ba
    Addresses
    104.21.8.156 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.8.156, 172.67.188.142): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    docsend.in
    Registered
    2026-07-13 · Web Commerce Communications Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  6. hjbdx.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    hjbdx.store
    First seen
    2026-11-09 05:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:31 UTC to 2027-02-07 04:31 UTC
    Logged 2026-11-09 05:30 UTC in Google PlumbersArms2027h1, entry 691,783,222
    SHA-256 6d69101b4144a6bea077cbf1fa28df66f62f2283c6cb58ad828c8054bb7504a9
    Public key SHA-256 62d9ecc39db9c8b56f80d5626d342f8184f821683105dde26dd996aff8f92999
    Addresses
    104.21.43.245 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.190.166 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.43.245, 172.67.190.166): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hjbdx.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  7. pnuvelbar-romania.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    pnuvelbar-romania.com
    First seen
    2026-11-09 05:36 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:34 UTC to 2027-02-07 05:32 UTC
    Logged 2026-11-09 05:35 UTC in Sectigo Statue2027h1, entry 102,084,340
    SHA-256 c04faa3bbfcd1b954a242bbf6e8c4644c27198e3eb79cfa80536d52d4eea98b1
    Public key SHA-256 126d70668ef0350e45926653f9610a64fccf54060e014e9eba31df3ed93cb3ce
    Addresses
    104.21.50.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.215.2 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.50.242, 172.67.215.2): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pnuvelbar-romania.com
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  8. teveflorx.click US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    teveflorx.click
    First seen
    2026-11-09 05:36 UTC
    Listing
    CERT Polska listed it 2026-05-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:36 UTC to 2027-02-07 04:36 UTC
    Logged 2026-11-09 05:34 UTC in Geomys Tuscolo2027h1, entry 539,526,627
    SHA-256 93b12d384d2c1fe7dd4af19041903c3f6b42aac9878a400287a9c6934e4e7c49
    Public key SHA-256 5e82f7de7fe9551b3b8a9864f05e1597ced42defe5dd67ad777eadc6d52d4325
    Addresses
    104.21.85.140 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.206.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.85.140, 172.67.206.112): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    teveflorx.click
    Registered
    2026-05-15 · Chengdu West Dimension Digital Technology Co., LTD
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  9. theboursa-ai.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    theboursa-ai.com
    First seen
    2026-11-09 05:36 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:31 UTC to 2027-02-07 05:30 UTC
    Logged 2026-11-09 05:31 UTC in Let's Encrypt Willow2027h1, entry 1,028,904,449
    SHA-256 6dd8eeab55b65421deda1d7b7825fd9444632e9075b9cba24c548c60f5a6c595
    Public key SHA-256 27d40399a481259a22a938875e7e0b921db076cca0604dd3b11ad29aca8ee918
    Addresses
    104.21.52.235 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.115 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.52.235, 172.67.205.115): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    theboursa-ai.com
    Registered
    2026-01-17 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  10. tradequantummarkets.com US · AS53667 · FranTech Solutions
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    tradequantummarkets.com
    First seen
    2026-11-09 05:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 04:33 UTC to 2027-02-07 04:33 UTC
    Logged 2026-11-09 05:31 UTC in Let's Encrypt Willow2027h1, entry 1,028,913,306
    SHA-256 2afea406b5b6e8f3f027fafab74b2db652f2d107298aa36f897a0b14071ea53d
    Public key SHA-256 9659d192eb2e9bc50959f620f92f625c8602791c8a8847e26d359898292310d4
    PhishDestroy
    Addresses
    198.251.84.200 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    tradequantummarkets.com
    Registered
    2026-09-08 · Dominet (HK) Limited
    MX
    Receives mail at tradequantummarkets.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  11. we8uv.beer US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    we8uv.beer
    First seen
    2026-11-09 05:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:33 UTC to 2027-02-07 04:33 UTC
    Logged 2026-11-09 05:31 UTC in Google ParcelYard2027h1, entry 691,517,375
    SHA-256 9f9427944cbd75e17269474c2547dc93d9befc83e5525558231ed36ff97f899e
    Public key SHA-256 c1b7d9cd9dc8595137ded5ac7f8d84b08d3114089203111921e5af6ce1436021
    Addresses
    104.21.24.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.123 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.24.25, 172.67.216.123): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    we8uv.beer
    Registered
    2026-03-17 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  12. www.app.tradequantummarkets.com US · AS53667 · FranTech Solutions
    ReportedUnder tradequantummarkets.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    www.app.tradequantummarkets.com
    First seen
    2026-11-09 05:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing tradequantummarkets.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 04:33 UTC to 2027-02-07 04:33 UTC
    Logged 2026-11-09 05:31 UTC in Let's Encrypt Willow2027h1, entry 1,028,913,306
    SHA-256 2afea406b5b6e8f3f027fafab74b2db652f2d107298aa36f897a0b14071ea53d
    Public key SHA-256 9659d192eb2e9bc50959f620f92f625c8602791c8a8847e26d359898292310d4
    PhishDestroy
    Addresses
    198.251.84.200 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    tradequantummarkets.com
    Registered
    2026-09-08 · Dominet (HK) Limited
    MX
    Receives mail at tradequantummarkets.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  13. www.fencecontractors.org US · AS13335 · Cloudflare, Inc.
    ReportedCloudflareUnder fencecontractors.org, reported by PhishDestroyMX absentSPF missingDMARC quarantineRegistered 2 y ago
    DetailsHide
    Hostname
    www.fencecontractors.org
    First seen
    2026-11-09 05:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing fencecontractors.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 23:06 UTC to 2026-12-10 00:06 UTC
    Logged 2026-11-09 05:30 UTC in Let's Encrypt Sycamore2026h2, entry 1,087,820,408
    SHA-256 6836c0c5be161c3f24a57be5b7fc76f7548d02c7ee71d020337aca6a89531b77
    Public key SHA-256 82afaa825f52e6f88267ef1670e366a00a312ffcf6e7053dc84b0536da3d83f8
    PhishDestroy
    Addresses
    185.158.133.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (185.158.133.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fencecontractors.org
    Registered
    2024-07-15 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-08 20:13 UTC

    Suggest a correction

  14. www.master.tradequantummarkets.com US · AS53667 · FranTech Solutions
    ReportedUnder tradequantummarkets.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    www.master.tradequantummarkets.com
    First seen
    2026-11-09 05:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing tradequantummarkets.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 04:33 UTC to 2027-02-07 04:33 UTC
    Logged 2026-11-09 05:31 UTC in Let's Encrypt Willow2027h1, entry 1,028,913,306
    SHA-256 2afea406b5b6e8f3f027fafab74b2db652f2d107298aa36f897a0b14071ea53d
    Public key SHA-256 9659d192eb2e9bc50959f620f92f625c8602791c8a8847e26d359898292310d4
    PhishDestroy
    Addresses
    198.251.84.200 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    tradequantummarkets.com
    Registered
    2026-09-08 · Dominet (HK) Limited
    MX
    Receives mail at tradequantummarkets.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  15. pay.sberbank.youla.pay.yandex.youla.3x8cd8k5y5do15euod163a0t6.winplus-cctv.com US · AS46844 · Sharktech2 addressesYandex+2
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 y ago
    DetailsHide
    Hostname
    pay.sberbank.youla.pay.yandex.youla.3x8cd8k5y5do15euod163a0t6.winplus-cctv.com
    First seen
    2026-11-09 05:34 UTC
    First published
    2026-11-09 05:29 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 208.98.40.40.
    1. Phishing-host list fetched with the address
    2. Resolved to 208.98.40.40
    Brands
    Yandex, Sberbank, Youla
    Addresses
    208.98.40.40 · United States · AS46844 SHARKTECH - Sharktech
    208.98.40.230 · United States · AS46844 SHARKTECH - Sharktech
    Domain
    winplus-cctv.com
    Registered
    2019-10-08 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 00:53 UTC

    Suggest a correction

  16. files.myprotondrive.com FR · AS16276 · OVH OVH SASProton
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 21 mo ago
    DetailsHide
    Hostname
    files.myprotondrive.com
    First seen
    2026-11-09 05:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.255.139.193.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 51.255.139.193
    Certificate
    Issued by YR1
    Valid 2026-11-09 04:22 UTC to 2027-02-07 04:22 UTC
    Logged 2026-11-09 05:20 UTC in Google PlumbersArms2027h1, entry 691,658,445
    SHA-256 1c66ab02d0987104c7b9bca09668520823b0b83f8ba419db092edb60a63dbc3e
    Public key SHA-256 821c484adbb2528c405442247aca16b4634f63838afb1cf36fe2ce7372570ffe
    Brand
    Proton
    Addresses
    51.255.139.193 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.255.139.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    myprotondrive.com
    Registered
    2025-02-20 · Internet Domain Service BS Corp
    MX
    Receives mail at mail.myprotondrive.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  17. dashboard.thecircleapp.us US · AS54113 · Fastly, Inc.
    ListedFastlyListed by MetaMaskMX presentSPF -allDMARC quarantineRegistered 14 mo ago
    DetailsHide
    Hostname
    dashboard.thecircleapp.us
    First seen
    2026-11-09 05:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3
    Valid 2026-09-10 23:32 UTC to 2026-12-10 00:31 UTC
    Logged 2026-11-09 05:26 UTC in DigiCert Wyvern2026h2, entry 2,213,704,280
    SHA-256 4028882bc0f57c5da375b4dabd8f843f7877583f94247492ba7e5460fb2e0734
    Public key SHA-256 6b81681f2127b0585ab88c74c3f801ef2c2c943ead58693cdc9d85e8fbf5a610
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    thecircleapp.us
    Registered
    2025-09-08 · GoDaddy.com, LLC
    MX
    Receives mail at thecircleapp-us.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  18. directory.1doc-shop.com AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder 1doc-shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    directory.1doc-shop.com
    First seen
    2026-11-09 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing 1doc-shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 04:28 UTC to 2027-02-07 04:28 UTC
    Logged 2026-11-09 05:27 UTC in Let's Encrypt Willow2027h1, entry 1,028,803,066
    SHA-256 3d1e75831fcab6d12f644ef1f2d16732ab1acc07025f697f1df3bf5e43c5f8df
    Public key SHA-256 6c1c12777e86cc9f4ca2c51ee48cdf70182662d51e8f31ee306a736006fa8af0
    PhishDestroy
    Addresses
    186.2.175.208 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    1doc-shop.com
    Registered
    2026-05-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  19. hxeywt.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    hxeywt.shop
    First seen
    2026-11-09 05:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:27 UTC to 2027-02-07 04:27 UTC
    Logged 2026-11-09 05:26 UTC in IPng Networks Halloumi2027h1, entry 421,913,340
    SHA-256 72f84c388e6d87bd4f071aca92cadf11353f81412704bdd39b9e9fb5fbad5730
    Public key SHA-256 fe4848016b766c1c7a88aff65b0755689027b1a393845750a6862b4a60ca6e6e
    Addresses
    104.21.44.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.238 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.44.72, 172.67.196.238): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hxeywt.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:32 UTC

    Suggest a correction

  20. subbdtoken.site US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    subbdtoken.site
    First seen
    2026-11-09 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:29 UTC to 2027-02-07 05:27 UTC
    Logged 2026-11-09 05:29 UTC in HARICA Selene2027h1, entry 61,087,561
    SHA-256 6a6dd4767e9f3c13ce6ce91552d2844c88d7baa29f6e0718b39484efddb0b609
    Public key SHA-256 c7c12199806d8efbbf3994480a75311d1e28189bdc7078b155ed17c29490f919
    PhishDestroy
    Addresses
    104.21.11.128 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.166.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.11.128, 172.67.166.30): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    subbdtoken.site
    Registered
    2025-11-19 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  21. tevewavro.wiki US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tevewavro.wiki
    First seen
    2026-11-09 05:31 UTC
    Listing
    CERT Polska listed it 2026-08-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:29 UTC to 2027-02-07 04:29 UTC
    Logged 2026-11-09 05:28 UTC in IPng Networks Gouda2027h1, entry 360,928,290
    SHA-256 70cac7e93da8970f1ba36a1c50916337802de3d965577675a2a057cc612a7f2c
    Public key SHA-256 4cb852e67673a6b9fbb69efba3ccefb2c74b05d1f02fe9687118fe3f53c2f208
    Addresses
    104.21.21.210 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.200.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.21.210, 172.67.200.89): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevewavro.wiki
    Registered
    2026-05-15 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  22. vfqga.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    vfqga.store
    First seen
    2026-11-09 05:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:28 UTC to 2027-02-07 04:28 UTC
    Logged 2026-11-09 05:26 UTC in Google ParcelYard2027h1, entry 691,453,353
    SHA-256 10edb8542afe1462618f9f605b0c2ac79a31bfb21311192030f2d11d6be1a946
    Public key SHA-256 2af608625ac05dc3a85d31026d8e14958146dc030657b351da5c715e670e0486
    Addresses
    104.21.59.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.219.28 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.59.82, 172.67.219.28): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vfqga.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  23. www.growbotgarden.com US · AS54600 · PEG TECH INC
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    www.growbotgarden.com
    First seen
    2026-11-09 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:31 UTC to 2027-02-07 04:31 UTC
    Logged 2026-11-09 05:30 UTC in Geomys Tuscolo2027h1, entry 539,474,128
    SHA-256 728cccf8a71d3bc3897075c30f40cde198b4dc69097dae5d1afe14475598bcc4
    Public key SHA-256 ae9ab1be2df7cf0df58f04079441a05cb668de29b414b85ee4bed36b978d821e
    PhishDestroy
    Addresses
    38.33.217.5 · United States · AS54600 PEG-SV - PEG TECH INC
    Domain
    growbotgarden.com
    Registered
    2026-11-08 · CV. Rumahweb Indonesia
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  24. www.maerkscargo.com.globalcapitalwealth.com US · AS20473 · The Constant Company, LLC
    ListedVultrUnder globalcapitalwealth.com, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 20 mo ago
    DetailsHide
    Hostname
    www.maerkscargo.com.globalcapitalwealth.com
    First seen
    2026-11-09 05:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-05 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask, listing globalcapitalwealth.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 04:27 UTC to 2027-02-07 04:27 UTC
    Logged 2026-11-09 05:26 UTC in Google ParcelYard2027h1, entry 691,445,054
    SHA-256 11a4c6b1108a6b875d4324487699d3422c5af960bb8e81604658fe41e835038c
    Public key SHA-256 070f299b1212e6942120b01ef55b35878c42cf55f8dd068dea0b493330ab27f7
    Addresses
    139.180.187.142 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    Vultr
    Vultr (139.180.187.142): a cloud provider. It rents servers and addresses to its customers.
    Domain
    globalcapitalwealth.com
    Registered
    2025-03-15 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Receives mail at globalcapitalwealth.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 23:47 UTC

    Suggest a correction

  25. 33ysb8.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    33ysb8.com
    First seen
    2026-11-09 05:25 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:25 UTC to 2027-02-07 04:25 UTC
    Logged 2026-11-09 05:24 UTC in Google PlumbersArms2027h1, entry 691,704,658
    SHA-256 5698042b56b9f7732f637c66b157e0c0e3fc0feea7109cca923158d46f470592
    Public key SHA-256 884876b9ced62a735d282fdd4b6f12b1e682d01d5adf82e3861274e1e286aec5
    PhishDestroy
    Addresses
    104.21.55.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.55.118, 172.67.147.254): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    33ysb8.com
    Registered
    2026-03-18 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  26. casino-shiny-wilds2.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    casino-shiny-wilds2.com
    First seen
    2026-11-09 05:25 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:21 UTC to 2027-02-07 05:21 UTC
    Logged 2026-11-09 05:21 UTC in Geomys Tuscolo2027h1, entry 539,367,041
    SHA-256 59e006bab29ef6b080ffebd0562dc92d87f220d55adba7e994f02a663740cda1
    Public key SHA-256 9b21e13b7fb9881b716242a4fdeca387d27aba832e7259d92685cad5da964e78
    PhishDestroy
    Addresses
    104.21.37.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.203.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.37.25, 172.67.203.74): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    casino-shiny-wilds2.com
    Registered
    2026-02-12 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  27. cwpab.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    cwpab.store
    First seen
    2026-11-09 05:25 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:22 UTC to 2027-02-07 04:22 UTC
    Logged 2026-11-09 05:21 UTC in Google PlumbersArms2027h1, entry 691,663,004
    SHA-256 298192b27f32c73f3fe12b2be708c2b0d40069edc9409e141e77a36a79ddef44
    Public key SHA-256 752a181217e4918c75dea9f824c8008f0e2d9ea126bf06b242c3fe0bc0558d89
    Addresses
    104.21.20.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.47 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.20.159, 172.67.193.47): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cwpab.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  28. inj.crushxp.com GB · AS201738 · UFO-TECHNOLOGIES-LIMITED UF…
    ListedUnder crushxp.com, listed by CERT PolskaMX absentSPF -allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    inj.crushxp.com
    First seen
    2026-11-09 05:25 UTC
    Listing
    CERT Polska listed it 2026-06-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    PhishDestroy: first observed in the feed 2026-10-26 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Listed
    CERT Polska, listing crushxp.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:24 UTC to 2027-02-07 04:24 UTC
    Logged 2026-11-09 05:23 UTC in Let's Encrypt Sycamore2027h1, entry 1,072,809,837
    SHA-256 4bb7e93411f8712bc11026cba4239ad631bad985bc1ce93f8e7e3ff02f4fcc4b
    Public key SHA-256 dbcb7db2a57d4cb17d8e8eefbc24ae11204be31caffe3410c4840f3337e0afa2
    Addresses
    109.238.86.5 · United Kingdom · AS201738 UFO-TECHNOLOGIES-LIMITED UFO TECHNOLOGIES LIMITED
    Domain
    crushxp.com
    Registered
    2023-02-15 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:33 UTC

    Suggest a correction

  29. instander.in US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    instander.in
    First seen
    2026-11-09 05:25 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-26 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:26 UTC to 2027-02-07 04:26 UTC
    Logged 2026-11-09 05:24 UTC in DigiCert Wyvern2027h1, entry 463,824,737
    SHA-256 96358d01cb39e3ab193719db46e061b9a1b8475deb99fc271e00c804f4eba855
    Public key SHA-256 ef03d5e3169f0093ad9b917889205e22b95234500adbcf4a4aacf3848f760ddb
    PhishDestroy
    Addresses
    104.21.11.80 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.169 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.11.80, 172.67.165.169): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    instander.in
    Registered
    2026-09-10 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:32 UTC

    Suggest a correction

  30. pnuvelbar-spain.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    pnuvelbar-spain.com
    First seen
    2026-11-09 05:25 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:20 UTC to 2027-02-07 05:19 UTC
    Logged 2026-11-09 05:21 UTC in Let's Encrypt Sycamore2027h1, entry 1,072,749,100
    SHA-256 d6152f73cf9bbba2b77bdb44aad64bd71ae60abe6240d7493069fd286a48a9c9
    Public key SHA-256 9f4cd3aa71369c7f59d10cb268a69c542ae78b30a92797cfb488132deed32d91
    Addresses
    104.21.32.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.151.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.32.122, 172.67.151.213): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pnuvelbar-spain.com
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  31. rugpull-pump.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    rugpull-pump.com
    First seen
    2026-11-09 05:25 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 04:23 UTC to 2027-02-07 04:23 UTC
    Logged 2026-11-09 05:22 UTC in Google ParcelYard2027h1, entry 691,391,474
    SHA-256 9052f1458e8cc051a5d1fc4c6c1e22f36c7603af3cc2ff826a8be5cb8d7890fb
    Public key SHA-256 810005f4e87400be81124abd9d12ee205e8f07bc6671ff56d9c7a97131602bb9
    PhishDestroy
    Addresses
    104.21.11.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.166.37 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.11.139, 172.67.166.37): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rugpull-pump.com
    Registered
    2026-03-15 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  32. sr-php.crushxp.com GB · AS201738 · UFO-TECHNOLOGIES-LIMITED UF…
    ListedUnder crushxp.com, listed by CERT PolskaMX absentSPF -allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    sr-php.crushxp.com
    First seen
    2026-11-09 05:25 UTC
    Listing
    CERT Polska listed it 2026-06-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    PhishDestroy: first observed in the feed 2026-10-26 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Listed
    CERT Polska, listing crushxp.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:24 UTC to 2027-02-07 04:24 UTC
    Logged 2026-11-09 05:23 UTC in DigiCert Sphinx2027h1, entry 410,643,865
    SHA-256 45675f985ffe13ccd7355705ad79d29a4c37605d3a2509feec6d6e8753044b62
    Public key SHA-256 d8c5709ed4bf3a7018933b19f2e81a9630d21298d93c3b58c6005e4be35f4441
    Addresses
    109.238.86.5 · United Kingdom · AS201738 UFO-TECHNOLOGIES-LIMITED UFO TECHNOLOGIES LIMITED
    Domain
    crushxp.com
    Registered
    2023-02-15 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:33 UTC

    Suggest a correction

  33. tenmh.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    tenmh.store
    First seen
    2026-11-09 05:25 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:25 UTC to 2027-02-07 04:25 UTC
    Logged 2026-11-09 05:23 UTC in Google ParcelYard2027h1, entry 691,409,862
    SHA-256 77cbe3a262a68d791879c26af2e51535f90b214e2383d195875d4197212c866f
    Public key SHA-256 e866bf19722eec10a71defb6fa4736dfd71530cf522c789616016ae42ea87e49
    Addresses
    104.21.62.57 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.220.109 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.57, 172.67.220.109): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tenmh.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  34. www.puntonexus.com US · AS13335 · Cloudflare, Inc.
    ReportedCloudflareUnder puntonexus.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    www.puntonexus.com
    First seen
    2026-11-09 05:25 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing puntonexus.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:23 UTC to 2027-02-07 05:22 UTC
    Logged 2026-11-09 05:23 UTC in DigiCert Wyvern2027h1, entry 463,807,444
    SHA-256 795db537f3e9613406b83ff23b3fb735eb3fbca0d783eba21ce0350ca7c8f27f
    Public key SHA-256 e601767b699cd36ffb742649ad6213177a819a2a239a523adb6fcc2fc81cd5fd
    PhishDestroy
    Addresses
    23.227.38.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (23.227.38.74): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    puntonexus.com
    Registered
    2025-11-19 · Metaregistrar BV
    MX
    Receives mail at mx1.titan.email, mx2.titan.email
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 03:09 UTC

    Suggest a correction

  35. www.myservicenow.net SG · AS63949 · Akamai Connected Cloud3 addressesServiceNow
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.myservicenow.net
    First seen
    2026-11-09 05:22 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:13 UTC to 2027-02-07 04:13 UTC
    Logged 2026-11-09 05:12 UTC in Google ParcelYard2027h1, entry 691,238,588
    SHA-256 0c65446c71951af6a0184885d6f597d2fdf1eae5baed7102301648ffd39764b9
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    ServiceNow
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    myservicenow.net
    Registered
    2026-06-17 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  36. avito.ozon.sberbank.yandex.pay.3x8cd8k5y5do15euod163a0t6.winplus-cctv.com US · AS46844 · SharktechYandex+2
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 y ago
    DetailsHide
    Hostname
    avito.ozon.sberbank.yandex.pay.3x8cd8k5y5do15euod163a0t6.winplus-cctv.com
    First seen
    2026-11-09 05:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 208.98.40.35.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 208.98.40.35
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:17 UTC to 2027-02-07 04:17 UTC
    Logged 2026-11-09 05:16 UTC in Google ParcelYard2027h1, entry 691,307,357
    SHA-256 2046356337e34890d1ff19b66f24400c9be8fcf8a0f8be5a68bdf4c692936af6
    Public key SHA-256 3feb5d8aa86d81368aeef796e8b8ba878a3ddb072076950fc3a9cab31f3dc043
    Brands
    Yandex, Sberbank, Avito
    Addresses
    208.98.40.35 · United States · AS46844 SHARKTECH - Sharktech
    Domain
    winplus-cctv.com
    Registered
    2019-10-08 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 00:53 UTC

    Suggest a correction

  37. atxooetb.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    atxooetb.shop
    First seen
    2026-11-09 05:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 04:17 UTC to 2027-02-07 04:17 UTC
    Logged 2026-11-09 05:15 UTC in Google PlumbersArms2027h1, entry 691,588,697
    SHA-256 23a66eac42d22b45d979ab3bda74b4b8d2ee92ceba8bba0dad6a89a86a491f2a
    Public key SHA-256 ea47c0c99b8d6ed515673b97ec1eb370c851daa76a08bb53aeed582c01b8426e
    Addresses
    104.21.76.60 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.190.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.76.60, 172.67.190.82): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    atxooetb.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:32 UTC

    Suggest a correction

  38. dare.market US · AS16509 · Amazon.com, Inc.
    ReportedAmazon Web ServicesReported by PhishDestroyMX presentSPF ~allDMARC quarantineRegistered 3 y ago
    DetailsHide
    Hostname
    dare.market
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-08 10:18 UTC to 2027-01-06 10:18 UTC
    Logged 2026-11-09 05:16 UTC in DigiCert Wyvern2027h1, entry 463,737,515
    SHA-256 063062e6156bb17216ffdd96a8e2bedafdc014dedf899e9fb0f1283b93df0c51
    Public key SHA-256 363cf581a0aae104abf70bd7f40029cb96db17553cc1578e0260e27dfbab8237
    PhishDestroy
    Addresses
    76.76.21.21 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (76.76.21.21): a cloud provider. It rents servers and addresses to its customers.
    Domain
    dare.market
    Registered
    2024-05-08 · GoDaddy.com, LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-08 12:15 UTC

    Suggest a correction

  39. disseammin.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    disseammin.cyou
    First seen
    2026-11-09 05:20 UTC
    Listing
    CERT Polska listed it 2026-05-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:19 UTC to 2027-02-07 04:19 UTC
    Logged 2026-11-09 05:17 UTC in Google PlumbersArms2027h1, entry 691,621,044
    SHA-256 9033a814351708599e3a85d497d4f0e7123de2b6dd461c72e79cfd4da722947b
    Public key SHA-256 293525f676a05ec2c0178fb0f988325b499ceb68ba3db3011cc237cebf1a4de6
    Domain
    disseammin.cyou
    Registered
    2026-05-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  40. ervtn.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    ervtn.store
    First seen
    2026-11-09 05:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:20 UTC to 2027-02-07 04:20 UTC
    Logged 2026-11-09 05:19 UTC in Let's Encrypt Willow2027h1, entry 1,028,603,919
    SHA-256 0b27f12bc0ece95db64664916011f2077d7b41fef5038a65d4a84631ba29d92d
    Public key SHA-256 c0ca5c214c1667d43f6552a415346dd09de37c16905eb44d9e6f611ac5521534
    Addresses
    104.21.63.198 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.150.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.63.198, 172.67.150.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ervtn.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  41. ftp.koinzilloxinvest.com US · AS53667 · FranTech Solutions
    ReportedUnder koinzilloxinvest.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    ftp.koinzilloxinvest.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing koinzilloxinvest.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:18 UTC to 2027-02-07 04:18 UTC
    Logged 2026-11-09 05:16 UTC in Google ParcelYard2027h1, entry 691,319,488
    SHA-256 c3f96f1f763b229cc95319a09a061ff444bfd81de773572744a633bd03db72b9
    Public key SHA-256 0522762db1bed63ff90a906a539d07b2b3d2269cb3ac007e2d1e9f8112971e2e
    PhishDestroy
    Addresses
    198.251.84.236 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    koinzilloxinvest.com
    Registered
    2026-06-23 · Dynadot Inc
    MX
    Receives mail at mail.koinzilloxinvest.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  42. howlongtosave.com US · AS18978 · Enzu IncMercari
    ListedListed by JPCERT/CC as imitating メルカリMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    howlongtosave.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    JPCERT/CC confirmed it 2026-05-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 02:12 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:21 UTC to 2027-02-07 04:21 UTC
    Logged 2026-11-09 05:19 UTC in Google ParcelYard2027h1, entry 691,358,237
    SHA-256 87f264a6237b60cd571f024fbf758e701612286955deba8cba7354a5851c55a8
    Public key SHA-256 85ece1eb9c3c6da8ee7dcc2d99b23ce78af267a899be3c125c95b13cfd96894e
    Brand
    Mercari
    Addresses
    108.187.25.81 · United States · AS18978 ENZUINC-US - Enzu Inc
    Domain
    howlongtosave.com
    Registered
    2026-08-18 · GMO Internet Group, Inc. d/b/a Onamae.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  43. ingc.top US · AS16509 · Amazon.com, Inc.4 addresses
    ListedAmazon Web ServicesListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    ingc.top
    First seen
    2026-11-09 05:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 M01
    Valid 2025-12-09 00:00 UTC to 2027-01-07 23:59 UTC
    Logged 2026-11-09 05:15 UTC in IPng Networks Halloumi2027h1, entry 421,789,151
    SHA-256 911a83689d626d20ef94ae15bf549332fcb34163722912727cd344c475893f93
    Public key SHA-256 f63b5393d037d553998872cdc3b0504bd23b76e9f07d278f363ce3c8983c755e
    Addresses
    18.239.105.6 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.105.68 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.105.93 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.105.97 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (18.239.105.6, 18.239.105.68, 18.239.105.93, 18.239.105.97): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ingc.top
    Registered
    2025-11-10 · 阿里云计算有限公司
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  44. ishark.me US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    ishark.me
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:16 UTC to 2027-02-07 05:15 UTC
    Logged 2026-11-09 05:16 UTC in Let's Encrypt Sycamore2027h1, entry 1,072,614,850
    SHA-256 3308be2923bde22ccccc4c49536632d41e0a43f79c1336d7457b460a3d7b3501
    Public key SHA-256 2323e452f7e10bb23fbf94e783659a3a9d4da64ef52c84791af378e0d9b64873
    PhishDestroy
    Addresses
    104.21.66.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.117, 172.67.159.152): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ishark.me
    Registered
    2022-09-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  45. klclabaa.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    klclabaa.shop
    First seen
    2026-11-09 05:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:16 UTC to 2027-02-07 04:16 UTC
    Logged 2026-11-09 05:15 UTC in Let's Encrypt Sycamore2027h1, entry 1,072,571,987
    SHA-256 526d4e23711a9f09f00903d2681ac2a6b62f62a3b21da4703518583d67bf7155
    Public key SHA-256 e0e08927c3524630617d48c9d5dee13a8d70acf37504002423de42bcb6c28d33
    Addresses
    104.21.23.171 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.92 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.23.171, 172.67.212.92): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    klclabaa.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:32 UTC

    Suggest a correction

  46. koinzilloxinvest.com US · AS53667 · FranTech Solutions
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    koinzilloxinvest.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:18 UTC to 2027-02-07 04:18 UTC
    Logged 2026-11-09 05:16 UTC in Google ParcelYard2027h1, entry 691,319,488
    SHA-256 c3f96f1f763b229cc95319a09a061ff444bfd81de773572744a633bd03db72b9
    Public key SHA-256 0522762db1bed63ff90a906a539d07b2b3d2269cb3ac007e2d1e9f8112971e2e
    PhishDestroy
    Addresses
    198.251.84.236 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    koinzilloxinvest.com
    Registered
    2026-06-23 · Dynadot Inc
    MX
    Receives mail at mail.koinzilloxinvest.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  47. mail.koinzilloxinvest.com US · AS53667 · FranTech Solutions
    ReportedUnder koinzilloxinvest.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    mail.koinzilloxinvest.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing koinzilloxinvest.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:18 UTC to 2027-02-07 04:18 UTC
    Logged 2026-11-09 05:16 UTC in Google ParcelYard2027h1, entry 691,319,488
    SHA-256 c3f96f1f763b229cc95319a09a061ff444bfd81de773572744a633bd03db72b9
    Public key SHA-256 0522762db1bed63ff90a906a539d07b2b3d2269cb3ac007e2d1e9f8112971e2e
    PhishDestroy
    Addresses
    198.251.84.236 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    koinzilloxinvest.com
    Registered
    2026-06-23 · Dynadot Inc
    MX
    Receives mail at mail.koinzilloxinvest.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  48. pop.koinzilloxinvest.com US · AS53667 · FranTech Solutions
    ReportedUnder koinzilloxinvest.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    pop.koinzilloxinvest.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing koinzilloxinvest.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:18 UTC to 2027-02-07 04:18 UTC
    Logged 2026-11-09 05:16 UTC in Google ParcelYard2027h1, entry 691,319,488
    SHA-256 c3f96f1f763b229cc95319a09a061ff444bfd81de773572744a633bd03db72b9
    Public key SHA-256 0522762db1bed63ff90a906a539d07b2b3d2269cb3ac007e2d1e9f8112971e2e
    PhishDestroy
    Addresses
    198.251.84.236 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    koinzilloxinvest.com
    Registered
    2026-06-23 · Dynadot Inc
    MX
    Receives mail at mail.koinzilloxinvest.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  49. q3-monad.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    q3-monad.info
    First seen
    2026-11-09 05:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:19 UTC to 2027-02-07 05:17 UTC
    Logged 2026-11-09 05:19 UTC in DigiCert Sphinx2027h1, entry 410,603,333
    SHA-256 482a078431f4e0b5012a2630923575ca2afedc8c4ad4fccb39891927886322ab
    Public key SHA-256 c814ce4ce3c1c20f1fc9b74ee18357ab24ff58e49521ea6a425413a0e2ab9873
    Addresses
    104.21.22.127 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.9 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.22.127, 172.67.205.9): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    q3-monad.info
    Registered
    2026-07-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  50. quantum-ai-project-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    quantum-ai-project-com.financecryptoworld.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 23:34 UTC to 2026-12-10 00:34 UTC
    Logged 2026-11-09 05:18 UTC in IPng Networks Halloumi2026h2a, entry 1,294,227,080
    SHA-256 70264c9524a36eb072dde41492111b2c4eae8d817cb7ca07a25b84cc5e26522f
    Public key SHA-256 c70bb0e9e6e6f203da83ae63fab7749004810758b0138afab897540b0d396dd2
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  51. simsino-casino-enligne.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    simsino-casino-enligne.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:19 UTC to 2027-02-07 04:19 UTC
    Logged 2026-11-09 05:18 UTC in Geomys Tuscolo2027h1, entry 539,327,711
    SHA-256 0136a81e086643cd19e2164e95e30fe0b647f0530d36a9f521cf9e87b1d8474d
    Public key SHA-256 b52632885e64bda9d1f4f4d40a26134b5406130ccb4cb9c3c37cc4f11b60c4d3
    PhishDestroy
    Addresses
    104.21.77.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.155 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.77.172, 172.67.210.155): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    simsino-casino-enligne.com
    Registered
    2026-03-17 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:32 UTC

    Suggest a correction

  52. smtp.koinzilloxinvest.com US · AS53667 · FranTech Solutions
    ReportedUnder koinzilloxinvest.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    smtp.koinzilloxinvest.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing koinzilloxinvest.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:18 UTC to 2027-02-07 04:18 UTC
    Logged 2026-11-09 05:16 UTC in Google ParcelYard2027h1, entry 691,319,488
    SHA-256 c3f96f1f763b229cc95319a09a061ff444bfd81de773572744a633bd03db72b9
    Public key SHA-256 0522762db1bed63ff90a906a539d07b2b3d2269cb3ac007e2d1e9f8112971e2e
    PhishDestroy
    Addresses
    198.251.84.236 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    koinzilloxinvest.com
    Registered
    2026-06-23 · Dynadot Inc
    MX
    Receives mail at mail.koinzilloxinvest.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  53. tryze.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    tryze.store
    First seen
    2026-11-09 05:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 04:18 UTC to 2027-02-07 04:18 UTC
    Logged 2026-11-09 05:17 UTC in Google ParcelYard2027h1, entry 691,322,488
    SHA-256 28bdcbbd53a158a8c7c9a00d13d857c6ae6d5706d14b718b6c1af2057dfb5b84
    Public key SHA-256 a3973379ee28c4f36b9c59b6270693ac58dabfea33e406223dfe83ae04836fbe
    Addresses
    104.21.9.149 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.9.149, 172.67.160.49): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tryze.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  54. www.bella-by-design.com US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesUnder bella-by-design.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    www.bella-by-design.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask, listing bella-by-design.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-09 05:15 UTC to 2027-05-26 05:15 UTC
    Logged 2026-11-09 05:15 UTC in Google Argon2027h1, entry 939,974,338
    SHA-256 8a3f378c4643a3d03d95da7aba458354bf310630c3954f79b0acaa8572abd576
    Public key SHA-256 884e703f6b024f8ab4eb778ea4d5f7116a775bdf640e2ee263db67b41fd5a3eb
    Addresses
    15.197.172.60 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (15.197.172.60): a cloud provider. It rents servers and addresses to its customers.
    Domain
    bella-by-design.com
    Registered
    2022-10-29 · eNom, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:07 UTC

    Suggest a correction

  55. www.koinzilloxinvest.com US · AS53667 · FranTech Solutions
    ReportedUnder koinzilloxinvest.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.koinzilloxinvest.com
    First seen
    2026-11-09 05:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing koinzilloxinvest.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:18 UTC to 2027-02-07 04:18 UTC
    Logged 2026-11-09 05:16 UTC in Google ParcelYard2027h1, entry 691,319,488
    SHA-256 c3f96f1f763b229cc95319a09a061ff444bfd81de773572744a633bd03db72b9
    Public key SHA-256 0522762db1bed63ff90a906a539d07b2b3d2269cb3ac007e2d1e9f8112971e2e
    PhishDestroy
    Addresses
    198.251.84.236 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    koinzilloxinvest.com
    Registered
    2026-06-23 · Dynadot Inc
    MX
    Receives mail at mail.koinzilloxinvest.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  56. yuanok.cloud
    ListedListed by NPA 165 (finance and insurance)MX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    yuanok.cloud
    First seen
    2026-11-09 05:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:17 UTC to 2027-02-07 05:16 UTC
    Logged 2026-11-09 05:17 UTC in Google ParcelYard2027h1, entry 691,331,080
    SHA-256 501ed0b20a7d43227b8b92f5cc65fb01c24794d312f0dfc52ec28dc6668f4608
    Public key SHA-256 99f45294ce4cbbad0173720d6b32433ac6d82acef5e42bfdca0db664d5a816e2
    Domain
    yuanok.cloud
    Registered
    2025-11-24 · Alibaba Cloud Computing Ltd.
    MX
    Receives mail at route3.mx.cloudflare.net, route2.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  57. zittiinter.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    zittiinter.cyou
    First seen
    2026-11-09 05:20 UTC
    Listing
    CERT Polska listed it 2026-05-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:20 UTC to 2027-02-07 04:20 UTC
    Logged 2026-11-09 05:18 UTC in IPng Networks Halloumi2027h1, entry 421,831,768
    SHA-256 882973e4ae7520b76d58e243d6d010f786377afa3926d25e4873cfe90d86a7a0
    Public key SHA-256 71000049410ca0e47725d49cd85fc8ca45627cc5f5ec2343fff025de4204ecfe
    Domain
    zittiinter.cyou
    Registered
    2026-05-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:17 UTC

    Suggest a correction

  58. www.google-reklama.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Google
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 mo ago
    DetailsHide
    Hostname
    www.google-reklama.pl
    First seen
    2026-11-09 05:16 UTC
    First published
    2026-11-09 05:29 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 04:04 UTC to 2027-02-07 04:04 UTC
    Logged 2026-11-09 05:03 UTC in IPng Networks Halloumi2027h1, entry 421,616,861
    SHA-256 4e06b6506561b888cd907163787df55d1da379e065694c0ee48ac36b394e7878
    Public key SHA-256 147e59cf36ae75343c27a8bcf1b185851adb3ea6b87ff844c0db25efa096245a
    Brand
    Google
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    google-reklama.pl
    Registered
    2026-08-21 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  59. google-reklama.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Google
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 mo ago
    DetailsHide
    Hostname
    google-reklama.pl
    First seen
    2026-11-09 05:16 UTC
    First published
    2026-11-09 05:29 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 04:04 UTC to 2027-02-07 04:04 UTC
    Logged 2026-11-09 05:03 UTC in IPng Networks Halloumi2027h1, entry 421,616,861
    SHA-256 4e06b6506561b888cd907163787df55d1da379e065694c0ee48ac36b394e7878
    Public key SHA-256 147e59cf36ae75343c27a8bcf1b185851adb3ea6b87ff844c0db25efa096245a
    Brand
    Google
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    google-reklama.pl
    Registered
    2026-08-21 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  60. 1.laosji.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder laosji.net, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    1.laosji.net
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy, listing laosji.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:12 UTC to 2027-02-07 05:12 UTC
    Logged 2026-11-09 05:12 UTC in Google PlumbersArms2027h1, entry 691,530,054
    SHA-256 02a435c8f52b01e9d44a58cc78564f48fcb41d3c2937fdb62da04abad7ecb541
    Public key SHA-256 362c8dd722651f5e0eccab049d21c6f95d3096835c2c1d7037ad8d1b133b8b84
    PhishDestroy
    Addresses
    172.66.44.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.207, 172.66.47.49): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    laosji.net
    Registered
    2023-07-19 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 08:43 UTC

    Suggest a correction

  61. chainupdate.com US · AS14618 · Amazon.com, Inc.4 addresses
    ReportedParking page · HugeDomainsReported by PhishDestroyMX absentSPF -allDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    chainupdate.com
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:11 UTC to 2027-02-07 04:11 UTC
    Logged 2026-11-09 05:10 UTC in IPng Networks Halloumi2027h1, entry 421,706,335
    SHA-256 3b5773a035a472fed14612a2485a5df56177628f83a05c5dabc60f3edaf98f15
    Public key SHA-256 4c3b4d15ee427afe26bc07c58ff3ccc94beaf8c2ba0c2fbc9c66e3a0e9f4e29a
    PhishDestroy
    Addresses
    13.223.25.84 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    54.243.117.197 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    2600:1f18:4ae:c605:dd5d:b838:5816:d7fb
    2600:1f18:4ae:c606:78d4:4260:db4e:aeee
    Parking page · HugeDomains
    HugeDomains (13.223.25.84, 54.243.117.197): a parking service. It answers for names that are typically for sale or unused.
    Domain
    chainupdate.com
    Registered
    2017-07-10 · TurnCommerce, Inc. DBA NameBright.com
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  62. compoundfinance.digital US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    compoundfinance.digital
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:13 UTC to 2027-02-07 04:13 UTC
    Logged 2026-11-09 05:12 UTC in IPng Networks Halloumi2027h1, entry 421,735,517
    SHA-256 d00fcc33e19cf93f59e1232af36892985008cfd98795bbd02aa653ce5899be7a
    Public key SHA-256 3c390bde4265509033ad157341e503a0c16ef8d8557e8631c6f30dda343a30ba
    Addresses
    104.21.24.230 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.24.230, 172.67.221.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    compoundfinance.digital
    Registered
    2026-05-15 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  63. dejsfnkr.ewxyrmqf.mraekthv.warhqnuy.ijdyvoge.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    dejsfnkr.ewxyrmqf.mraekthv.warhqnuy.ijdyvoge.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 05:40 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:14 UTC to 2027-02-07 04:14 UTC
    Logged 2026-11-09 05:12 UTC in Let's Encrypt Willow2027h1, entry 1,028,426,378
    SHA-256 21d1fbea47ec8ff12bb43b7ad419090ccd144ce9d7a0d29fd8b62f0fd3c5c4cc
    Public key SHA-256 affeb91548408e5c968a4160630fcbe1ddb3d534c24dce95d8619755f59ab7cf
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  64. etqpjghc.kydhiwmv.kqiovdce.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    etqpjghc.kydhiwmv.kqiovdce.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 05:40 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:11 UTC to 2027-02-07 04:11 UTC
    Logged 2026-11-09 05:10 UTC in Google ParcelYard2027h1, entry 691,199,861
    SHA-256 40c773b39e983a549f3bccba003533ce25fa8ab694553cc5fec0cc2c3d2eafad
    Public key SHA-256 24aba0e79940508e1abe56527c991dc60db67a6012c8bc5cd21853a36dbee884
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  65. kcgsg.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    kcgsg.store
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:16 UTC to 2027-02-07 04:16 UTC
    Logged 2026-11-09 05:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,072,552,518
    SHA-256 123f2de3c5803855d68982607e7321a8c40836d65fd342a8d2543d823e866356
    Public key SHA-256 2c97d64e95c0911971163bb13d516dc4a59395228076294fdf6305d00bcde928
    Addresses
    104.21.89.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.89.153, 172.67.189.147): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kcgsg.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  66. kra50i.ru US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    kra50i.ru
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:11 UTC to 2027-02-07 05:09 UTC
    Logged 2026-11-09 05:12 UTC in HARICA Selene2027h1, entry 60,959,656
    SHA-256 3a4048b751cd4d1a0bf9e876dd33c2161e9da5be4d4b2e30bff365f5e603c91f
    Public key SHA-256 580e592d09de14bd0f65413ebb1e721350f577889c8eaa88442fc0444cdc0688
    PhishDestroy
    Addresses
    104.21.12.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.43 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.12.178, 172.67.195.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kra50i.ru
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:17 UTC

    Suggest a correction

  67. peluxiv.capital US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    peluxiv.capital
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    CERT Polska listed it 2026-08-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:15 UTC to 2027-02-07 04:15 UTC
    Logged 2026-11-09 05:13 UTC in Google ParcelYard2027h1, entry 691,264,752
    SHA-256 728d053fad651239c5b0aab9881a6eb4c6924d391e95c66141c2cd031d61216c
    Public key SHA-256 4a6ed53a5eeecd2f8f246d9645d0f4d0c50ff5e855d1a67fedee7dad56c4b9e9
    Addresses
    104.21.27.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.191 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.27.139, 172.67.142.191): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    peluxiv.capital
    Registered
    2026-05-16 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:17 UTC

    Suggest a correction

  68. powhjbyc.qfkwixyb.jdznbyhr.djrehuxf.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    powhjbyc.qfkwixyb.jdznbyhr.djrehuxf.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 05:40 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:13 UTC to 2027-02-07 04:13 UTC
    Logged 2026-11-09 05:11 UTC in DigiCert Sphinx2027h1, entry 410,515,201
    SHA-256 9c570d60154b1b1bc5c762d586ead3f52a924e8d94bd4f13eec662c751073b4b
    Public key SHA-256 18050a4b1d3a63d70e79db1ffa351e37623db8eadfc72a77e05b7e2c58f4f98f
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  69. qytwexmj.bkaoweli.tgahyuzd.rzfdoakh.onvgwjec.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    qytwexmj.bkaoweli.tgahyuzd.rzfdoakh.onvgwjec.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 05:40 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:13 UTC to 2027-02-07 04:13 UTC
    Logged 2026-11-09 05:11 UTC in Google ParcelYard2027h1, entry 691,223,437
    SHA-256 146238a1eb8c774b8a645dc619ff1362936044536af34c9c09471ad1f293ac7b
    Public key SHA-256 35ffd94c92d1d863122d97451e07c2a2fd303878cf168a51e2674a47eaff7811
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  70. smartdefi.cyou US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    smartdefi.cyou
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:12 UTC to 2027-02-07 04:12 UTC
    Logged 2026-11-09 05:10 UTC in Google PlumbersArms2027h1, entry 691,500,346
    SHA-256 1977d19a2304cbf8231c8397bef1de181cd8792125674f7ef25047bf12fd03d4
    Public key SHA-256 6bc55c408affaf85f4f4f1b5622c95bd20d9a7e0103004d5a04faf63f22ffb26
    PhishDestroy
    Addresses
    104.21.36.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.194.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.36.122, 172.67.194.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    smartdefi.cyou
    Registered
    2026-09-09 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  71. steamports.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    steamports.com
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:12 UTC to 2027-02-07 04:12 UTC
    Logged 2026-11-09 05:11 UTC in Google PlumbersArms2027h1, entry 691,505,677
    SHA-256 5cfd82be3b31151a794047ba216f07213e9ff7cfd81f572b1d738dda708b6c8b
    Public key SHA-256 c1d617226826da614562759b9a4fcb618e43e67d2044cbbc3a16684daf2d6208
    PhishDestroy
    Addresses
    104.21.60.131 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.60.131, 172.67.196.216): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    steamports.com
    Registered
    2026-09-11 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:17 UTC

    Suggest a correction

  72. www.elmizan.com US · AS54113 · Fastly, Inc.2 addresses
    ReportedFastlyUnder elmizan.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    www.elmizan.com
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy, listing elmizan.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3
    Valid 2026-10-04 07:30 UTC to 2027-01-02 08:27 UTC
    Logged 2026-11-09 05:12 UTC in Sectigo Statue2027h1, entry 101,847,593
    SHA-256 d2f4cf2d69e743d0dae7e62084fa072b3aadbd33b9733e2c51e553db0206af0c
    Public key SHA-256 17a8d38a1f559246194bccae62a794ff80d419e849fa78811a4910d7283c1f75
    PhishDestroy
    Addresses
    151.101.1.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    151.101.65.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (151.101.1.195, 151.101.65.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    elmizan.com
    Registered
    2017-01-02 · Cloudflare, Inc.
    MX
    Receives mail at route3.mx.cloudflare.net, route2.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:27 UTC

    Suggest a correction

  73. ysdcw.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    ysdcw.store
    First seen
    2026-11-09 05:15 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:16 UTC to 2027-02-07 04:16 UTC
    Logged 2026-11-09 05:15 UTC in IPng Networks Halloumi2027h1, entry 421,776,162
    SHA-256 9500719201bd951ead030766084b629e9eb3b75ad0530e1fe0d98d81f1793eaa
    Public key SHA-256 108ec8666a6522ae935b46f593715962cff1c6246de0b467dac18052c1cdde61
    Addresses
    104.21.12.239 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.153.238 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.12.239, 172.67.153.238): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ysdcw.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  74. yandexid.ru RU · AS210644 · AEZA-AS AEZA GROUP LLCYandex
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    yandexid.ru
    First seen
    2026-11-09 05:11 UTC
    First published
    2026-11-09 05:29 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 217.144.191.185.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 217.144.191.185
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 03:59 UTC to 2027-02-07 03:59 UTC
    Logged 2026-11-09 04:57 UTC in IPng Networks Gouda2027h1, entry 360,675,952
    SHA-256 3df23398d88b5865f6fbfc7b6cb0071ac0869d6d5bf9a9b40340a6c84b1f7610
    Public key SHA-256 60a307fe43164efbf1ec9f982327d4a7b7a54ebc0091f18f7525c23bf6908815
    Brand
    Yandex
    Addresses
    217.144.191.185 · Russia · AS210644 AEZA-AS AEZA GROUP LLC
    Domain
    yandexid.ru
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:12 UTC

    Suggest a correction

  75. www.truistsupport.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…Truist
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.truistsupport.online
    First seen
    2026-11-09 05:11 UTC
    First published
    2026-11-09 05:29 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:08 UTC to 2027-02-07 04:08 UTC
    Logged 2026-11-09 05:06 UTC in Google ParcelYard2027h1, entry 691,138,316
    SHA-256 3be0193af8ff6ce8a7cff02f12da2780f59acbc2eaabe430ce2106edf50067dc
    Public key SHA-256 a6ec0eb130025eaf88ced2506a5f54e39786c6b20231978f6cf2acdffad871e8
    Brand
    Truist
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    truistsupport.online
    Registered
    2026-05-27 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:12 UTC

    Suggest a correction

  76. x-api.us-githubusercontent.com IR · AS205585 · ARVANCLOUD-CDN-IR Noyan Abr…2 addressesGitHub
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    x-api.us-githubusercontent.com
    First seen
    2026-11-09 05:11 UTC
    First published
    2026-11-09 05:29 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.143.233.133.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.143.233.133
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:06 UTC to 2027-02-07 04:06 UTC
    Logged 2026-11-09 05:05 UTC in DigiCert Wyvern2027h1, entry 463,594,717
    SHA-256 1f11bc8bc4b12830ea4339722739a11177184d382b86faf15772d7fdb310d903
    Public key SHA-256 98b60b3335ca284005f861f1b0f716763481464e421ea31bf095177b7645b4ea
    Brand
    GitHub
    Addresses
    185.143.233.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
    185.143.234.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
    Domain
    us-githubusercontent.com
    Registered
    2026-01-23 · Hello Internet Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  77. tmall.832365.cc HK · AS135357 · HONG KONG KOWLOON TELECOMMU…Alibaba
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 11 y ago
    DetailsHide
    Hostname
    tmall.832365.cc
    First seen
    2026-11-09 05:11 UTC
    First published
    2026-11-09 05:29 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 103.244.151.206.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 103.244.151.206
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 04:10 UTC to 2027-02-07 04:10 UTC
    Logged 2026-11-09 05:08 UTC in Google ParcelYard2027h1, entry 691,176,362
    SHA-256 771c9ebcfee459b5e2723377a653e422d68673484f9b4679ea9ed62a92befc3e
    Public key SHA-256 ba332fdf2515b8f6e5c65d5dee07fa9321adc01c1c819b065d3f40e97e6fa51f
    Brand
    Alibaba
    Addresses
    103.244.151.206 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    832365.cc
    Registered
    2015-10-11 · 22net, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  78. truistsupport.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…Truist
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    truistsupport.online
    First seen
    2026-11-09 05:11 UTC
    First published
    2026-11-09 05:29 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:08 UTC to 2027-02-07 04:08 UTC
    Logged 2026-11-09 05:06 UTC in Google ParcelYard2027h1, entry 691,138,316
    SHA-256 3be0193af8ff6ce8a7cff02f12da2780f59acbc2eaabe430ce2106edf50067dc
    Public key SHA-256 a6ec0eb130025eaf88ced2506a5f54e39786c6b20231978f6cf2acdffad871e8
    Brand
    Truist
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    truistsupport.online
    Registered
    2026-05-27 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:12 UTC

    Suggest a correction

  79. alchemix-rewards.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    alchemix-rewards.xyz
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:08 UTC to 2027-02-07 04:08 UTC
    Logged 2026-11-09 05:06 UTC in IPng Networks Halloumi2027h1, entry 421,654,222
    SHA-256 52744b13ba4c6bf00158a72036e367a3c79fa28e65f1d6fc4d5ced0d574304aa
    Public key SHA-256 5fbbea42003846ce454d1fd4061afde9c46337186591b17a3fae4c5adb173e3f
    Addresses
    104.21.11.163 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.166.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.11.163, 172.67.166.108): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    alchemix-rewards.xyz
    Registered
    2026-05-16 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  80. czfyv.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    czfyv.store
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:10 UTC to 2027-02-07 04:10 UTC
    Logged 2026-11-09 05:09 UTC in Google ParcelYard2027h1, entry 691,187,900
    SHA-256 feafa8551c308c67a181c2ea5273fdcb12d3d6cd3a9a90f3f65599e519481938
    Public key SHA-256 6e1109c7a4e4d1cdb97d37b67cc0801c3c6e8a49fd2e6c497fa0e7632411c102
    Addresses
    104.21.49.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.157, 172.67.191.48): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    czfyv.store
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  81. qhhcy.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    qhhcy.asia
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:09 UTC to 2027-02-07 05:07 UTC
    Logged 2026-11-09 05:09 UTC in Google ParcelYard2027h1, entry 691,179,770
    SHA-256 981f3df15cc99a1204b481577ece65ca1bfd052a817bf6193053cfaf73687b67
    Public key SHA-256 e8ced39ddc9f5e168fea0d4f139fac2729f2ff8810102777223cb1f14998ab30
    Addresses
    104.21.22.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.202.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.22.31, 172.67.202.50): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qhhcy.asia
    Registered
    2025-11-19 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  82. tevehivro.work US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tevehivro.work
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    CERT Polska listed it 2026-06-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:07 UTC to 2027-02-07 04:07 UTC
    Logged 2026-11-09 05:06 UTC in Google PlumbersArms2027h1, entry 691,420,532
    SHA-256 ab49a702942594e368cdb7defb50eaad83ed61cbce6553c22a1d059e6bf515d3
    Public key SHA-256 96a9b03a5012a02f8add3c54860186160189909ee07a69987a59cffcfbedb8c1
    Addresses
    104.21.82.196 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.162.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.82.196, 172.67.162.213): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevehivro.work
    Registered
    2026-05-15 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  83. tevelabio.help US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tevelabio.help
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 04:09 UTC to 2027-02-07 04:09 UTC
    Logged 2026-11-09 05:07 UTC in Google PlumbersArms2027h1, entry 691,442,877
    SHA-256 a1fa2129db47efa2bbac5b3dbd013504b3de8066e5606c74163257e9798782f6
    Public key SHA-256 bc1d47cedc6d3f1ceaf483ac1a5b3a388b850f4cb58dbc855a48d2e117163fd2
    Addresses
    104.21.65.217 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.192.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.217, 172.67.192.186): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevelabio.help
    Registered
    2026-05-15 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  84. www.goodydo.cz US · AS54113 · Fastly, Inc.
    ReportedFastlyUnder goodydo.cz, reported by PhishDestroyMX presentSPF -allDMARC policy noneRegistered 4 y ago
    DetailsHide
    Hostname
    www.goodydo.cz
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy, listing goodydo.cz and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3
    Valid 2026-09-23 07:28 UTC to 2026-12-22 08:24 UTC
    Logged 2026-11-09 05:09 UTC in Geomys Trastevere2026h2, entry 30,484,121
    SHA-256 bff412e03f0dc462fc5a2f5313ee92be23e4270a0ce70db0773816d46011f341
    Public key SHA-256 17a8d38a1f559246194bccae62a794ff80d419e849fa78811a4910d7283c1f75
    PhishDestroy
    Addresses
    199.36.158.100 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (199.36.158.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    goodydo.cz
    Registered
    2022-06-23 · Webglobe, s.r.o.
    MX
    Receives mail at goodydo-cz.mail.protection.outlook.com, email.webglobe.cz, email2.webglobe.cz
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 21:45 UTC

    Suggest a correction

  85. www.greenleavez.com US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder greenleavez.com, reported by PhishDestroyMX absentSPF missingDMARC quarantineRegistered 4 y ago
    DetailsHide
    Hostname
    www.greenleavez.com
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy, listing greenleavez.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-09 05:04 UTC to 2027-05-26 05:04 UTC
    Logged 2026-11-09 05:04 UTC in Google Argon2027h1, entry 939,789,977
    SHA-256 663e1c674e3880c44a97da8d3e1bd709f93530ab0279f15ae26200b71cfb8025
    Public key SHA-256 bd8cd9eeadb8c99f57aa14c20f147f02cf5bd00051e68c3d8bcf821921ad58c9
    PhishDestroy
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    greenleavez.com
    Registered
    2022-11-01 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-08 08:28 UTC

    Suggest a correction

  86. www.hypertliquid.com US · AS16509 · Amazon.com, Inc.
    ReportedAmazon Web ServicesReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    www.hypertliquid.com
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-09 05:07 UTC to 2027-05-26 05:07 UTC
    Logged 2026-11-09 05:07 UTC in Google Argon2027h1, entry 939,839,464
    SHA-256 4aac0e5962d131a54fc546a888c8b84ea3cbbed7b6c252a210fc18306b538fa1
    Public key SHA-256 2480b944a48a364126626cd7f198eee4c409d83202816e45e9c4dba366af748d
    PhishDestroy
    Addresses
    52.223.13.41 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (52.223.13.41): a cloud provider. It rents servers and addresses to its customers.
    Domain
    hypertliquid.com
    Registered
    2025-10-29 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  87. zerobasedao.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    zerobasedao.xyz
    First seen
    2026-11-09 05:10 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-11 03:02 UTC to 2026-12-10 04:01 UTC
    Logged 2026-11-09 05:05 UTC in Let's Encrypt Sycamore2026h2, entry 1,087,659,227
    SHA-256 6846812fba50684e44aca36a587a0e9b4047ec820f5759dd461582ed20b6099a
    Public key SHA-256 fbc15c5dfed8dc428391f0970adc86a612982dbc1ad8592e5e0da76d5ea377ea
    PhishDestroy
    Addresses
    104.21.14.230 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.190 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.14.230, 172.67.160.190): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zerobasedao.xyz
    Registered
    2025-11-19 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  88. 711799.comApple
    ListedListed by JPCERT/CC as imitating Apple AccountMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    711799.com
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    JPCERT/CC confirmed it 2026-08-06 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 02:12 UTC
    DNS
    Not resolving · checked 2026-11-09 05:34 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:02 UTC to 2027-02-07 04:02 UTC
    Logged 2026-11-09 05:00 UTC in IPng Networks Gouda2027h1, entry 360,699,943
    SHA-256 62f847d2ee408d0de4a600c3db7c4d6c360d6456a9f2f34c19485cb73e00b311
    Public key SHA-256 b63781ed258b09000a2f7026a50fe9481021ae4169b7d8a4625d58dc847a34f2
    Brand
    Apple
    Domain
    711799.com
    Registered
    2026-11-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  89. api.wealthphantomsolution-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    api.wealthphantomsolution-com.financecryptoworld.com
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 03:36 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 04:03 UTC to 2027-02-07 05:02 UTC
    Logged 2026-11-09 05:03 UTC in Geomys Tuscolo2027h1, entry 539,113,289
    SHA-256 01879afa87e847496f183ea81cbb60b4eb7a11d26d66e25f4c150e82ec9c9da3
    Public key SHA-256 4d152e481b3f6f4a1602a68f4b56f4e08272b57604578d160e4bc5f7e6f5a9b6
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  90. bonus-hyperlend.com US · AS54600 · PEG TECH INC
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    bonus-hyperlend.com
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:01 UTC to 2027-02-07 04:01 UTC
    Logged 2026-11-09 05:00 UTC in IPng Networks Gouda2027h1, entry 360,695,798
    SHA-256 1e36ac5fff6f4f149ced983292304ca0cd10b6ae54e4f0ee655f2e4a3c539a39
    Public key SHA-256 349b23015699df0344f3c3b309ac47e6fcbb431231fac096fcd490ddc4cf187d
    PhishDestroy
    Addresses
    38.33.217.12 · United States · AS54600 PEG-SV - PEG TECH INC
    Domain
    bonus-hyperlend.com
    Registered
    2026-11-08 · CV. Rumahweb Indonesia
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  91. gateway.api-payments.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ListedHostingerUnder api-payments.com, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 13 mo ago
    DetailsHide
    Hostname
    gateway.api-payments.com
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    MetaMask, listing api-payments.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 04:05 UTC to 2027-02-07 04:05 UTC
    Logged 2026-11-09 05:04 UTC in Geomys Tuscolo2027h1, entry 539,119,055
    SHA-256 6bdd7c17720e7b91bebf610ab66617128b1580caa1ed4a9cc3d255c2a215d2bc
    Public key SHA-256 f9c96464e91a947e5594ebed16f89ad12e8f00ac876019bba1f8e21085c0eab3
    Addresses
    76.13.49.204 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (76.13.49.204): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    api-payments.com
    Registered
    2025-10-11 · CV. Rumahweb Indonesia
    MX
    Receives mail at mail.api-payments.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 05:29 UTC

    Suggest a correction

  92. m.bonus-hyperlend.com US · AS54600 · PEG TECH INC
    ReportedUnder bonus-hyperlend.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    m.bonus-hyperlend.com
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy, listing bonus-hyperlend.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:01 UTC to 2027-02-07 04:01 UTC
    Logged 2026-11-09 05:00 UTC in IPng Networks Gouda2027h1, entry 360,695,798
    SHA-256 1e36ac5fff6f4f149ced983292304ca0cd10b6ae54e4f0ee655f2e4a3c539a39
    Public key SHA-256 349b23015699df0344f3c3b309ac47e6fcbb431231fac096fcd490ddc4cf187d
    PhishDestroy
    Addresses
    38.33.217.12 · United States · AS54600 PEG-SV - PEG TECH INC
    Domain
    bonus-hyperlend.com
    Registered
    2026-11-08 · CV. Rumahweb Indonesia
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  93. profile-gcase.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    profile-gcase.com
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    DNS
    Not resolving · checked 2026-11-09 05:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:01 UTC to 2027-02-07 05:00 UTC
    Logged 2026-11-09 05:01 UTC in Let's Encrypt Willow2027h1, entry 1,028,133,092
    SHA-256 a46a47872e415db0173a3beffee3e4c465b94d57807a6a82e173f1132ccaed1d
    Public key SHA-256 c014b146ef226ae3e899603ec37d14fc8292645ddc916e390b25a6415b37a1f5
    Domain
    profile-gcase.com
    Registered
    2026-07-13 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  94. tinfo.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    tinfo.shop
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-10 22:57 UTC to 2026-12-09 23:57 UTC
    Logged 2026-11-09 05:04 UTC in DigiCert Wyvern2026h2, entry 2,213,668,081
    SHA-256 628ed7103a3c6b36626bef76256af4aafefe5d79b9bc10ff09a01f421421bcc1
    Public key SHA-256 7bf4ed97d9c43ddd3c9665bb98e18c398168ed5b6057b4c080eb97f734365291
    Addresses
    104.21.76.218 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.201.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.76.218, 172.67.201.68): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tinfo.shop
    Registered
    2025-11-18 · Dynadot Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  95. vlbfnlekkergaan.daunt.link RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder daunt.link, reported by PhishDestroyMX absentSPF ~allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    vlbfnlekkergaan.daunt.link
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy, listing daunt.link and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 04:02 UTC to 2027-02-07 04:02 UTC
    Logged 2026-11-09 05:01 UTC in DigiCert Wyvern2027h1, entry 463,555,553
    SHA-256 57c6d7dc92aa03b4a1b8d004c6a9592777e5473f14572ea00f2142eb70da94d2
    Public key SHA-256 11dc23f627e2ab3d4c165640efddf340673393489555fa4ced290c06acc34cfd
    PhishDestroy
    Addresses
    185.149.120.195 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.149.120.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    daunt.link
    Registered
    2022-09-25 · Key-Systems, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 20:53 UTC

    Suggest a correction

  96. www.bonus-hyperlend.com US · AS54600 · PEG TECH INC
    ReportedUnder bonus-hyperlend.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    www.bonus-hyperlend.com
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy, listing bonus-hyperlend.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 04:01 UTC to 2027-02-07 04:01 UTC
    Logged 2026-11-09 05:00 UTC in IPng Networks Gouda2027h1, entry 360,695,798
    SHA-256 1e36ac5fff6f4f149ced983292304ca0cd10b6ae54e4f0ee655f2e4a3c539a39
    Public key SHA-256 349b23015699df0344f3c3b309ac47e6fcbb431231fac096fcd490ddc4cf187d
    PhishDestroy
    Addresses
    38.33.217.12 · United States · AS54600 PEG-SV - PEG TECH INC
    Domain
    bonus-hyperlend.com
    Registered
    2026-11-08 · CV. Rumahweb Indonesia
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  97. www.phantom-app.co.uk US · AS53831 · Squarespace, Inc.4 addresses
    ReportedSquarespaceUnder phantom-app.co.uk, reported by PhishDestroyMX presentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    www.phantom-app.co.uk
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Reported
    PhishDestroy, listing phantom-app.co.uk and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 04:05 UTC to 2027-02-07 04:05 UTC
    Logged 2026-11-09 05:04 UTC in Let's Encrypt Sycamore2027h1, entry 1,072,251,691
    SHA-256 c1db36d3c2a8e1c72d0ca52ba40d983f4bf0d1b693e26a68c157783b70b15e48
    Public key SHA-256 a4b00952b8a4ffc19143dced1492e3a7433bd63735521bf71d1306bb267f1163
    PhishDestroy
    Addresses
    198.49.23.144 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.49.23.145 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.185.159.144 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    198.185.159.145 · United States · AS53831 SQUARESPACE - Squarespace, Inc. · Squarespace (site builder)
    Squarespace
    Squarespace (198.49.23.144, 198.49.23.145, 198.185.159.144, 198.185.159.145): a site builder. It hosts pages for anyone who signs up.
    Domain
    phantom-app.co.uk
    Registered
    2026-01-17 · Squarespace Domains LLC t/a SQUARESPACE DOMAINS
    MX
    Receives mail at smtp.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  98. xrpl-allocation.live US · AS13335 · Cloudflare, Inc.2 addressesRipple (XRP)
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    xrpl-allocation.live
    First seen
    2026-11-09 05:05 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 04:02 UTC to 2027-02-07 04:59 UTC
    Logged 2026-11-09 05:02 UTC in Sectigo Monument2027h1, entry 101,651,857
    SHA-256 28919c1520bc1f2a1887d667674d130998107aebc697aab225273a9a16630230
    Public key SHA-256 79715c549330e51467f3b9a83b68e571ec48cfee770f762599f6771caeec607c
    Brand
    Ripple (XRP)
    Addresses
    104.21.57.156 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.57.156, 172.67.146.225): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xrpl-allocation.live
    Registered
    2026-07-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

  99. samsung-compressors.com US · AS40244 · Turnkey Internet Inc.4 addressesSamsung
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    samsung-compressors.com
    First seen
    2026-11-09 05:03 UTC
    DNS
    Resolves · checked 2026-11-09 05:03 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 199.193.114.43.
    1. Phishing-host list fetched with the address
    2. Resolved to 199.193.114.43
    Brand
    Samsung
    Addresses
    199.193.114.43 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    199.193.114.42 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    199.193.114.45 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    199.193.114.46 · United States · AS40244 TURNKEY-INTERNET - Turnkey Internet Inc.
    Domain
    samsung-compressors.com
    Registered
    2018-10-29 · Media Elite Holdings Limited, S.A.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 08:35 UTC

    Suggest a correction

  100. boostweb3.us US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF -allSPF on Spamhaus DROPDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    boostweb3.us
    First seen
    2026-11-09 05:00 UTC
    First published
    2026-11-09 05:29 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    DNS
    Resolves · checked 2026-11-09 05:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:00 UTC to 2027-02-07 04:00 UTC
    Logged 2026-11-09 04:59 UTC in IPng Networks Gouda2027h1, entry 360,687,179
    SHA-256 43d10fcfcc8a3fc691c8290be7f82faa217e20294ab0c076b8e47f1d49794888
    Public key SHA-256 7f28828173344c3c455ba81e1d6e3e5253d75fe2e056328892ac8a3fbaa7ae21
    Addresses
    104.21.43.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.219.128 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.43.48, 172.67.219.128): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    boostweb3.us
    Registered
    2026-05-15 · NameCheap, Inc.
    MX
    Receives mail at mail.boostweb3.us
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    SPF listing
    The SPF record lists 196.251.107.128 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-09 05:27 UTC

    Suggest a correction

Showing 101–200 of 5,855 hostnames.Back to the start
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources