Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-09 10:48 UTC
Certificate-log entries · 24 h
395.4M
from 84 distinct feeds
Unique certificates · 24 h
37.2M
each reviewed
Names resolved · 24 h
22.6M
17.2M with an address
Findings · 24 h
6,066
208 of 1,061 brands targeted

6,066 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. cambiumtrade.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    cambiumtrade.com
    First seen
    2026-11-09 10:45 UTC
    Listing
    CERT Polska listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 09:46 UTC to 2027-02-07 09:46 UTC
    Logged 2026-11-09 10:44 UTC in DigiCert Sphinx2027h1, entry 413,684,822
    SHA-256 137878eecb23e626dd921d7e960ebc78e58a4784a0cfdf630c2d3eebceffa5b5
    Public key SHA-256 7f3ded33e1b42968a01b037886dc49115b577623f9c5040dddf47fbd09d54484
    Addresses
    104.21.41.232 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.223 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:29e8
    2606:4700:3037::ac43:c3df
    Cloudflare
    Cloudflare (104.21.41.232, 172.67.195.223): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cambiumtrade.com
    Registered
    2026-08-18 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  2. chilloutvrlabs.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    chilloutvrlabs.com
    First seen
    2026-11-09 10:45 UTC
    Listing
    CERT Polska listed it 2026-07-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 09:42 UTC to 2027-02-07 09:42 UTC
    Logged 2026-11-09 10:40 UTC in Google ParcelYard2027h1, entry 696,104,226
    SHA-256 7cfe5b3625a73fc826a5e403cc466cad8dd45e0f5a26c07ba428d41d30eda087
    Public key SHA-256 4511bfb1ed89f13ecba16d609ac4af3edbeed3e08a2fe6a5b1263d591fe86d62
    Addresses
    104.21.34.55 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.155.29 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:9b1d
    2606:4700:3034::6815:2237
    Cloudflare
    Cloudflare (104.21.34.55, 172.67.155.29): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    chilloutvrlabs.com
    Registered
    2026-03-28 · Turkticaret.net Yazilim Hizmetleri Sanayi ve Ticaret A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  3. genesis-jasmy.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    genesis-jasmy.com
    First seen
    2026-11-09 10:45 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:43 UTC to 2027-02-07 10:42 UTC
    Logged 2026-11-09 10:43 UTC in Google PlumbersArms2027h1, entry 696,432,231
    SHA-256 485019d84f5b81d3ebb342a9b398a5582cc68d45e7c1e801c9cc8878fc9d998b
    Public key SHA-256 94b0870f049ad26e1b96709e910dbdea82d227982c38005076676b5d24d24382
    PhishDestroy
    Addresses
    104.21.53.185 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.41 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3037::6815:35b9
    2606:4700:3037::ac43:d829
    Cloudflare
    Cloudflare (104.21.53.185, 172.67.216.41): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    genesis-jasmy.com
    Registered
    2025-11-19 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:47 UTC

    Suggest a correction

  4. genesiscasino.org US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 17 mo ago
    DetailsHide
    Hostname
    genesiscasino.org
    First seen
    2026-11-09 10:45 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:41 UTC to 2027-02-07 10:38 UTC
    Logged 2026-11-09 10:41 UTC in Geomys Tuscolo2027h1, entry 543,030,218
    SHA-256 c391100a52423de50e797a0269d5dfdcd9ea8579eb04bc18e6453e142d53aa00
    Public key SHA-256 94dd0c3421a46ddbe01057b8841878258009e940a03148ed962d0a34f5b02891
    PhishDestroy
    Addresses
    104.21.67.11 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:430b
    2606:4700:3037::ac43:d2fe
    Cloudflare
    Cloudflare (104.21.67.11, 172.67.210.254): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    genesiscasino.org
    Registered
    2025-06-25 · Internet Domain Service BS Corp
    MX
    Receives mail at _dc-mx.10e83ce3f0c4.genesiscasino.org
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  5. gfyl.pw US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    gfyl.pw
    First seen
    2026-11-09 10:45 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:42 UTC to 2027-02-07 10:41 UTC
    Logged 2026-11-09 10:42 UTC in Google PlumbersArms2027h1, entry 696,414,352
    SHA-256 b7be7bd2d96785928ccdeedb814b4bb3012e76eccb7c7f93a00b3e225842171d
    Public key SHA-256 5e805e5f005b60af71932122cb6d9847ca083c820ebf85864ae41ba97ef2c478
    Addresses
    104.21.66.200 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.59 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:42c8
    2606:4700:3034::ac43:cf3b
    Cloudflare
    Cloudflare (104.21.66.200, 172.67.207.59): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gfyl.pw
    Registered
    2026-07-10 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  6. iycs.pw US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    iycs.pw
    First seen
    2026-11-09 10:45 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:43 UTC to 2027-02-07 10:42 UTC
    Logged 2026-11-09 10:44 UTC in IPng Networks Halloumi2027h1, entry 425,274,335
    SHA-256 e344f12d0ddbf002059cc5194527014355a966e9b66a5540aecf61a8a9ad82ef
    Public key SHA-256 4e3a296355ec46dd4df1f211c673fdc72876af97de7d45cd799e708121e8f3fd
    Addresses
    104.21.85.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.206.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:5593
    2606:4700:3035::ac43:cead
    Cloudflare
    Cloudflare (104.21.85.147, 172.67.206.173): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    iycs.pw
    Registered
    2026-07-10 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  7. medfk.asia US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    medfk.asia
    First seen
    2026-11-09 10:45 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:41 UTC to 2027-02-07 10:39 UTC
    Logged 2026-11-09 10:41 UTC in Geomys Tuscolo2027h1, entry 543,026,430
    SHA-256 ccc8d6bb8bc6e1e1e5cce0b676211254d56f200979805fbfb06bfd8eb2f8fdf0
    Public key SHA-256 00c83f3f0ecbafeb3b52f4c2417ac59276d23eefbe90e0a95691ebae386a5b48
    Addresses
    104.21.26.161 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:8931
    2606:4700:3033::6815:1aa1
    Cloudflare
    Cloudflare (104.21.26.161, 172.67.137.49): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    medfk.asia
    Registered
    2026-07-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  8. quadrapodi.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    quadrapodi.cyou
    First seen
    2026-11-09 10:45 UTC
    Listing
    CERT Polska listed it 2026-07-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:42 UTC to 2027-02-07 10:41 UTC
    Logged 2026-11-09 10:42 UTC in IPng Networks Halloumi2027h1, entry 425,261,948
    SHA-256 62c5d6f9ce4d762aa4b261758823a37dd41d3bfa9cf54a42b3a2ff247a792f51
    Public key SHA-256 cd02dc5bd51705c570d119040ec8f1472f94a521a4bfedd4fe1bae82be8cddd3
    Domain
    quadrapodi.cyou
    Registered
    2026-07-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  9. qzovarel-switzerland.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    qzovarel-switzerland.com
    First seen
    2026-11-09 10:45 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:41 UTC to 2027-02-07 10:40 UTC
    Logged 2026-11-09 10:41 UTC in Google ParcelYard2027h1, entry 696,117,765
    SHA-256 9041417e38a9073dc37eb784aa786adc7ac0707b57ff437c3ac6933851c8f0d1
    Public key SHA-256 33a439c0d189eecf9cf3e6ff549b2551144955d12c27df0295f4de5588207d9a
    Addresses
    104.21.46.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:2ed6
    2606:4700:3037::ac43:8e56
    Cloudflare
    Cloudflare (104.21.46.214, 172.67.142.86): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qzovarel-switzerland.com
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  10. uifcz.asia US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    uifcz.asia
    First seen
    2026-11-09 10:45 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:43 UTC to 2027-02-07 10:42 UTC
    Logged 2026-11-09 10:43 UTC in Geomys Tuscolo2027h1, entry 543,058,902
    SHA-256 30eeb72021b4da6d8d1bc1e3ff9a8dfa3cf493278b7144414e10456b3db514d3
    Public key SHA-256 141093ae9a31ebfd998438e001859f77ba18276ae5fb5daced8e21f3f437c0dc
    Addresses
    104.21.9.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.161.32 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:9ac
    2606:4700:3036::ac43:a120
    Cloudflare
    Cloudflare (104.21.9.172, 172.67.161.32): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    uifcz.asia
    Registered
    2026-07-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  11. us-web05.us GB · AS215439 · PLAY2GO-NET PLAY2GO INTERNA…
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    us-web05.us
    First seen
    2026-11-09 10:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:41 UTC to 2027-02-07 10:39 UTC
    Logged 2026-11-09 10:41 UTC in Geomys Tuscolo2027h1, entry 543,026,621
    SHA-256 06a1b332ec2a9d23d7a76a155f1a17c4e185e8b9418196c42278370975cb7598
    Public key SHA-256 59ea5eced4dd4d1b813c8717d7c3921abc4ff2bdb6391958914c5610adddd3b5
    Addresses
    144.31.212.92 · United Kingdom · AS215439 PLAY2GO-NET PLAY2GO INTERNATIONAL LIMITED
    Domain
    us-web05.us
    Registered
    2026-07-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  12. curve-finance.com.mx US · AS13335 · Cloudflare, Inc.4 addressesCurve Finance
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    curve-finance.com.mx
    First seen
    2026-11-09 10:40 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 09:40 UTC to 2027-02-07 09:40 UTC
    Logged 2026-11-09 10:39 UTC in Google ParcelYard2027h1, entry 696,079,007
    SHA-256 17004658dd1e9efd2ea24f3de5d3291d4c5572ad56c0afa2923ccfe71722819f
    Public key SHA-256 a71c97765d318b2d33c1bc0dc1ed458b4d43265a8546027bc060ded6205dc268
    Brand
    Curve Finance
    Addresses
    104.21.60.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:bf70
    2606:4700:3037::6815:3c26
    Cloudflare
    Cloudflare (104.21.60.38, 172.67.191.112): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    curve-finance.com.mx
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  13. developers.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    developers.fresh-focus.pro
    First seen
    2026-11-09 10:40 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:38 UTC to 2027-02-07 09:38 UTC
    Logged 2026-11-09 10:37 UTC in Let's Encrypt Sycamore2027h1, entry 1,081,348,408
    SHA-256 317d61b34e282a1d276b0ccaf9706ac09d730b47b87e57f873bc702ec2acaca3
    Public key SHA-256 7e097bf627f3639ea62d36831e7178ae32e1b8f40caae5169563610fdc62deb9
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  14. gatebtc-xau.my US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    gatebtc-xau.my
    First seen
    2026-11-09 10:40 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-30 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:37 UTC to 2027-02-07 10:36 UTC
    Logged 2026-11-09 10:37 UTC in Google PlumbersArms2027h1, entry 696,336,152
    SHA-256 0c08d60adba6bce28d6c0805e2fddfd463dca932f71548960519e214c3493212
    Public key SHA-256 3ff1cc7c02d99c5624d4c28e14b648911150d29edc5e47fd1d97e0cf0364b7f1
    Addresses
    104.21.31.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.31.42, 172.67.174.243): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gatebtc-xau.my
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  15. lludll.uk US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 13 d ago
    DetailsHide
    Hostname
    lludll.uk
    First seen
    2026-11-09 10:40 UTC
    Listing
    CERT Polska listed it 2026-11-06 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:36 UTC to 2027-02-07 10:36 UTC
    Logged 2026-11-09 10:36 UTC in Google ParcelYard2027h1, entry 696,037,937
    SHA-256 3bb5f7b5bfa9a8a4456737df84e3071e2059c2f719958a07bb9e0d61333d4cc5
    Public key SHA-256 dc770eef7ca44a17cafbd29aa611c4b832d31bfa7c0675012af689d9a2d6dc3e
    Addresses
    104.16.211.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.16.211.68): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lludll.uk
    Registered
    2026-10-27 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  16. muzeum.me US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 y ago
    DetailsHide
    Hostname
    muzeum.me
    First seen
    2026-11-09 10:40 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 09:37 UTC to 2027-02-07 09:37 UTC
    Logged 2026-11-09 10:36 UTC in DigiCert Wyvern2027h1, entry 467,112,310
    SHA-256 082ad666e72c584cc475644fc30edd3b338b4ac540165d467c12e296df02d964
    Public key SHA-256 2cb8ee7b8285c04881be24344019f4770e4a111be2ea32aef6d82ccf005b6e21
    PhishDestroy
    Addresses
    104.21.96.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.218 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.96.104, 172.67.176.218): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    muzeum.me
    Registered
    2019-12-04 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  17. routubergo.rtbr.ooo CH · AS29222 · Infomaniak-AS Infomaniak Ne…
    ReportedUnder rtbr.ooo, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    routubergo.rtbr.ooo
    First seen
    2026-11-09 10:40 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing rtbr.ooo and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 09:37 UTC to 2027-02-07 09:37 UTC
    Logged 2026-11-09 10:35 UTC in Google ParcelYard2027h1, entry 696,024,495
    SHA-256 4145271722ddf9687fd9ceb2024373008308aab56d3672124bfc2a893da3de8e
    Public key SHA-256 9461aaad3150b096761f7f20f4c361a88f34c1aefcd96818a09d56421a0622aa
    PhishDestroy
    Addresses
    179.237.85.169 · Switzerland · AS29222 Infomaniak-AS Infomaniak Network SA
    Domain
    rtbr.ooo
    Registered
    2026-03-29 · Fewmoretaps OU d/b/a Trustname.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  18. s2-fantom.foundation US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    s2-fantom.foundation
    First seen
    2026-11-09 10:40 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:37 UTC to 2027-02-07 10:36 UTC
    Logged 2026-11-09 10:37 UTC in Google PlumbersArms2027h1, entry 696,334,717
    SHA-256 920457b8ba98422f2b55ca0bfbb8dd550881a80aecea6af2db8f9b4245919a5d
    Public key SHA-256 df1740a24b2d5fd0314a05025131243a12ed4b2a4d88ef99e7784726e221491f
    PhishDestroy
    Addresses
    104.21.86.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.236 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.86.82, 172.67.216.236): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    s2-fantom.foundation
    Registered
    2025-11-19 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  19. www.lludll.uk US · AS13335 · Cloudflare, Inc.
    ListedCloudflareUnder lludll.uk, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 13 d ago
    DetailsHide
    Hostname
    www.lludll.uk
    First seen
    2026-11-09 10:40 UTC
    Listing
    CERT Polska listed it 2026-11-06 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska, listing lludll.uk and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:36 UTC to 2027-02-07 10:36 UTC
    Logged 2026-11-09 10:36 UTC in DigiCert Wyvern2027h1, entry 467,123,123
    SHA-256 a7655ba5a53136d8d5ad93524e619cdf3c1aeb9f5786511dbe4e6d87ed56b35b
    Public key SHA-256 c4c13bcbb863e436dbeabe2e2b74fd129daf215e87e6e13909f88a09af0bc141
    Addresses
    104.16.211.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.16.211.68): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lludll.uk
    Registered
    2026-10-27 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  20. www.yhsssy.uk US · AS13335 · Cloudflare, Inc.
    ListedCloudflareUnder yhsssy.uk, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 13 d ago
    DetailsHide
    Hostname
    www.yhsssy.uk
    First seen
    2026-11-09 10:40 UTC
    Listing
    CERT Polska listed it 2026-10-29 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska, listing yhsssy.uk and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:38 UTC to 2027-02-07 10:38 UTC
    Logged 2026-11-09 10:38 UTC in Google PlumbersArms2027h1, entry 696,342,830
    SHA-256 638ce59ee146617a6c094330ce4abf454477fe10d2f31b0ca36b5e77b4b4390a
    Public key SHA-256 03491ccf17794b4173a2caaf6fbfefc232701e43bf397353f50c5d027c0d4b31
    Addresses
    104.16.211.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.16.211.68): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    yhsssy.uk
    Registered
    2026-10-27 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 07:55 UTC

    Suggest a correction

  21. www.yugalpachori.in CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ReportedHostingerUnder yugalpachori.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 20 mo ago
    DetailsHide
    Hostname
    www.yugalpachori.in
    First seen
    2026-11-09 10:40 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing yugalpachori.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 09:39 UTC to 2027-02-07 09:39 UTC
    Logged 2026-11-09 10:38 UTC in Google ParcelYard2027h1, entry 696,066,616
    SHA-256 5c428613f63eaa52916235587b283973f62718b44861ee99982f81a22d452c06
    Public key SHA-256 649cbdec47e49478e9c3f9f2a1b6ea0cf5a6eee6dc571f18dc6840a18aae6544
    PhishDestroy
    Addresses
    77.37.53.80 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    93.127.179.192 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (77.37.53.80, 93.127.179.192): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    yugalpachori.in
    Registered
    2025-03-11 · OVI HOSTING PVT LTD
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  22. yugalpachori.in CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ReportedHostingerReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 20 mo ago
    DetailsHide
    Hostname
    yugalpachori.in
    First seen
    2026-11-09 10:40 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 09:39 UTC to 2027-02-07 09:39 UTC
    Logged 2026-11-09 10:38 UTC in Google ParcelYard2027h1, entry 696,066,616
    SHA-256 5c428613f63eaa52916235587b283973f62718b44861ee99982f81a22d452c06
    Public key SHA-256 649cbdec47e49478e9c3f9f2a1b6ea0cf5a6eee6dc571f18dc6840a18aae6544
    PhishDestroy
    Addresses
    77.37.83.129 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    91.108.98.152 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (77.37.83.129, 91.108.98.152): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    yugalpachori.in
    Registered
    2025-03-11 · OVI HOSTING PVT LTD
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  23. www.asterdex.uk PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Aster DEX
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 17 mo ago
    DetailsHide
    Hostname
    www.asterdex.uk
    First seen
    2026-11-09 10:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 09:33 UTC to 2027-02-07 09:33 UTC
    Logged 2026-11-09 10:32 UTC in Let's Encrypt Sycamore2027h1, entry 1,081,222,572
    SHA-256 69f5572cbcc2ddbe369acd5c48922176a0ae7e51da19c217a8252d95aa2bcefc
    Public key SHA-256 2c55c195591bcff46d4294f19af276bf53eedf155b45d2698c5160af72831573
    Brand
    Aster DEX
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    asterdex.uk
    Registered
    2025-07-02 · Key-Systems GmbH
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 10:37 UTC

    Suggest a correction

  24. minecraft-apksdownload.com US · AS19318 · Interserver, IncMinecraft
    Phishing hostInterserverAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 9 d ago
    DetailsHide
    Hostname
    minecraft-apksdownload.com
    First seen
    2026-11-09 10:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 64.20.39.203.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 64.20.39.203
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:35 UTC to 2027-02-07 09:35 UTC
    Logged 2026-11-09 10:34 UTC in Google ParcelYard2027h1, entry 695,999,564
    SHA-256 70c1ca344581093c21808b8200f15165f11a25cac4be8bac3555f4f6bc17b3c3
    Public key SHA-256 fda1db5c695768667f50d00580ff883f038255c34916ec252782a10b84e0740a
    Brand
    Minecraft
    Addresses
    64.20.39.203 · United States · AS19318 IS-AS-1 - Interserver, Inc · Interserver (shared hosting)
    Interserver
    Interserver (64.20.39.203): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    minecraft-apksdownload.com
    Registered
    2026-10-31 · NameCheap, Inc.
    MX
    Receives mail at minecraft-apksdownload.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  25. asterdex.uk PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Aster DEX
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 17 mo ago
    DetailsHide
    Hostname
    asterdex.uk
    First seen
    2026-11-09 10:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 09:33 UTC to 2027-02-07 09:33 UTC
    Logged 2026-11-09 10:32 UTC in Let's Encrypt Sycamore2027h1, entry 1,081,222,572
    SHA-256 69f5572cbcc2ddbe369acd5c48922176a0ae7e51da19c217a8252d95aa2bcefc
    Public key SHA-256 2c55c195591bcff46d4294f19af276bf53eedf155b45d2698c5160af72831573
    Brand
    Aster DEX
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    asterdex.uk
    Registered
    2025-07-02 · Key-Systems GmbH
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 10:37 UTC

    Suggest a correction

  26. anchomrcn.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    anchomrcn.com
    First seen
    2026-11-09 10:35 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:32 UTC to 2027-02-07 10:30 UTC
    Logged 2026-11-09 10:32 UTC in DigiCert Sphinx2027h1, entry 413,561,790
    SHA-256 eb48dd1b592b009b2af15bfc651fe01af5e5060bebe35c12d4414f29edfe8435
    Public key SHA-256 2341d716c49233bb7b6ebd3ea53061ded67baedb528fab1961fe730c5f686bff
    PhishDestroy
    Addresses
    104.21.38.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.168.36 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.38.153, 172.67.168.36): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    anchomrcn.com
    Registered
    2026-09-11 · Gransy, s.r.o.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  27. arcticwwf-api.stage.io-ext.se BE · AS34762 · COMBELL-AS Combell NV
    ListedUnder io-ext.se, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    arcticwwf-api.stage.io-ext.se
    First seen
    2026-11-09 10:35 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask, listing io-ext.se and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:31 UTC to 2027-02-07 09:31 UTC
    Logged 2026-11-09 10:30 UTC in Google ParcelYard2027h1, entry 695,935,640
    SHA-256 389a6eed5bd1fc9bedb5221dabd80ecab77193cb56ec307d5f2a42af1a8c5eb4
    Public key SHA-256 5cb81934c3444efbe5027560e847a717d59b1fc2ee52a67f7747df4ffc07db29
    Addresses
    188.208.37.137 · Belgium · AS34762 COMBELL-AS Combell NV
    Domain
    io-ext.se
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:17 UTC

    Suggest a correction

  28. baradua.it BE · AS34762 · COMBELL-AS Combell NV
    ReportedReported by PhishDestroyMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    baradua.it
    First seen
    2026-11-09 10:35 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 10:14 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:35 UTC to 2027-02-07 09:35 UTC
    Logged 2026-11-09 10:33 UTC in Google ParcelYard2027h1, entry 695,986,939
    SHA-256 0d12cdbcd86d40b331a946b1c8d811ded0f8bc895f0f8795279aba1eadbae4d5
    Public key SHA-256 fad30094440d7eb19e1970d508d866b09042907f0b3ecfac109a08e77903436b
    PhishDestroy
    Addresses
    213.158.79.22 · Belgium · AS34762 COMBELL-AS Combell NV
    Domain
    baradua.it
    MX
    Receives mail at mail.register.it
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 09:24 UTC

    Suggest a correction

  29. com.togg-turk.com
    ListedUnder togg-turk.com, listed by USOMMX presentSPF ~allDMARC policy noneRegistered 2 d ago
    DetailsHide
    Hostname
    com.togg-turk.com
    First seen
    2026-11-09 10:35 UTC
    Listing
    USOM listed it 2026-11-07 · still listed at the last successful feed check 2026-11-09 10:11 UTC
    Listed
    USOM, listing togg-turk.com and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:33 UTC to 2027-02-07 09:33 UTC
    Logged 2026-11-09 10:31 UTC in IPng Networks Gouda2027h1, entry 362,986,370
    SHA-256 3b30c4cf44b4bae74345a12808419f903889022c3a7d7eacaf370b528b1817bb
    Public key SHA-256 ff36de911e75d83c1ddf93d010cdeab1e85de5decd5af252c37d95cdfee1fec2
    Domain
    togg-turk.com
    Registered
    2026-11-07 · Sollutium EU sp. z o.o.
    MX
    Receives mail at togg-turk.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 11:36 UTC

    Suggest a correction

  30. jpharoenterprises.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    jpharoenterprises.com
    First seen
    2026-11-09 10:35 UTC
    Listing
    CERT Polska listed it 2026-09-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:33 UTC to 2027-02-07 10:31 UTC
    Logged 2026-11-09 10:33 UTC in Google ParcelYard2027h1, entry 695,979,657
    SHA-256 a54191740377aa8ba602237cfbdbb441140a23aa2aab327f45ca2433049147cc
    Public key SHA-256 9156c86a7891850fd63203730ec1c69d117819e1b32bb3acbd193dd67811a00e
    Addresses
    104.21.77.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.204.120 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.77.44, 172.67.204.120): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jpharoenterprises.com
    Registered
    2026-01-18 · Wild West Domains, LLC
    MX
    Receives mail at route1.mx.cloudflare.net, route3.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  31. qz0op.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    qz0op.xyz
    First seen
    2026-11-09 10:35 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 09:34 UTC to 2027-02-07 09:34 UTC
    Logged 2026-11-09 10:32 UTC in Google ParcelYard2027h1, entry 695,974,651
    SHA-256 055fc4582cb3238f03fb7d4a2df0af022a0832a03e3fb407158161c99d1fbb96
    Public key SHA-256 1ef56d6ffe1d4547f95f4490a204c0fbe1a156513c603610561be4ae0ab64117
    Addresses
    104.21.68.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.154 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.10, 172.67.184.154): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qz0op.xyz
    Registered
    2026-03-17 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  32. qzovarel-france.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    qzovarel-france.com
    First seen
    2026-11-09 10:35 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 09:31 UTC to 2027-02-07 10:29 UTC
    Logged 2026-11-09 10:33 UTC in DigiCert Wyvern2027h1, entry 467,090,580
    SHA-256 286a08b5673885bb1420ee383202c05a90649cc237709175d2f85fdecb3292d3
    Public key SHA-256 c29d2d2be5e52f06895fd2daa68c0bd5c196a632cc427d4adf62924cec45dce3
    Addresses
    104.21.37.19 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.202.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.37.19, 172.67.202.158): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qzovarel-france.com
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  33. rabbitmq.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    rabbitmq.fresh-focus.pro
    First seen
    2026-11-09 10:35 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 09:32 UTC to 2027-02-07 09:32 UTC
    Logged 2026-11-09 10:30 UTC in IPng Networks Gouda2027h1, entry 362,978,951
    SHA-256 01ad69574c58a55a247a6a0918779d3022f7fda0f0eeb4e0ab57387987030846
    Public key SHA-256 f754514ebd5d3287f792f019c6f04c9c7e9d501cc789662a2188945bfa188da5
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  34. www.arcticwwf-api.stage.io-ext.se BE · AS34762 · COMBELL-AS Combell NV
    ListedUnder io-ext.se, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.arcticwwf-api.stage.io-ext.se
    First seen
    2026-11-09 10:35 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask, listing io-ext.se and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:31 UTC to 2027-02-07 09:31 UTC
    Logged 2026-11-09 10:30 UTC in Google ParcelYard2027h1, entry 695,935,640
    SHA-256 389a6eed5bd1fc9bedb5221dabd80ecab77193cb56ec307d5f2a42af1a8c5eb4
    Public key SHA-256 5cb81934c3444efbe5027560e847a717d59b1fc2ee52a67f7747df4ffc07db29
    Addresses
    188.208.37.137 · Belgium · AS34762 COMBELL-AS Combell NV
    Domain
    io-ext.se
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:17 UTC

    Suggest a correction

  35. www.baradua.it BE · AS34762 · COMBELL-AS Combell NV
    ReportedUnder baradua.it, reported by PhishDestroyMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.baradua.it
    First seen
    2026-11-09 10:35 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing baradua.it and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:35 UTC to 2027-02-07 09:35 UTC
    Logged 2026-11-09 10:33 UTC in Google ParcelYard2027h1, entry 695,986,939
    SHA-256 0d12cdbcd86d40b331a946b1c8d811ded0f8bc895f0f8795279aba1eadbae4d5
    Public key SHA-256 fad30094440d7eb19e1970d508d866b09042907f0b3ecfac109a08e77903436b
    PhishDestroy
    Addresses
    213.158.79.22 · Belgium · AS34762 COMBELL-AS Combell NV
    Domain
    baradua.it
    MX
    Receives mail at mail.register.it
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 09:24 UTC

    Suggest a correction

  36. www.e-tog.com.togg-turk.com PL · AS43641 · Sollutium-NL SOLLUTIUM EU S…
    ListedUnder togg-turk.com, listed by USOMMX presentSPF ~allDMARC policy noneRegistered 2 d ago
    DetailsHide
    Hostname
    www.e-tog.com.togg-turk.com
    First seen
    2026-11-09 10:35 UTC
    Listing
    USOM listed it 2026-11-07 · still listed at the last successful feed check 2026-11-09 10:11 UTC
    Listed
    USOM, listing togg-turk.com and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:33 UTC to 2027-02-07 09:33 UTC
    Logged 2026-11-09 10:31 UTC in IPng Networks Gouda2027h1, entry 362,986,370
    SHA-256 3b30c4cf44b4bae74345a12808419f903889022c3a7d7eacaf370b528b1817bb
    Public key SHA-256 ff36de911e75d83c1ddf93d010cdeab1e85de5decd5af252c37d95cdfee1fec2
    Addresses
    195.160.223.206 · Poland · AS43641 Sollutium-NL SOLLUTIUM EU Sp z.o.o.
    Domain
    togg-turk.com
    Registered
    2026-11-07 · Sollutium EU sp. z o.o.
    MX
    Receives mail at togg-turk.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 11:36 UTC

    Suggest a correction

  37. www.togg-siparis.com.togg-turk.com PL · AS43641 · Sollutium-NL SOLLUTIUM EU S…
    ListedUnder togg-turk.com, listed by USOMMX presentSPF ~allDMARC policy noneRegistered 2 d ago
    DetailsHide
    Hostname
    www.togg-siparis.com.togg-turk.com
    First seen
    2026-11-09 10:35 UTC
    Listing
    USOM listed it 2026-11-07 · still listed at the last successful feed check 2026-11-09 10:11 UTC
    Listed
    USOM, listing togg-turk.com and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:33 UTC to 2027-02-07 09:33 UTC
    Logged 2026-11-09 10:31 UTC in IPng Networks Gouda2027h1, entry 362,986,370
    SHA-256 3b30c4cf44b4bae74345a12808419f903889022c3a7d7eacaf370b528b1817bb
    Public key SHA-256 ff36de911e75d83c1ddf93d010cdeab1e85de5decd5af252c37d95cdfee1fec2
    Addresses
    195.160.223.206 · Poland · AS43641 Sollutium-NL SOLLUTIUM EU Sp z.o.o.
    Domain
    togg-turk.com
    Registered
    2026-11-07 · Sollutium EU sp. z o.o.
    MX
    Receives mail at togg-turk.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 11:36 UTC

    Suggest a correction

  38. xoxtw.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    xoxtw.xyz
    First seen
    2026-11-09 10:35 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:32 UTC to 2027-02-07 10:29 UTC
    Logged 2026-11-09 10:32 UTC in Let's Encrypt Willow2027h1, entry 1,036,813,646
    SHA-256 cfbbceca64e0dc82670775f12be3880ead4892713b833c4794e35170bf8f6587
    Public key SHA-256 0fbcf027f2a84806e4e7fb525ce9c699d218135b7f3fa719064dceb3a1424316
    Addresses
    104.21.26.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.135.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.26.91, 172.67.135.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xoxtw.xyz
    Registered
    2026-01-17 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  39. allyspin-casino-france.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    allyspin-casino-france.com
    First seen
    2026-11-09 10:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:25 UTC to 2027-02-07 10:25 UTC
    Logged 2026-11-09 10:25 UTC in DigiCert Wyvern2027h1, entry 466,997,466
    SHA-256 279b8b11e3f3dcd4131f0029805e35c414036f863a8a9aa105787065c93235d4
    Public key SHA-256 e861fd8ff1e5d41e11b505d254d790f9b8b7641b79d4b24a450f7c8ef506bd44
    PhishDestroy
    Addresses
    104.21.31.202 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.179.240 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.31.202, 172.67.179.240): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    allyspin-casino-france.com
    Registered
    2026-02-02 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:31 UTC

    Suggest a correction

  40. birikimfonculuk.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    birikimfonculuk.org
    First seen
    2026-11-09 10:30 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 09:28 UTC to 2027-02-07 09:28 UTC
    Logged 2026-11-09 10:26 UTC in IPng Networks Gouda2027h1, entry 362,952,625
    SHA-256 1f4a76d5b42646f19de29eb72bfa1264b62fc9fc307a0b937d677001b627130c
    Public key SHA-256 2dd840f163479134469f777b786c291c8149c8e2239a3f35749218e17c9bbb38
    Addresses
    104.21.57.60 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.57.60, 172.67.159.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    birikimfonculuk.org
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  41. blumenrealty.com.br US · AS40021 · Contabo Inc.
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 13 y ago
    DetailsHide
    Hostname
    blumenrealty.com.br
    First seen
    2026-11-09 10:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 09:29 UTC to 2027-02-07 09:29 UTC
    Logged 2026-11-09 10:28 UTC in IPng Networks Halloumi2027h1, entry 425,102,479
    SHA-256 0f8f3b5023b29638d9d091b9bd9c728c4aa149ba5f0ddba4381863518d80d46a
    Public key SHA-256 3cdb95f0f27957381bcbf17d83441380c3e5fabc32c4cce5789a7218b2d36102
    PhishDestroy
    Addresses
    207.244.245.47 · United States · AS40021 CONTABO-40021 - Contabo Inc.
    Domain
    blumenrealty.com.br
    Registered
    2013-09-16
    MX
    Receives mail at venus.bluhost.net.br
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  42. casinos-dragonia-france.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    casinos-dragonia-france.com
    First seen
    2026-11-09 10:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 09:26 UTC to 2027-02-07 10:24 UTC
    Logged 2026-11-09 10:26 UTC in Geomys Tuscolo2027h1, entry 542,861,200
    SHA-256 181f9bec0981d535e7d3d2b794474015fe81b73380f0a2211a98743a8f56d712
    Public key SHA-256 d61f62efb89728ed9e253d9289374360bb0abce6b0df92aff98bd3b5342f9019
    PhishDestroy
    Addresses
    104.21.29.188 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.29.188, 172.67.149.158): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    casinos-dragonia-france.com
    Registered
    2026-04-09 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  43. s2.sm-shopxyz.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    s2.sm-shopxyz.com
    First seen
    2026-11-09 10:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:26 UTC to 2027-02-07 09:26 UTC
    Logged 2026-11-09 10:25 UTC in Google ParcelYard2027h1, entry 695,855,065
    SHA-256 135d42e991c653957747d51aef8fe8ff1646ca0b9ef223ebe861757c623b21ef
    Public key SHA-256 97547cf19023d032691fa4fe655314d3b64e693fae2895d9b263feb6009d52e3
    Addresses
    104.21.64.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.174 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.117, 172.67.183.174): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sm-shopxyz.com
    Registered
    2026-06-23 · Aceville Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  44. techendyshopping.shop
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    techendyshopping.shop
    First seen
    2026-11-09 10:30 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 09:30 UTC to 2027-02-07 09:30 UTC
    Logged 2026-11-09 10:29 UTC in DigiCert Sphinx2027h1, entry 413,531,422
    SHA-256 b000ad4d30e86e4343e710a50b002fad437e521b58508ae400b7fe4865a8a9e7
    Public key SHA-256 951a276f51668285acc6969c9e429cb20878533061141803811135ef662f224c
    Domain
    techendyshopping.shop
    Registered
    2026-09-11 · Alibaba Cloud Computing Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  45. tesscogames.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tesscogames.com
    First seen
    2026-11-09 10:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 09:29 UTC to 2027-02-07 09:29 UTC
    Logged 2026-11-09 10:27 UTC in Google ParcelYard2027h1, entry 695,897,744
    SHA-256 a3ed1102882f5c0602f5d766bab99f834c4bd4b53ae9a111d2b6af388362c943
    Public key SHA-256 80211820f2d055e055391c4fc741f972facd034551867dcec306691cbcef95a3
    PhishDestroy
    Addresses
    104.21.57.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.190.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.57.117, 172.67.190.89): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tesscogames.com
    Registered
    2026-05-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  46. trezor-login-7ko.pages.dev US · AS13335 · Cloudflare, Inc.4 addressesTrezor
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-login-7ko.pages.dev
    First seen
    2026-11-09 10:30 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:25 UTC to 2027-02-07 10:24 UTC
    Logged 2026-11-09 10:25 UTC in IPng Networks Halloumi2027h1, entry 425,066,721
    SHA-256 af02b76ce271d8de8e1178db7635aafa9d3b4547e06648fcfc3843b580970c39
    Public key SHA-256 07e215868376da2a81dba03065d80c1b6f17d5669c61dea1dfe016ce395a5b82
    Brand
    Trezor
    Addresses
    172.66.45.36 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.220 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d24
    2606:4700:310c::ac42:2edc
    Cloudflare
    Cloudflare (172.66.45.36, 172.66.46.220): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  47. tttttttttttttttttttttttttttttttttttttttttttttttttttt.cryptopayment.xyz US · AS14061 · DigitalOcean, LLC
    ListedDigitalOceanUnder cryptopayment.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    tttttttttttttttttttttttttttttttttttttttttttttttttttt.cryptopayment.xyz
    First seen
    2026-11-09 10:30 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask, listing cryptopayment.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 09:30 UTC to 2027-02-07 09:30 UTC
    Logged 2026-11-09 10:28 UTC in Let's Encrypt Willow2027h1, entry 1,036,718,319
    SHA-256 2e91f15ddbc38955457ab641e797ff2c26abd97ea8b6a0f896cd9812dc0a7678
    Public key SHA-256 0cfef355090b7d7c71b2d136b1251568c12fab990a82048e0c1008b56355a06d
    Addresses
    143.244.211.82 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (143.244.211.82): a cloud provider. It rents servers and addresses to its customers.
    Domain
    cryptopayment.xyz
    Registered
    2020-11-20 · Interstellar Registrar Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  48. whm.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    whm.fresh-focus.pro
    First seen
    2026-11-09 10:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:28 UTC to 2027-02-07 09:28 UTC
    Logged 2026-11-09 10:26 UTC in Geomys Tuscolo2027h1, entry 542,865,015
    SHA-256 d9bf212398e81095359c8a748be8f163b9b490975361dfd429f93034886f71b0
    Public key SHA-256 6c211494bedf4751f427538b4345a0364e51af018f30e861e7591bf8fbd55251
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  49. www.residencialmaldivas.blumenrealty.com.br US · AS40021 · Contabo Inc.
    ReportedUnder blumenrealty.com.br, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 13 y ago
    DetailsHide
    Hostname
    www.residencialmaldivas.blumenrealty.com.br
    First seen
    2026-11-09 10:30 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing blumenrealty.com.br and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 09:29 UTC to 2027-02-07 09:29 UTC
    Logged 2026-11-09 10:28 UTC in IPng Networks Halloumi2027h1, entry 425,102,479
    SHA-256 0f8f3b5023b29638d9d091b9bd9c728c4aa149ba5f0ddba4381863518d80d46a
    Public key SHA-256 3cdb95f0f27957381bcbf17d83441380c3e5fabc32c4cce5789a7218b2d36102
    PhishDestroy
    Addresses
    207.244.245.47 · United States · AS40021 CONTABO-40021 - Contabo Inc.
    Domain
    blumenrealty.com.br
    Registered
    2013-09-16
    MX
    Receives mail at venus.bluhost.net.br
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  50. auesy.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    auesy.asia
    First seen
    2026-11-09 10:25 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:23 UTC to 2027-02-07 10:22 UTC
    Logged 2026-11-09 10:23 UTC in Google PlumbersArms2027h1, entry 696,099,850
    SHA-256 c2ba850453995ac485a6f3e9aec90c25039b1089a64d48104587e4664ffe8a5b
    Public key SHA-256 0c257ef791e6836196b79ff388ddb638fe6b7d4bde798cb9a51f5140992af40b
    Addresses
    104.21.42.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.170 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.42.229, 172.67.167.170): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    auesy.asia
    Registered
    2026-07-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  51. bbb.clouddlare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouddlare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    bbb.clouddlare.net
    First seen
    2026-11-09 10:25 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Listed
    MetaMask, listing clouddlare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:23 UTC to 2027-02-07 09:23 UTC
    Logged 2026-11-09 10:21 UTC in IPng Networks Halloumi2027h1, entry 425,019,131
    SHA-256 171831e8a74a7fdec3e03e90cf29d6230827d2ef364432835d40ed5ef46f5c3c
    Public key SHA-256 571568c8945c1c8fcd2b19bdf6077fd4042c195a8a39bcb85f3f559fc9b4d3a1
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouddlare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:15 UTC

    Suggest a correction

  52. creativemanshopping.shop
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    creativemanshopping.shop
    First seen
    2026-11-09 10:25 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 09:23 UTC to 2027-02-07 09:23 UTC
    Logged 2026-11-09 10:21 UTC in Google ParcelYard2027h1, entry 695,784,373
    SHA-256 7447f46a49ba94953dcd9e4057b54b64ec34fb5e45bdfccfbf33429a000f5c9f
    Public key SHA-256 d39841dfadb8e7d98c0374d5f1f560aaaee1d02ae70a0d4877fa3ff7849dda03
    Domain
    creativemanshopping.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:26 UTC

    Suggest a correction

  53. halo-hold.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    halo-hold.pages.dev
    First seen
    2026-11-09 10:25 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:24 UTC to 2027-02-07 10:21 UTC
    Logged 2026-11-09 10:24 UTC in Google ParcelYard2027h1, entry 695,835,431
    SHA-256 973082015025287671f63920a200726ff00ae22f66697fa70b48700fd6faf9f7
    Public key SHA-256 75359c6c2c293d1d0641b3ba12955aae0e896513d150f5da16c0d601fdaf6f11
    Addresses
    172.66.44.105 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.151 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.105, 172.66.47.151): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  54. konimqh.study US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    konimqh.study
    First seen
    2026-11-09 10:25 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:23 UTC to 2027-02-07 10:22 UTC
    Logged 2026-11-09 10:23 UTC in DigiCert Wyvern2027h1, entry 466,964,101
    SHA-256 ea91e65156350e98d71747dca9e5e51d806d8d6bf5744938e0c626d0394b6fe8
    Public key SHA-256 e25835d719a2e3234df5068a287cbeca04eec4b53077d32c621dd29305dbae27
    PhishDestroy
    Addresses
    104.21.95.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.24 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.95.97, 172.67.144.24): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    konimqh.study
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  55. lib.clouddlare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouddlare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    lib.clouddlare.net
    First seen
    2026-11-09 10:25 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Listed
    MetaMask, listing clouddlare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:23 UTC to 2027-02-07 09:23 UTC
    Logged 2026-11-09 10:21 UTC in IPng Networks Halloumi2027h1, entry 425,019,131
    SHA-256 171831e8a74a7fdec3e03e90cf29d6230827d2ef364432835d40ed5ef46f5c3c
    Public key SHA-256 571568c8945c1c8fcd2b19bdf6077fd4042c195a8a39bcb85f3f559fc9b4d3a1
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouddlare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:15 UTC

    Suggest a correction

  56. lobigoi.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX presentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    lobigoi.pro
    First seen
    2026-11-09 10:25 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:24 UTC to 2027-02-07 10:21 UTC
    Logged 2026-11-09 10:24 UTC in Google ParcelYard2027h1, entry 695,833,462
    SHA-256 f3b7ac312d1cb47aaee1059ea97c7539023e9b35f0aa26db257b20d522b0b960
    Public key SHA-256 b7f405441665533f57741f7cc5fe0b21db65543ce9b2b151d1ba5845726fe050
    Addresses
    104.21.40.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.157.9 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.40.207, 172.67.157.9): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lobigoi.pro
    Registered
    2026-07-14 · NameCheap, Inc.
    MX
    Receives mail at mail.lobigoi.pro
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  57. nexus.clouddlare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouddlare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    nexus.clouddlare.net
    First seen
    2026-11-09 10:25 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Listed
    MetaMask, listing clouddlare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:23 UTC to 2027-02-07 09:23 UTC
    Logged 2026-11-09 10:21 UTC in IPng Networks Halloumi2027h1, entry 425,019,131
    SHA-256 171831e8a74a7fdec3e03e90cf29d6230827d2ef364432835d40ed5ef46f5c3c
    Public key SHA-256 571568c8945c1c8fcd2b19bdf6077fd4042c195a8a39bcb85f3f559fc9b4d3a1
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouddlare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:15 UTC

    Suggest a correction

  58. nyolo.shop
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    nyolo.shop
    First seen
    2026-11-09 10:25 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 09:21 UTC to 2027-02-07 09:21 UTC
    Logged 2026-11-09 10:19 UTC in Google ParcelYard2027h1, entry 695,747,493
    SHA-256 5c2cf003e81c49e98553e78cdfdf9a054b11d29401e16330ac89b0e76a26d958
    Public key SHA-256 e64e3e96bd0679c069a36617dec501459d193840cebc0b6385c0d7f7546bdb3b
    Domain
    nyolo.shop
    Registered
    2026-05-16 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  59. zh.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    zh.save-whatsapp.com
    First seen
    2026-11-09 10:22 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  60. www.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.save-whatsapp.com
    First seen
    2026-11-09 10:22 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  61. wap.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    wap.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  62. web.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    web.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  63. site.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    site.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  64. save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  65. pc.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    pc.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  66. portal.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    portal.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  67. online.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    online.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  68. login.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    login.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  69. m.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    m.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  70. info.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    info.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  71. home.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    home.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  72. h5.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    h5.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  73. guide.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    guide.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  74. en.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    en.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  75. desktop.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    desktop.save-whatsapp.com
    First seen
    2026-11-09 10:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  76. cn.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    cn.save-whatsapp.com
    First seen
    2026-11-09 10:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  77. chat.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    chat.save-whatsapp.com
    First seen
    2026-11-09 10:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  78. bitcoin-mixer-top.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    bitcoin-mixer-top.com
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:19 UTC to 2027-02-07 10:17 UTC
    Logged 2026-11-09 10:19 UTC in IPng Networks Halloumi2027h1, entry 424,992,683
    SHA-256 4e9741432ac5ec03edf0bfb52614c576c8dda453b5a26d1b103ab46cf89fb4aa
    Public key SHA-256 7d9b9261dbddef03b83bf7f203836073d081d6b0dc1bb3d923de74c061c75e7b
    PhishDestroy
    Addresses
    104.21.17.180 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.177.192 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.17.180, 172.67.177.192): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bitcoin-mixer-top.com
    Registered
    2026-01-17 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:21 UTC

    Suggest a correction

  79. com.penkarhomegroup.in
    ReportedUnder penkarhomegroup.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    com.penkarhomegroup.in
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing penkarhomegroup.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:17 UTC to 2027-02-07 09:17 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,691,535
    SHA-256 11c77eddefa5cd965c8d96599f23e650b96287fcb0a956d61ccac06b98e05476
    Public key SHA-256 04f57d14fd00a47c8484ea4de71b99f3db00a74067d3b963fb653505c6a99ac2
    PhishDestroy
    Domain
    penkarhomegroup.in
    Registered
    2024-02-07 · GoDaddy
    MX
    Receives mail at mail.penkarhomegroup.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  80. deepanshuenterprises.in.penkarhomegroup.in IN · AS133296 · Web Werks India Pvt. Ltd.
    ReportedUnder penkarhomegroup.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    deepanshuenterprises.in.penkarhomegroup.in
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing penkarhomegroup.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:17 UTC to 2027-02-07 09:17 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,691,535
    SHA-256 11c77eddefa5cd965c8d96599f23e650b96287fcb0a956d61ccac06b98e05476
    Public key SHA-256 04f57d14fd00a47c8484ea4de71b99f3db00a74067d3b963fb653505c6a99ac2
    PhishDestroy
    Addresses
    103.108.220.133 · India · AS133296 WEBWERKS-AS-IN - Web Werks India Pvt. Ltd.
    Domain
    penkarhomegroup.in
    Registered
    2024-02-07 · GoDaddy
    MX
    Receives mail at mail.penkarhomegroup.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  81. eligibilitychecker.fun US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    eligibilitychecker.fun
    First seen
    2026-11-09 10:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:18 UTC to 2027-02-07 10:17 UTC
    Logged 2026-11-09 10:18 UTC in Google ParcelYard2027h1, entry 695,734,686
    SHA-256 bde69d087862df46c0f94be8db3c049652004b00cd4307efcae3fd09d94e27e4
    Public key SHA-256 fa0dddfd0b18b77571800d176de6236c44163ccc3e4a47c29015ab27c920303e
    Addresses
    104.21.19.131 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.103 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.19.131, 172.67.186.103): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    eligibilitychecker.fun
    Registered
    2026-07-14 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  82. gangaa.co.in.penkarhomegroup.in IN · AS133296 · Web Werks India Pvt. Ltd.
    ReportedUnder penkarhomegroup.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    gangaa.co.in.penkarhomegroup.in
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing penkarhomegroup.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:17 UTC to 2027-02-07 09:17 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,691,535
    SHA-256 11c77eddefa5cd965c8d96599f23e650b96287fcb0a956d61ccac06b98e05476
    Public key SHA-256 04f57d14fd00a47c8484ea4de71b99f3db00a74067d3b963fb653505c6a99ac2
    PhishDestroy
    Addresses
    103.108.220.133 · India · AS133296 WEBWERKS-AS-IN - Web Werks India Pvt. Ltd.
    Domain
    penkarhomegroup.in
    Registered
    2024-02-07 · GoDaddy
    MX
    Receives mail at mail.penkarhomegroup.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  83. mitarchive.info US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 y ago
    DetailsHide
    Hostname
    mitarchive.info
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 09:19 UTC to 2027-02-07 09:19 UTC
    Logged 2026-11-09 10:17 UTC in IPng Networks Gouda2027h1, entry 362,881,635
    SHA-256 920b084b967f551e1d7bc0480140ea731df3f1471e2e1755538425d45d464b7e
    Public key SHA-256 b7d7c8cb11bcab5e05da26e5bd180e739ebe9ae0a263c4beeec70e3c2e611011
    PhishDestroy
    Addresses
    104.21.18.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.105 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.18.221, 172.67.183.105): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mitarchive.info
    Registered
    2014-07-27 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  84. novafintrade.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    novafintrade.com
    First seen
    2026-11-09 10:20 UTC
    Listing
    CERT Polska listed it 2026-09-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 09:20 UTC to 2027-02-07 09:20 UTC
    Logged 2026-11-09 10:18 UTC in Google ParcelYard2027h1, entry 695,730,712
    SHA-256 0c25d158e051eb00efaabe58578831b401e93623389e92947414637fe150b4d3
    Public key SHA-256 b9bef006fe85a5ef672a46800c5d3966865d25aa13e6754984152b566d9ad602
    Addresses
    104.21.27.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.143.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.27.251, 172.67.143.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    novafintrade.com
    Registered
    2026-07-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  85. partner.ni-electrical.com GB · AS201738 · UFO-TECHNOLOGIES-LIMITED UF…
    ListedUnder ni-electrical.com, listed by CERT PolskaMX absentSPF -allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    partner.ni-electrical.com
    First seen
    2026-11-09 10:20 UTC
    Listing
    CERT Polska listed it 2026-06-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Listed
    CERT Polska, listing ni-electrical.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:20 UTC to 2027-02-07 09:20 UTC
    Logged 2026-11-09 10:18 UTC in DigiCert Wyvern2027h1, entry 466,907,162
    SHA-256 3a7feac561b43bdc4378525db193695549daf32477c100bc6de339d8491aae15
    Public key SHA-256 308c5103487eab3a784157b22cbff20fd975ffacf187be77d18bc012852a3129
    Addresses
    109.238.86.5 · United Kingdom · AS201738 UFO-TECHNOLOGIES-LIMITED UFO TECHNOLOGIES LIMITED
    Domain
    ni-electrical.com
    Registered
    2022-01-02 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  86. sdja.8ea.ezgateway.net
    ListedUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    sdja.8ea.ezgateway.net
    First seen
    2026-11-09 10:20 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 10:11 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing RSA CA 4 · precertificate
    Valid 2026-11-09 10:07 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 10:17 UTC in DigiCert Wyvern2027h1, entry 466,899,625
    SHA-256 334686e8bcc71904a92ff94ca2d5408fb8d41a1be8070c998a3758a74c6c2956
    Public key SHA-256 68b6d510311770e6adf1d710f4c7891b0785d482aecd777169a3e12627d1515c
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  87. twtsystems.pro US · AS53667 · FranTech Solutions
    ListedListed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    twtsystems.pro
    First seen
    2026-11-09 10:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 06:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:18 UTC to 2027-02-07 09:18 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,694,445
    SHA-256 5479620786a444823bc34196a795207edb39ac8b2a44fd16c1f81b8adddd484e
    Public key SHA-256 1f769aa71e9067233234364803a252753d54fc04340cbb310a2dcc4747f75543
    Addresses
    198.251.89.220 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    twtsystems.pro
    Registered
    2026-05-18 · Dynadot Inc
    MX
    Receives mail at twtsystems.pro
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  88. vivanarcha.store US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    vivanarcha.store
    First seen
    2026-11-09 10:20 UTC
    Listing
    CERT Polska listed it 2026-09-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 09:19 UTC to 2027-02-07 09:19 UTC
    Logged 2026-11-09 10:18 UTC in Google PlumbersArms2027h1, entry 696,004,590
    SHA-256 91296cfa3d47f8dfc5f4d85ccd2882cf31ea8a834159b0e8692f88a90ce85334
    Public key SHA-256 cbd9881733da12705a5b603607cb02b0ae3aacf47aad138d940b46f5461005e5
    Addresses
    104.21.41.231 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.154 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.41.231, 172.67.195.154): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vivanarcha.store
    Registered
    2026-09-11 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  89. www.alphagogy.com.penkarhomegroup.in IN · AS133296 · Web Werks India Pvt. Ltd.
    ReportedUnder penkarhomegroup.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    www.alphagogy.com.penkarhomegroup.in
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing penkarhomegroup.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:17 UTC to 2027-02-07 09:17 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,691,535
    SHA-256 11c77eddefa5cd965c8d96599f23e650b96287fcb0a956d61ccac06b98e05476
    Public key SHA-256 04f57d14fd00a47c8484ea4de71b99f3db00a74067d3b963fb653505c6a99ac2
    PhishDestroy
    Addresses
    103.108.220.133 · India · AS133296 WEBWERKS-AS-IN - Web Werks India Pvt. Ltd.
    Domain
    penkarhomegroup.in
    Registered
    2024-02-07 · GoDaddy
    MX
    Receives mail at mail.penkarhomegroup.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  90. www.badrikakunjbagh.com.penkarhomegroup.in IN · AS133296 · Web Werks India Pvt. Ltd.
    ReportedUnder penkarhomegroup.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    www.badrikakunjbagh.com.penkarhomegroup.in
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing penkarhomegroup.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:17 UTC to 2027-02-07 09:17 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,691,535
    SHA-256 11c77eddefa5cd965c8d96599f23e650b96287fcb0a956d61ccac06b98e05476
    Public key SHA-256 04f57d14fd00a47c8484ea4de71b99f3db00a74067d3b963fb653505c6a99ac2
    PhishDestroy
    Addresses
    103.108.220.133 · India · AS133296 WEBWERKS-AS-IN - Web Werks India Pvt. Ltd.
    Domain
    penkarhomegroup.in
    Registered
    2024-02-07 · GoDaddy
    MX
    Receives mail at mail.penkarhomegroup.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  91. www.brldiagnostics.com.penkarhomegroup.in IN · AS133296 · Web Werks India Pvt. Ltd.
    ReportedUnder penkarhomegroup.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    www.brldiagnostics.com.penkarhomegroup.in
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing penkarhomegroup.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:17 UTC to 2027-02-07 09:17 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,691,535
    SHA-256 11c77eddefa5cd965c8d96599f23e650b96287fcb0a956d61ccac06b98e05476
    Public key SHA-256 04f57d14fd00a47c8484ea4de71b99f3db00a74067d3b963fb653505c6a99ac2
    PhishDestroy
    Addresses
    103.108.220.133 · India · AS133296 WEBWERKS-AS-IN - Web Werks India Pvt. Ltd.
    Domain
    penkarhomegroup.in
    Registered
    2024-02-07 · GoDaddy
    MX
    Receives mail at mail.penkarhomegroup.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  92. www.deepanshuenterprises.in.penkarhomegroup.in IN · AS133296 · Web Werks India Pvt. Ltd.
    ReportedUnder penkarhomegroup.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    www.deepanshuenterprises.in.penkarhomegroup.in
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing penkarhomegroup.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:17 UTC to 2027-02-07 09:17 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,691,535
    SHA-256 11c77eddefa5cd965c8d96599f23e650b96287fcb0a956d61ccac06b98e05476
    Public key SHA-256 04f57d14fd00a47c8484ea4de71b99f3db00a74067d3b963fb653505c6a99ac2
    PhishDestroy
    Addresses
    103.108.220.133 · India · AS133296 WEBWERKS-AS-IN - Web Werks India Pvt. Ltd.
    Domain
    penkarhomegroup.in
    Registered
    2024-02-07 · GoDaddy
    MX
    Receives mail at mail.penkarhomegroup.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  93. www.eliteschauffeurng.elitesholdingsng.com AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicUnder elitesholdingsng.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    www.eliteschauffeurng.elitesholdingsng.com
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-08 · still listed at the last successful feed check 2026-11-09 05:59 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-07 (13 days)
    Reported
    PhishDestroy, listing elitesholdingsng.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 09:16 UTC to 2027-02-07 09:16 UTC
    Logged 2026-11-09 10:14 UTC in Geomys Tuscolo2027h1, entry 542,706,560
    SHA-256 6836fd3dc5dca885db2601ef1bb632c0c5049e1c08ba9cce875f436b5fe59e37
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates elitesholdingsng.com to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    elitesholdingsng.com
    Registered
    2023-11-08 · NameSilo, LLC
    MX
    Receives mail at mail.eye-mail.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 11:15 UTC

    Suggest a correction

  94. www.gangaa.co.in.penkarhomegroup.in IN · AS133296 · Web Werks India Pvt. Ltd.
    ReportedUnder penkarhomegroup.in, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    www.gangaa.co.in.penkarhomegroup.in
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing penkarhomegroup.in and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 09:17 UTC to 2027-02-07 09:17 UTC
    Logged 2026-11-09 10:16 UTC in Google ParcelYard2027h1, entry 695,691,535
    SHA-256 11c77eddefa5cd965c8d96599f23e650b96287fcb0a956d61ccac06b98e05476
    Public key SHA-256 04f57d14fd00a47c8484ea4de71b99f3db00a74067d3b963fb653505c6a99ac2
    PhishDestroy
    Addresses
    103.108.220.133 · India · AS133296 WEBWERKS-AS-IN - Web Werks India Pvt. Ltd.
    Domain
    penkarhomegroup.in
    Registered
    2024-02-07 · GoDaddy
    MX
    Receives mail at mail.penkarhomegroup.in
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  95. www.mitarchive.info US · AS16509 · Amazon.com, Inc.
    ReportedAmazon Web ServicesUnder mitarchive.info, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 y ago
    DetailsHide
    Hostname
    www.mitarchive.info
    First seen
    2026-11-09 10:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 05:59 UTC
    Reported
    PhishDestroy, listing mitarchive.info and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 09:19 UTC to 2027-02-07 09:19 UTC
    Logged 2026-11-09 10:17 UTC in IPng Networks Gouda2027h1, entry 362,881,635
    SHA-256 920b084b967f551e1d7bc0480140ea731df3f1471e2e1755538425d45d464b7e
    Public key SHA-256 b7d7c8cb11bcab5e05da26e5bd180e739ebe9ae0a263c4beeec70e3c2e611011
    PhishDestroy
    Addresses
    52.57.98.65 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (52.57.98.65): a cloud provider. It rents servers and addresses to its customers.
    Domain
    mitarchive.info
    Registered
    2014-07-27 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  96. logowanieipko.michaelumzugsservice.com US · AS397423 · Tier.Net Technologies LLC
    ReportedReported by PhishTankMX presentSPF ~allDMARC policy noneRegistered 18 mo ago
    DetailsHide
    Hostname
    logowanieipko.michaelumzugsservice.com
    First seen
    2026-11-09 10:16 UTC
    Listing
    PhishTank: first observed in the feed 2026-11-09 · still listed at the last successful feed check 2026-11-09 10:14 UTC
    Reported
    PhishTank
    1. Certificate logged in CT
    2. Observed in the PhishTank feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-08 22:25 UTC to 2027-02-06 22:25 UTC
    Logged 2026-11-08 23:24 UTC in Google ParcelYard2027h1, entry 686,328,843
    SHA-256 d8710cfdfbcfc309c92d315f6c7dc8ba2d00104368435ebe3f8228e7815f82ba
    Public key SHA-256 7beee01eceab91f16f224bf4cb442a248d46ebbf671f706a409f6bb721252717
    PhishTank
    PhishTank report #9556901
    Addresses
    154.29.76.108 · United States · AS397423 TIER-NET - Tier.Net Technologies LLC
    Domain
    michaelumzugsservice.com
    Registered
    2025-05-16 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Receives mail at mail.webador.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  97. app.save-whatsapp.com HK · AS136038 · HDTIDC LIMITEDWhatsApp
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    app.save-whatsapp.com
    First seen
    2026-11-09 10:15 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.59.152.4
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 2.59.152.4.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 2.59.152.4
    Certificate
    Issued by YR1
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in Google PlumbersArms2027h1, entry 695,880,827
    SHA-256 29319d78a49a056b1ee14c1cefa799afee6953f6abb1c334494efae14647aed4
    Public key SHA-256 320349dcf1c66d70f934d72d60465f88fd6d3389b12c6cbb9cc6e0a2cae80eca
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    Domain
    save-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  98. accessiblebean.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    accessiblebean.com
    First seen
    2026-11-09 10:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 09:11 UTC to 2027-02-07 09:11 UTC
    Logged 2026-11-09 10:10 UTC in DigiCert Wyvern2027h1, entry 466,832,921
    SHA-256 36db01b450114541ada2346876deee015f6850014fd8b62a0b3385ccbbffeb09
    Public key SHA-256 13b480bf04c8bd85af69e233dcaa5fabe4be943c8cf155748ac672dda5c77094
    Addresses
    104.21.15.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.146 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.15.219, 172.67.207.146): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    accessiblebean.com
    Registered
    2026-09-11 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

  99. c8480f0008.nxcli.io US · AS36444 · Liquid Web, L.L.C
    ListedListed by CERT PolskaMX presentSPF missingDMARC missingRegistered 9 y ago
    DetailsHide
    Hostname
    c8480f0008.nxcli.io
    First seen
    2026-11-09 10:15 UTC
    Listing
    CERT Polska listed it 2026-05-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:13 UTC to 2027-02-07 09:13 UTC
    Logged 2026-11-09 10:11 UTC in DigiCert Sphinx2027h1, entry 413,351,123
    SHA-256 1c65b571655acb9c0d9ac1e36bd495fcc92640e1b747251b2ffa1ac660e72c70
    Public key SHA-256 42a5b6d68d4a3ade74af309893f260fe34eda14a5ba9691ce4c5a80552ad983c
    Addresses
    8.36.41.56 · United States · AS36444 NEXCESS-NET - Liquid Web, L.L.C
    Domain
    nxcli.io
    Registered
    2017-12-05 · Tucows Domains Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 07:15 UTC

    Suggest a correction

  100. ehmfj.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ehmfj.asia
    First seen
    2026-11-09 10:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 09:14 UTC to 2027-02-07 10:12 UTC
    Logged 2026-11-09 10:14 UTC in Geomys Tuscolo2027h1, entry 542,698,665
    SHA-256 894a85ed6794d41508d53ac488274995f84677efa4c12ae2233cea4b19f46111
    Public key SHA-256 7d049d262bda7982af2ff709abf3b78bb887f410415cc348ecbd6a0339ec6637
    Addresses
    104.21.92.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.201.180 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.92.249, 172.67.201.180): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ehmfj.asia
    Registered
    2026-07-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:53 UTC

    Suggest a correction

Showing 1–100 of 6,066 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources