Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-09 11:55 UTC
Certificate-log entries · 24 h
395.9M
from 84 distinct feeds
Unique certificates · 24 h
37.1M
each reviewed
Names resolved · 24 h
21.8M
16.5M with an address
Findings · 24 h
6,131
211 of 1,061 brands targeted

6,131 hostnames from the last 24 hours.

  1. www.poloniex-trade.com GB · AS215439 · PLAY2GO-NET PLAY2GO INTERNA…2 addressesPoloniex
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 53 d ago
    DetailsHide
    Hostname
    www.poloniex-trade.com
    First seen
    2026-11-09 11:28 UTC
    First published
    2026-11-01 11:21 UTC
    DNS
    Resolves · checked 2026-11-09 11:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 144.31.203.42.
    1. Phishing-host list fetched with the address
    2. Resolved to 144.31.203.42
    Brand
    Poloniex
    Addresses
    144.31.203.42 · United Kingdom · AS215439 PLAY2GO-NET PLAY2GO INTERNATIONAL LIMITED
    2.26.96.13 · United Kingdom · AS215439 PLAY2GO-NET PLAY2GO INTERNATIONAL LIMITED
    Domain
    poloniex-trade.com
    Registered
    2026-09-17 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  2. www.assistant-facebook.fr FR · AS16276 · OVH OVH SASFacebook
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    www.assistant-facebook.fr
    First seen
    2026-11-09 11:26 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 188.165.53.185.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 188.165.53.185
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 10:22 UTC to 2027-02-07 10:22 UTC
    Logged 2026-11-09 11:20 UTC in Let's Encrypt Willow2027h1, entry 1,038,153,264
    SHA-256 7cc996dc57ab1f2b0f33fde6d159173551f830a5ca42577a27f81d8afebea751
    Public key SHA-256 e6932554ded5eba5b87d0c6f8dec3de3dfb7762ca990ea7da3549d0bf54b9bac
    Brand
    Facebook
    Addresses
    188.165.53.185 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (188.165.53.185): a cloud provider. It rents servers and addresses to its customers.
    Domain
    assistant-facebook.fr
    Registered
    2026-04-08 · OVH
    MX
    Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 09:45 UTC

    Suggest a correction

  3. www.bitrefill.com-dx01-esim-gift.com GB · AS214351 · FEMOIT FEMO IT SOLUTIONS LI…Bitrefill
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    www.bitrefill.com-dx01-esim-gift.com
    First seen
    2026-11-09 11:26 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 62.60.226.39.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 62.60.226.39
    Certificate
    Issued by YR2
    Valid 2026-11-09 10:25 UTC to 2027-02-07 10:25 UTC
    Logged 2026-11-09 11:24 UTC in Google ParcelYard2027h1, entry 696,732,536
    SHA-256 547c2368fdac2adc292b3adc877bb9ce343e57a23d6a4c8b5826af4b1a3a6381
    Public key SHA-256 4918e692564de492706495964624e11f9966ebed4c0480cb90f7fbde480aaaed
    Brand
    Bitrefill
    Addresses
    62.60.226.39 · United Kingdom · AS214351 FEMOIT FEMO IT SOLUTIONS LIMITED
    Domain
    com-dx01-esim-gift.com
    Registered
    2026-11-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  4. www.pay-bitrefill.com-dx01-esim-gift.com GB · AS214351 · FEMOIT FEMO IT SOLUTIONS LI…Bitrefill
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    www.pay-bitrefill.com-dx01-esim-gift.com
    First seen
    2026-11-09 11:26 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 62.60.226.39.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 62.60.226.39
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 10:26 UTC to 2027-02-07 10:26 UTC
    Logged 2026-11-09 11:24 UTC in DigiCert Sphinx2027h1, entry 414,000,068
    SHA-256 84d41a6a11059c20f1cb7a5582c9823201da0de8e13913c3244b88f61b3b1ef0
    Public key SHA-256 4cc7f982144d75ce817ce50946e8028019c959808dcc1eea966e71e843c12663
    Brand
    Bitrefill
    Addresses
    62.60.226.39 · United Kingdom · AS214351 FEMOIT FEMO IT SOLUTIONS LIMITED
    Domain
    com-dx01-esim-gift.com
    Registered
    2026-11-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  5. pay-bitrefill.com-dx01-esim-gift.com GB · AS214351 · FEMOIT FEMO IT SOLUTIONS LI…Bitrefill
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    pay-bitrefill.com-dx01-esim-gift.com
    First seen
    2026-11-09 11:26 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 62.60.226.39.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 62.60.226.39
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 10:26 UTC to 2027-02-07 10:26 UTC
    Logged 2026-11-09 11:24 UTC in DigiCert Sphinx2027h1, entry 414,000,068
    SHA-256 84d41a6a11059c20f1cb7a5582c9823201da0de8e13913c3244b88f61b3b1ef0
    Public key SHA-256 4cc7f982144d75ce817ce50946e8028019c959808dcc1eea966e71e843c12663
    Brand
    Bitrefill
    Addresses
    62.60.226.39 · United Kingdom · AS214351 FEMOIT FEMO IT SOLUTIONS LIMITED
    Domain
    com-dx01-esim-gift.com
    Registered
    2026-11-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  6. bitrefill.com-dx01-esim-gift.com GB · AS214351 · FEMOIT FEMO IT SOLUTIONS LI…Bitrefill
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    bitrefill.com-dx01-esim-gift.com
    First seen
    2026-11-09 11:26 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 62.60.226.39.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 62.60.226.39
    Certificate
    Issued by YR2
    Valid 2026-11-09 10:25 UTC to 2027-02-07 10:25 UTC
    Logged 2026-11-09 11:24 UTC in Google ParcelYard2027h1, entry 696,732,536
    SHA-256 547c2368fdac2adc292b3adc877bb9ce343e57a23d6a4c8b5826af4b1a3a6381
    Public key SHA-256 4918e692564de492706495964624e11f9966ebed4c0480cb90f7fbde480aaaed
    Brand
    Bitrefill
    Addresses
    62.60.226.39 · United Kingdom · AS214351 FEMOIT FEMO IT SOLUTIONS LIMITED
    Domain
    com-dx01-esim-gift.com
    Registered
    2026-11-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  7. adobe.com.acrobat.online.signon.help US · AS13335 · Cloudflare, Inc.4 addressesAdobe
    ListedCloudflareUnder signon.help, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 5 mo ago
    DetailsHide
    Hostname
    adobe.com.acrobat.online.signon.help
    First seen
    2026-11-09 11:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing signon.help and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 11:14 UTC to 2027-02-07 11:24 UTC
    Logged 2026-11-09 11:24 UTC in DigiCert Wyvern2027h1, entry 467,549,118
    SHA-256 2b20d356b81f579fe326377814b938c582e111eb50d9d19a154dc7a2be3226ea
    Public key SHA-256 beac3239252bd742fe286aecbbb1061b07abe344a597f3bada019d7041044c61
    Brand
    Adobe
    Addresses
    104.21.23.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:d132
    2606:4700:3037::6815:1731
    Cloudflare
    Cloudflare (104.21.23.49, 172.67.209.50): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    signon.help
    Registered
    2026-06-05 · NameCheap, Inc.
    MX
    Receives mail at _dc-mx.6059c93ec22f.signon.help
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 17:57 UTC

    Suggest a correction

  8. borqika.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    borqika.vip
    First seen
    2026-11-09 11:26 UTC
    Listing
    CERT Polska listed it 2026-07-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:23 UTC to 2027-02-07 11:22 UTC
    Logged 2026-11-09 11:23 UTC in Geomys Tuscolo2027h1, entry 543,501,470
    SHA-256 c1b83c35418d7d9863ae32d6ee2edb97f0ce49ee11537aa503853f5708aa4c14
    Public key SHA-256 d6a6eecace2bea174108c3e4f4d271e31bed1451d4d54089b205fb06e5cb3093
    Addresses
    104.21.27.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.169.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.27.112, 172.67.169.35): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    borqika.vip
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  9. ccttju.mom US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    ccttju.mom
    First seen
    2026-11-09 11:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 10:22 UTC to 2027-02-07 10:22 UTC
    Logged 2026-11-09 11:20 UTC in Google PlumbersArms2027h1, entry 696,968,965
    SHA-256 8e0596f7d4510c1d79272a48567d3fa7d869d76a7cc98d905945c5c2f550ecfe
    Public key SHA-256 0d37cc485895b67cffbc5479d740f098ae7926f48f50457f6c481cc8843cda33
    Addresses
    104.21.23.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.214.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.23.246, 172.67.214.182): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ccttju.mom
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  10. community.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    community.fresh-focus.pro
    First seen
    2026-11-09 11:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:25 UTC to 2027-02-07 10:25 UTC
    Logged 2026-11-09 11:24 UTC in Google ParcelYard2027h1, entry 696,732,792
    SHA-256 2806c31cae70a6dc37014e47e1129f04414c79b54927cdfbf2d01b0515dca6bf
    Public key SHA-256 2c3aaa00f3b4f804393baeb4cdd81b3ba6f40cccd7e494e3693eb774132f25ff
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  11. events.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    events.fresh-focus.pro
    First seen
    2026-11-09 11:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:25 UTC to 2027-02-07 10:25 UTC
    Logged 2026-11-09 11:24 UTC in Google ParcelYard2027h1, entry 696,732,792
    SHA-256 2806c31cae70a6dc37014e47e1129f04414c79b54927cdfbf2d01b0515dca6bf
    Public key SHA-256 2c3aaa00f3b4f804393baeb4cdd81b3ba6f40cccd7e494e3693eb774132f25ff
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  12. exchange.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    exchange.fresh-focus.pro
    First seen
    2026-11-09 11:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:25 UTC to 2027-02-07 10:25 UTC
    Logged 2026-11-09 11:24 UTC in Google ParcelYard2027h1, entry 696,732,792
    SHA-256 2806c31cae70a6dc37014e47e1129f04414c79b54927cdfbf2d01b0515dca6bf
    Public key SHA-256 2c3aaa00f3b4f804393baeb4cdd81b3ba6f40cccd7e494e3693eb774132f25ff
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  13. git.androidloading.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder androidloading.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    git.androidloading.com
    First seen
    2026-11-09 11:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing androidloading.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 10:22 UTC to 2027-02-07 10:22 UTC
    Logged 2026-11-09 11:21 UTC in Google PlumbersArms2027h1, entry 696,973,116
    SHA-256 be4f8720d34355b84b52040be233a3b0970c4a608d52293b06dbd766919e5459
    Public key SHA-256 62aff1a05f4e0fdec43f125a95a01ad8b2b0ded6c38ea59e9077cb656fd4564b
    PhishDestroy
    Addresses
    185.178.208.191 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.191): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    androidloading.com
    Registered
    2023-04-19 · Center of Ukrainian Internet Names (UKRNAMES)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 22:34 UTC

    Suggest a correction

  14. gw.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    gw.fresh-focus.pro
    First seen
    2026-11-09 11:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:25 UTC to 2027-02-07 10:25 UTC
    Logged 2026-11-09 11:24 UTC in Google ParcelYard2027h1, entry 696,732,792
    SHA-256 2806c31cae70a6dc37014e47e1129f04414c79b54927cdfbf2d01b0515dca6bf
    Public key SHA-256 2c3aaa00f3b4f804393baeb4cdd81b3ba6f40cccd7e494e3693eb774132f25ff
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  15. hedefonmusteripaneli.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    hedefonmusteripaneli.com
    First seen
    2026-11-09 11:26 UTC
    Listing
    USOM listed it 2026-07-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 11:41 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:23 UTC to 2027-02-07 11:22 UTC
    Logged 2026-11-09 11:23 UTC in Google PlumbersArms2027h1, entry 697,010,941
    SHA-256 d749bb7b716904a1a6d4a7ad7f4f8fcdd978491119025ad8e7a19d9149bccaf5
    Public key SHA-256 e79a4a41fa9d718943ba976175249f5d1dc0a20ef24547cabed2aae074a23fb1
    Addresses
    104.21.90.191 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.204.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.90.191, 172.67.204.108): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hedefonmusteripaneli.com
    Registered
    2026-07-09 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  16. idp.clloudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clloudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    idp.clloudflare.net
    First seen
    2026-11-09 11:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clloudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:22 UTC to 2027-02-07 10:22 UTC
    Logged 2026-11-09 11:21 UTC in Let's Encrypt Willow2027h1, entry 1,038,162,987
    SHA-256 40c76a767c6b0e3025924bf072161f7d9c2f98f0829cf7ef1def4fb6980272cd
    Public key SHA-256 112aec164381a75779065185d66bb82457d616975154d2ff8e648c9b2ddaad1f
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clloudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  17. maps.clloudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clloudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    maps.clloudflare.net
    First seen
    2026-11-09 11:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clloudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:24 UTC to 2027-02-07 10:24 UTC
    Logged 2026-11-09 11:22 UTC in Google ParcelYard2027h1, entry 696,714,503
    SHA-256 acda301f3362fed78ef38ef1f2bc19ad7e22434ed3de09449762e15736c20e33
    Public key SHA-256 99ee27a65aedb9de2a761d6a276162421bedb05cc4e0503842f7ee6875448b56
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clloudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  18. murmureshopping.online US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC quarantineRegistered 6 mo ago
    DetailsHide
    Hostname
    murmureshopping.online
    First seen
    2026-11-09 11:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 10:24 UTC to 2027-02-07 10:24 UTC
    Logged 2026-11-09 11:22 UTC in Google ParcelYard2027h1, entry 696,715,648
    SHA-256 18fa3a7711799be06a929daacfdcfb03121b73635f61b410af5455e80ab08593
    Public key SHA-256 e5142cd9cb60cb5de21ab0f03eb7e87033becb4c07509279387ab92ad0a386b2
    Addresses
    104.21.20.102 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.192.84 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.20.102, 172.67.192.84): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    murmureshopping.online
    Registered
    2026-05-16 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  19. pr-4.radstation.byway.dev DE · AS24940 · HETZNER-AS Hetzner Online G…
    ListedHetznerUnder byway.dev, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    pr-4.radstation.byway.dev
    First seen
    2026-11-09 11:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing byway.dev and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 10:22 UTC to 2027-02-07 10:22 UTC
    Logged 2026-11-09 11:21 UTC in Let's Encrypt Willow2027h1, entry 1,038,166,408
    SHA-256 0babb84c3642850741f52670a2464a9e15df092bf9615c2a92858f80458a7136
    Public key SHA-256 b6487df982eb51694ba7d061813d143acf927c38e722e20d83bc55d764ca04ce
    Addresses
    91.99.178.72 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (91.99.178.72): a cloud provider. It rents servers and addresses to its customers.
    Domain
    byway.dev
    Registered
    2022-01-21 · Namecheap Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 18:26 UTC

    Suggest a correction

  20. qqxxmg.lat US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    qqxxmg.lat
    First seen
    2026-11-09 11:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 10:24 UTC to 2027-02-07 10:24 UTC
    Logged 2026-11-09 11:23 UTC in Google ParcelYard2027h1, entry 696,721,664
    SHA-256 731a93b71aae8432e6636b74adf6acf05a614a20b76d73ad144a145ab4dda6ed
    Public key SHA-256 2971c2c2dfe0033aac75f04a28dcaf17571c537f6bef0cb6496b110e4c785257
    Addresses
    104.21.88.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.88.91, 172.67.174.178): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qqxxmg.lat
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  21. rruuri.cfd US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    rruuri.cfd
    First seen
    2026-11-09 11:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 10:27 UTC to 2027-02-07 10:27 UTC
    Logged 2026-11-09 11:25 UTC in Let's Encrypt Willow2027h1, entry 1,038,264,203
    SHA-256 d8e6eb41b13bbc66b6b95c719fb5fcd4000fc06e10e2a1c9a62af1575da5221d
    Public key SHA-256 6d91475bd9e6d3685d4d8f4020d5acfc872c38de37ed28d63846131b965cd253
    Addresses
    104.21.1.99 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.3 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.1.99, 172.67.129.3): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rruuri.cfd
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  22. sils.87ad.ezgateway.net US · AS13335 · Cloudflare, Inc.5 addresses
    ListedCloudflareUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    sils.87ad.ezgateway.net
    First seen
    2026-11-09 11:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 11:41 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing RSA CA 4 · precertificate
    Valid 2026-11-09 11:13 UTC to 2027-02-07 11:21 UTC
    Logged 2026-11-09 11:23 UTC in DigiCert Wyvern2027h1, entry 467,541,930
    SHA-256 cbdbb6d10da0f21030019901410cab0dadb36e09689439c08ba46e7ebbb17bee
    Public key SHA-256 dff2334fa24bb75def709721423e171baa71483a4f9aca9d57e0427242a95345
    Addresses
    104.18.35.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.20.52.222 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.25.252.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.64.158.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.131.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.35.214, 104.20.52.222, 104.25.252.78, 172.64.158.216, 172.66.131.94): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  23. sso.clloudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clloudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    sso.clloudflare.net
    First seen
    2026-11-09 11:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clloudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:24 UTC to 2027-02-07 10:24 UTC
    Logged 2026-11-09 11:22 UTC in Google ParcelYard2027h1, entry 696,714,503
    SHA-256 acda301f3362fed78ef38ef1f2bc19ad7e22434ed3de09449762e15736c20e33
    Public key SHA-256 99ee27a65aedb9de2a761d6a276162421bedb05cc4e0503842f7ee6875448b56
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clloudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  24. thegeldronaiapp.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    thegeldronaiapp.com
    First seen
    2026-11-09 11:26 UTC
    Listing
    CERT Polska listed it 2026-07-24 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 10:23 UTC to 2027-02-07 10:23 UTC
    Logged 2026-11-09 11:21 UTC in Google ParcelYard2027h1, entry 696,700,421
    SHA-256 90a86e9348fa7379d0c1c4d78c26cd0445da9dd37d4f1f133021c75243258379
    Public key SHA-256 1d5d5371d3c7242b476ae7a469fa403f359ae7f7be780a743c9dd52c6af26fb3
    Addresses
    104.21.38.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.93 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.38.186, 172.67.137.93): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    thegeldronaiapp.com
    Registered
    2026-05-15 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  25. www.dev.test1.androidloading.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder androidloading.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    www.dev.test1.androidloading.com
    First seen
    2026-11-09 11:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing androidloading.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 10:22 UTC to 2027-02-07 10:22 UTC
    Logged 2026-11-09 11:21 UTC in Google PlumbersArms2027h1, entry 696,973,116
    SHA-256 be4f8720d34355b84b52040be233a3b0970c4a608d52293b06dbd766919e5459
    Public key SHA-256 62aff1a05f4e0fdec43f125a95a01ad8b2b0ded6c38ea59e9077cb656fd4564b
    PhishDestroy
    Addresses
    185.178.208.191 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.191): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    androidloading.com
    Registered
    2023-04-19 · Center of Ukrainian Internet Names (UKRNAMES)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 22:34 UTC

    Suggest a correction

  26. www.lkfincialservices.co.za.futurewise-referral.co.za US · AS53667 · FranTech Solutions
    ReportedUnder futurewise-referral.co.za, reported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.lkfincialservices.co.za.futurewise-referral.co.za
    First seen
    2026-11-09 11:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing futurewise-referral.co.za and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:24 UTC to 2027-02-07 10:24 UTC
    Logged 2026-11-09 11:23 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,585,606
    SHA-256 b3af6144c8888e4f4ac48812966e9c29adb541d648cd02e18d49a254b8e732b3
    Public key SHA-256 ea4b8d1fde7ea7d5f18881a0d537d18df88ef867af2bfd8ca1242040e3cb90d7
    PhishDestroy
    Addresses
    198.251.84.200 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    futurewise-referral.co.za
    MX
    Receives mail at futurewise-referral.co.za
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:11 UTC

    Suggest a correction

  27. ztskv.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ztskv.asia
    First seen
    2026-11-09 11:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:20 UTC to 2027-02-07 11:19 UTC
    Logged 2026-11-09 11:20 UTC in Geomys Tuscolo2027h1, entry 543,472,840
    SHA-256 cd74ec2c5359930708c125959bdd771d58f8775cb66aae8a6e0435ac17653eaf
    Public key SHA-256 924eb029150b5441d54780ad0db19a0817fafc8b221eab8b17a8c3f21813b21d
    Addresses
    104.21.79.106 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.79.106, 172.67.144.178): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ztskv.asia
    Registered
    2026-07-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  28. 1inch-info.to GE · AS200823 · MHost-AS MHost LLC3 addresses1inch
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    1inch-info.to
    First seen
    2026-11-09 11:21 UTC
    First published
    2026-11-02 10:48 UTC
    DNS
    Resolves · checked 2026-11-09 11:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.85.237.128.
    1. Resolved to 95.85.237.128
    2. Phishing-host list fetched with the address
    Brand
    1inch
    Addresses
    95.85.237.128 · Georgia · AS200823 MHost-AS MHost LLC
    5.252.155.27 · Georgia · AS200823 MHost-AS MHost LLC
    95.85.237.62 · Georgia · AS200823 MHost-AS MHost LLC
    Domain
    1inch-info.to
    Registered
    2026-06-24 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:57 UTC

    Suggest a correction

  29. andes-rendivo-austria.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    andes-rendivo-austria.com
    First seen
    2026-11-09 11:21 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:20 UTC to 2027-02-07 11:18 UTC
    Logged 2026-11-09 11:20 UTC in Let's Encrypt Willow2027h1, entry 1,038,146,799
    SHA-256 01fa418ee7394d02a640081a7a2e3a7480dcd7b6943362afd7d25e88e41d0446
    Public key SHA-256 44140e98e3749fb4f299e662d5bbff88cf07361a7060cfd82f8500b90d069cfa
    Addresses
    104.21.14.238 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.199 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.14.238, 172.67.160.199): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    andes-rendivo-austria.com
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  30. ank20.top US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    ank20.top
    First seen
    2026-11-09 11:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 10:19 UTC to 2027-02-07 10:19 UTC
    Logged 2026-11-09 11:18 UTC in Google ParcelYard2027h1, entry 696,652,739
    SHA-256 985966b3009788005d2cea2384f992bc191593c14080a9944c196f1e65fb4d89
    Public key SHA-256 93b26ecc140c0a26d825f3d0628eaca62a73c59af6b4bcbecde685daca832cf8
    Addresses
    104.21.54.110 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.138.53 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.54.110, 172.67.138.53): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ank20.top
    Registered
    2026-09-11 · NameSilo,LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  31. backup.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    backup.clouudflare.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:19 UTC to 2027-02-07 10:19 UTC
    Logged 2026-11-09 11:17 UTC in Geomys Tuscolo2027h1, entry 543,438,544
    SHA-256 1160bb932e2a087ef9e4cde2f124ab7b8bbeb2cfd34c74d60fa39f8f4d5f0701
    Public key SHA-256 b7d6e9f9e0a01126f633c1d8547017cd746fbfe3793201a9757c6064003f3f1a
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  32. bet365.q636gb4.cc CA · AS54994 · Meteverse Limited.
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    bet365.q636gb4.cc
    First seen
    2026-11-09 11:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:17 UTC to 2027-02-07 10:17 UTC
    Logged 2026-11-09 11:16 UTC in Google ParcelYard2027h1, entry 696,625,062
    SHA-256 068a5cb558957abe82c47a0b52eeb95a4bf907a4bf380bdfb20f857caaa58b6e
    Public key SHA-256 6815c15c56d160a358ac7c9731cde02cf26a5e9cf8f3d53a2ab80e3344770842
    PhishDestroy
    Addresses
    146.103.77.108 · Canada · AS54994 ML-1432-54994 - Meteverse Limited.
    Domain
    q636gb4.cc
    Registered
    2026-04-03 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  33. corp.cloydflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloydflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    corp.cloydflare.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloydflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 10:18 UTC to 2027-02-07 10:18 UTC
    Logged 2026-11-09 11:16 UTC in Geomys Tuscolo2027h1, entry 543,431,301
    SHA-256 6c8a3cd2298f8337e7f83941c2b5edec416042f2ed1fa9c500fc78ad360a55a9
    Public key SHA-256 0b9e908c9fcda20b3ba77f158f6b4a875323d32f8425e3554fa1d81ecac21fc0
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloydflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:21 UTC

    Suggest a correction

  34. dc8usign.portal-login-access.net US · AS8075 · Microsoft Corporation
    ReportedMicrosoft AzureUnder portal-login-access.net, reported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 10 mo ago
    DetailsHide
    Hostname
    dc8usign.portal-login-access.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing portal-login-access.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 10:20 UTC to 2027-02-07 10:20 UTC
    Logged 2026-11-09 11:18 UTC in Google PlumbersArms2027h1, entry 696,942,134
    SHA-256 1220d19f896e519db9f3716bb28823e354c81beb94115e82284e39e1f8c19189
    Public key SHA-256 0c507a58c5f128c7a6e0dcaa547ef5600d475afb1b072bdac752c4ad0630b354
    PhishDestroy
    Addresses
    172.174.53.244 · United States · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation · Microsoft Azure (cloud provider)
    Microsoft Azure
    Microsoft Azure (172.174.53.244): a cloud provider. It rents servers and addresses to its customers.
    Domain
    portal-login-access.net
    Registered
    2026-01-07 · GoDaddy.com, LLC
    MX
    Receives mail at filter10.antispamcloud.com, filter20.antispamcloud.com, filter30.antispamcloud.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  35. docsign.portal-login-access.net US · AS8075 · Microsoft Corporation
    ReportedMicrosoft AzureUnder portal-login-access.net, reported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 10 mo ago
    DetailsHide
    Hostname
    docsign.portal-login-access.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing portal-login-access.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 10:20 UTC to 2027-02-07 10:20 UTC
    Logged 2026-11-09 11:18 UTC in Google ParcelYard2027h1, entry 696,657,586
    SHA-256 079ef05d7a3d6406a8c036ede01a11bc738142edd8e68cc5cab5eebc676e87eb
    Public key SHA-256 a611b3ea8a5792c70808c8ee0b65bef50f79cea03752e872b6d0759526abc0f7
    PhishDestroy
    Addresses
    172.174.53.244 · United States · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation · Microsoft Azure (cloud provider)
    Microsoft Azure
    Microsoft Azure (172.174.53.244): a cloud provider. It rents servers and addresses to its customers.
    Domain
    portal-login-access.net
    Registered
    2026-01-07 · GoDaddy.com, LLC
    MX
    Receives mail at filter10.antispamcloud.com, filter20.antispamcloud.com, filter30.antispamcloud.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  36. drpbxlgn92q.alert-notifications.app US · AS8075 · Microsoft Corporation
    ReportedMicrosoft AzureReported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 10 mo ago
    DetailsHide
    Hostname
    drpbxlgn92q.alert-notifications.app
    First seen
    2026-11-09 11:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:44 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 10:20 UTC to 2027-02-07 10:20 UTC
    Logged 2026-11-09 11:19 UTC in IPng Networks Halloumi2027h1, entry 425,604,452
    SHA-256 42aa8dcdfc69c05e2e9ba4dd09f58d3fe9e65360e79e7097064ad2349bbab7e8
    Public key SHA-256 bfed98a4098c4baf2d4a141cef27297a6cbbf8a7f5aba7f32a9845fd658b8405
    PhishDestroy
    Addresses
    172.174.53.244 · United States · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation · Microsoft Azure (cloud provider)
    Microsoft Azure
    Microsoft Azure (172.174.53.244): a cloud provider. It rents servers and addresses to its customers.
    Domain
    alert-notifications.app
    Registered
    2026-01-07 · GoDaddy.com, LLC
    MX
    Receives mail at filter10.antispamcloud.com, filter20.antispamcloud.com, filter30.antispamcloud.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  37. hotspot.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    hotspot.clouudflare.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:19 UTC to 2027-02-07 10:19 UTC
    Logged 2026-11-09 11:17 UTC in Geomys Tuscolo2027h1, entry 543,438,544
    SHA-256 1160bb932e2a087ef9e4cde2f124ab7b8bbeb2cfd34c74d60fa39f8f4d5f0701
    Public key SHA-256 b7d6e9f9e0a01126f633c1d8547017cd746fbfe3793201a9757c6064003f3f1a
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  38. portal-login-access.net US · AS8075 · Microsoft Corporation
    ReportedMicrosoft AzureReported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 10 mo ago
    DetailsHide
    Hostname
    portal-login-access.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:21 UTC to 2027-02-07 10:21 UTC
    Logged 2026-11-09 11:20 UTC in Google ParcelYard2027h1, entry 696,681,339
    SHA-256 9b5698dc5537d0d03a233b4dd147033c7f230e4c016a14bd493ecdf29f2de51a
    Public key SHA-256 0968a369064ca5e98e6d6dd1f58cd1b7a459b53b11bf01211f28595e6a6aee1e
    PhishDestroy
    Addresses
    172.174.53.244 · United States · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation · Microsoft Azure (cloud provider)
    Microsoft Azure
    Microsoft Azure (172.174.53.244): a cloud provider. It rents servers and addresses to its customers.
    Domain
    portal-login-access.net
    Registered
    2026-01-07 · GoDaddy.com, LLC
    MX
    Receives mail at filter10.antispamcloud.com, filter20.antispamcloud.com, filter30.antispamcloud.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  39. service.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    service.clouudflare.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:19 UTC to 2027-02-07 10:19 UTC
    Logged 2026-11-09 11:17 UTC in Geomys Tuscolo2027h1, entry 543,438,544
    SHA-256 1160bb932e2a087ef9e4cde2f124ab7b8bbeb2cfd34c74d60fa39f8f4d5f0701
    Public key SHA-256 b7d6e9f9e0a01126f633c1d8547017cd746fbfe3793201a9757c6064003f3f1a
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  40. stand.adm-pulse.com RU · AS209133 · DATA-HALL DATA HALL LTD
    ReportedUnder adm-pulse.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    stand.adm-pulse.com
    First seen
    2026-11-09 11:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing adm-pulse.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 10:17 UTC to 2027-02-07 10:17 UTC
    Logged 2026-11-09 11:16 UTC in Google PlumbersArms2027h1, entry 696,904,594
    SHA-256 0cef89293fcfed61ad7362f1a97cadf1dc9f2ed7ce016de642c9b4acca6e514e
    Public key SHA-256 57203c9fc60d20d81ebd554b079c2798a2f934afdff2135e820e7022ca8d3027
    PhishDestroy
    Addresses
    170.168.72.180 · Russia · AS209133 DATA-HALL DATA HALL LTD
    Domain
    adm-pulse.com
    Registered
    2025-09-04 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 07:45 UTC

    Suggest a correction

  41. tilhulpmiddelen.info
    ListedListed by CERT PolskaMX presentSPF ~allSPF on StopForumSpamDMARC policy noneRegistered 8 mo ago
    DetailsHide
    Hostname
    tilhulpmiddelen.info
    First seen
    2026-11-09 11:21 UTC
    Listing
    CERT Polska listed it 2026-06-03 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 10:19 UTC to 2027-02-07 10:19 UTC
    Logged 2026-11-09 11:17 UTC in Google ParcelYard2027h1, entry 696,643,683
    SHA-256 baedef827cee2744864d47c4dcc62aa7299bac931fb457e4cae2f602b0bbbd3e
    Public key SHA-256 ed47b817d4e2999441499c6d928822f187623525a9baf0525866e433d9c8cb39
    Domain
    tilhulpmiddelen.info
    Registered
    2026-03-18 · NameSilo, LLC
    MX
    Receives mail at mail-primary1.tilhulpmiddelen.info
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    SPF listing
    The SPF record lists 212.129.0.144 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.0.202 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.0.220 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.0.243 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.0.245 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.1.130 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.1.141 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.1.143 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.1.222 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.1.229 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.1.237 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.1.243 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.3.63 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.3.69 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.3.76 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    The SPF record lists 212.129.3.84 as a sender. It is on StopForumSpam: address ranges dedicated to spam.
    Data: Toxic IP ranges from StopForumSpam (www.stopforumspam.com), CC BY 3.0.
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  42. web2.cloudflaer.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloudflaer.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    web2.cloudflaer.com
    First seen
    2026-11-09 11:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-08 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloudflaer.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:17 UTC to 2027-02-07 10:17 UTC
    Logged 2026-11-09 11:15 UTC in Google ParcelYard2027h1, entry 696,619,845
    SHA-256 f15fb9726675c470b0ec799754240870894bf83bd15143b257b8bd82ab7b0eb5
    Public key SHA-256 c5ecb3545e8d4c1b6f3b26bd42e06f38c830fe40803c08a4a3456d9a7a20c649
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloudflaer.com
    Registered
    2020-10-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:51 UTC

    Suggest a correction

  43. www.d4s11.ezgateway.net US · AS13335 · Cloudflare, Inc.
    ListedCloudflareUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    www.d4s11.ezgateway.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 11:41 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 10:17 UTC to 2027-02-07 11:16 UTC
    Logged 2026-11-09 11:17 UTC in IPng Networks Halloumi2027h1, entry 425,590,702
    SHA-256 235d54008f8d208556f9ae00c8f759c3e5459cf70972fbcfebca58f2c0f06e44
    Public key SHA-256 178e3ec88964d42f5208bdf85567202a621464f6e2c31f751c7743db79f8ea1d
    Addresses
    104.21.84.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.84.64): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  44. www.mbjugj.ezgateway.net US · AS13335 · Cloudflare, Inc.
    ListedCloudflareUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    www.mbjugj.ezgateway.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 11:41 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 10:18 UTC to 2027-02-07 11:17 UTC
    Logged 2026-11-09 11:18 UTC in Let's Encrypt Willow2027h1, entry 1,038,108,133
    SHA-256 277c7d494ad00163fbd63e9a02f09d4b2af742907f5c26fea036d866a8a6328f
    Public key SHA-256 dcb717eb1af4c5d5bdacb72eabbff6523f2a08a0d480ccb0b982163aef2903d8
    Addresses
    104.21.84.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.84.64): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  45. www.ottowalluk.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesUnder ottowalluk.com, listed by CERT PolskaMX absentSPF missingDMARC quarantineRegistered 3 y ago
    DetailsHide
    Hostname
    www.ottowalluk.com
    First seen
    2026-11-09 11:21 UTC
    Listing
    CERT Polska listed it 2026-05-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska, listing ottowalluk.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-09 11:16 UTC to 2027-05-26 11:16 UTC
    Logged 2026-11-09 11:16 UTC in GoDaddy Aquamarine2027h1, entry 201,317,992
    SHA-256 51fce053c6da14200ec71493af45a1e44f0d2fd2775b7c23cfb522aa66b578a3
    Public key SHA-256 f3db53bb995fee215641daec0649f3e4a03c46fca0da9ce560e7e7838ae4a5e6
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ottowalluk.com
    Registered
    2023-10-27 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 08:49 UTC

    Suggest a correction

  46. www4.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www4.clouudflare.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:19 UTC to 2027-02-07 10:19 UTC
    Logged 2026-11-09 11:17 UTC in Geomys Tuscolo2027h1, entry 543,438,544
    SHA-256 1160bb932e2a087ef9e4cde2f124ab7b8bbeb2cfd34c74d60fa39f8f4d5f0701
    Public key SHA-256 b7d6e9f9e0a01126f633c1d8547017cd746fbfe3793201a9757c6064003f3f1a
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  47. x7tq54amsloginx7tq92.portal-login-access.net US · AS8075 · Microsoft Corporation
    ReportedMicrosoft AzureReported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 10 mo ago
    DetailsHide
    Hostname
    x7tq54amsloginx7tq92.portal-login-access.net
    First seen
    2026-11-09 11:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 10:21 UTC to 2027-02-07 10:21 UTC
    Logged 2026-11-09 11:20 UTC in Google ParcelYard2027h1, entry 696,681,339
    SHA-256 9b5698dc5537d0d03a233b4dd147033c7f230e4c016a14bd493ecdf29f2de51a
    Public key SHA-256 0968a369064ca5e98e6d6dd1f58cd1b7a459b53b11bf01211f28595e6a6aee1e
    PhishDestroy
    Addresses
    172.174.53.244 · United States · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation · Microsoft Azure (cloud provider)
    Microsoft Azure
    Microsoft Azure (172.174.53.244): a cloud provider. It rents servers and addresses to its customers.
    Domain
    portal-login-access.net
    Registered
    2026-01-07 · GoDaddy.com, LLC
    MX
    Receives mail at filter10.antispamcloud.com, filter20.antispamcloud.com, filter30.antispamcloud.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  48. zoompods.us VG · AS40034 · Confluence Networks Inc
    ListedParking page · Confluence NetworksListed by MetaMaskMX absentSPF -allDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    zoompods.us
    First seen
    2026-11-09 11:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-02-07 23:59 UTC
    Logged 2026-11-09 11:17 UTC in Geomys Tuscolo2027h1, entry 543,437,047
    SHA-256 4d4e8133aa787826c233e69e8414f07af649c417b60c3f164edf78316c0316fb
    Public key SHA-256 e536e18bb4621d7355ca6db012e7ecaebf78445372a2a4b9305ffb831323a899
    Addresses
    208.91.197.208 · British Virgin Islands · AS40034 CONFLUENCE-NETWORK-INC - Confluence Networks Inc · Confluence Networks (parking page)
    Parking page · Confluence Networks
    Confluence Networks (208.91.197.208): a parking service. It answers for names that are typically for sale or unused.
    Domain
    zoompods.us
    Registered
    2020-10-14 · Network Solutions, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:21 UTC

    Suggest a correction

  49. adobe.com.secure.signon.help US · AS13335 · Cloudflare, Inc.4 addressesAdobe
    ListedCloudflareUnder signon.help, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 5 mo ago
    DetailsHide
    Hostname
    adobe.com.secure.signon.help
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing signon.help and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 11:01 UTC to 2027-02-07 11:10 UTC
    Logged 2026-11-09 11:11 UTC in DigiCert Sphinx2027h1, entry 413,913,279
    SHA-256 7f07a908fa1e6597c95955fc58e21366f558433dc05d1b83029ffc528a152c68
    Public key SHA-256 93d61d548df69ea21c9f8c18a9bb6483a3a5ed4e4842dc72dc698247a6473b1d
    Brand
    Adobe
    Addresses
    104.21.23.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:d132
    2606:4700:3037::6815:1731
    Cloudflare
    Cloudflare (104.21.23.49, 172.67.209.50): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    signon.help
    Registered
    2026-06-05 · NameCheap, Inc.
    MX
    Receives mail at _dc-mx.6059c93ec22f.signon.help
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 17:57 UTC

    Suggest a correction

  50. bevecoi.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX presentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    bevecoi.pro
    First seen
    2026-11-09 11:16 UTC
    Listing
    CERT Polska listed it 2026-07-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:13 UTC to 2027-02-07 11:12 UTC
    Logged 2026-11-09 11:13 UTC in Geomys Tuscolo2027h1, entry 543,398,014
    SHA-256 f42d7531689dd4bc8d3fae6cf6f3b09af724df4d85ffde9dad647e6621255e11
    Public key SHA-256 94883d295abf9e26b133a2bc46f120b8259502c7f426e4fa81d3ff4825d119ee
    Addresses
    104.21.66.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.157.129 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.77, 172.67.157.129): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bevecoi.pro
    Registered
    2026-07-14 · NameCheap, Inc.
    MX
    Receives mail at mail.bevecoi.pro
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  51. billing.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    billing.clouudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,412,730
    SHA-256 7d2f452d1a56531c6d946549cafab5f404e282b987dd0c8536e5ba2f10f29b80
    Public key SHA-256 9d202fb0fbfbd11d9db80a244d887b78a43862bbab7753e7592dde56350a8107
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  52. cacti.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    cacti.clouudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,412,730
    SHA-256 7d2f452d1a56531c6d946549cafab5f404e282b987dd0c8536e5ba2f10f29b80
    Public key SHA-256 9d202fb0fbfbd11d9db80a244d887b78a43862bbab7753e7592dde56350a8107
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  53. gprnt.vip 9.216.45.170
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    gprnt.vip
    First seen
    2026-11-09 11:16 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 10:15 UTC to 2027-02-07 10:15 UTC
    Logged 2026-11-09 11:14 UTC in Google PlumbersArms2027h1, entry 696,885,787
    SHA-256 83699f61a4a526241076d292d7863241129ab4e095f8f74fb7fc28cb949f9368
    Public key SHA-256 d08305b11cbd29c537e7230cf13ae29dd3b00ca6ac88432cdaa0991d6e698852
    Addresses
    9.216.45.170
    Domain
    gprnt.vip
    Registered
    2026-05-16 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  54. jobs.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    jobs.clouudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,412,730
    SHA-256 7d2f452d1a56531c6d946549cafab5f404e282b987dd0c8536e5ba2f10f29b80
    Public key SHA-256 9d202fb0fbfbd11d9db80a244d887b78a43862bbab7753e7592dde56350a8107
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  55. keexpress.lol US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (transport and delivery)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    keexpress.lol
    First seen
    2026-11-09 11:16 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:13 UTC to 2027-02-07 11:11 UTC
    Logged 2026-11-09 11:13 UTC in Geomys Tuscolo2027h1, entry 543,395,034
    SHA-256 6e5381231fdd02a49fcd10b398c1b0ebe9c1a556f75663ef19b38839eb8c9ab5
    Public key SHA-256 473e36a4ea0fe83027ec829f68e0cdbee6459f8cb5a831aa0a13d9eddb3f817b
    Addresses
    104.21.53.135 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.32 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.135, 172.67.213.32): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    keexpress.lol
    Registered
    2026-01-18 · Hongkong Kouming International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  56. kklljc.cfd US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    kklljc.cfd
    First seen
    2026-11-09 11:16 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 10:13 UTC to 2027-02-07 10:13 UTC
    Logged 2026-11-09 11:11 UTC in Google ParcelYard2027h1, entry 696,564,638
    SHA-256 34dccea04be7f273c66860d51643dd4682d721c2e711f4432b24d3360cad67aa
    Public key SHA-256 b179aaaa87a68a544ba64a6b8fffe690ffdbb2f09a7a9e74e4ad25997b073d8f
    Addresses
    104.21.54.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.79 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.54.88, 172.67.137.79): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kklljc.cfd
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  57. ledger-site.app US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ledger-site.app
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:12 UTC to 2027-02-07 11:11 UTC
    Logged 2026-11-09 11:12 UTC in Geomys Tuscolo2027h1, entry 543,385,245
    SHA-256 22a29ae820aaf3a448b6bd380d0c05de595ee9b8e19a1c079309a5ebf0c9e7c0
    Public key SHA-256 52f700fee75c34f843f4bd4588e27d57a6128c8759eb45d0d7e11cc031649784
    Addresses
    104.21.13.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.236 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.13.94, 172.67.167.236): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledger-site.app
    Registered
    2026-07-13 · TLD Registrar Solutions Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  58. lms.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    lms.clouudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,412,730
    SHA-256 7d2f452d1a56531c6d946549cafab5f404e282b987dd0c8536e5ba2f10f29b80
    Public key SHA-256 9d202fb0fbfbd11d9db80a244d887b78a43862bbab7753e7592dde56350a8107
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  59. login.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    login.clouudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,412,730
    SHA-256 7d2f452d1a56531c6d946549cafab5f404e282b987dd0c8536e5ba2f10f29b80
    Public key SHA-256 9d202fb0fbfbd11d9db80a244d887b78a43862bbab7753e7592dde56350a8107
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  60. mendasform.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    mendasform.cyou
    First seen
    2026-11-09 11:16 UTC
    Listing
    CERT Polska listed it 2026-07-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:13 UTC to 2027-02-07 11:12 UTC
    Logged 2026-11-09 11:13 UTC in Google ParcelYard2027h1, entry 696,596,239
    SHA-256 649ba122ab0f224b6cc559a78f3a8282a9581aa972c14fcea4b1dc69ee5b81b4
    Public key SHA-256 eef7fd97afcebcda1bd074cb27a26d913dcb9b9f2a8c2bd5f2d7d306cb088ac7
    Domain
    mendasform.cyou
    Registered
    2026-07-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  61. moonshot-money.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    moonshot-money.pro
    First seen
    2026-11-09 11:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Google PlumbersArms2027h1, entry 696,890,587
    SHA-256 08ff3e3a2ec2940c8d38d463da2d621984f8972c0dcd288598f2e484d681f9eb
    Public key SHA-256 5945714a18101d757c7f330b90150fd2f1948db41b46bd40ccc92916d9ebe2f2
    PhishDestroy
    Addresses
    104.21.82.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.151 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.82.225, 172.67.164.151): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    moonshot-money.pro
    Registered
    2026-03-18 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  62. newsletter.cloudflear.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloudflear.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    newsletter.cloudflear.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloudflear.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 10:11 UTC to 2027-02-07 10:11 UTC
    Logged 2026-11-09 11:10 UTC in Google ParcelYard2027h1, entry 696,543,185
    SHA-256 99fc0d9cf3c9abd8153bd21400205fe77859e974e5a1808e7c401aba88e16c80
    Public key SHA-256 b5b6d55d3cd514c403905fbe4733a9cd08fa5ef95ec0e6edce33ed771f3f9149
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloudflear.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 18:26 UTC

    Suggest a correction

  63. preprod.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    preprod.clouudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,412,730
    SHA-256 7d2f452d1a56531c6d946549cafab5f404e282b987dd0c8536e5ba2f10f29b80
    Public key SHA-256 9d202fb0fbfbd11d9db80a244d887b78a43862bbab7753e7592dde56350a8107
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  64. projects.cooudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cooudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    projects.cooudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cooudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 10:13 UTC to 2027-02-07 10:13 UTC
    Logged 2026-11-09 11:12 UTC in DigiCert Sphinx2027h1, entry 413,921,224
    SHA-256 a8b19c65a9833dea1ccfa3d57853bc249b73fc9810716744eea2f95bf5cfbfd5
    Public key SHA-256 092dfe1a6894f5521f7f67df79ecb09ddc03b781392df6107c4087eac19a2348
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cooudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 15:49 UTC

    Suggest a correction

  65. rorunoneb.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    rorunoneb.shop
    First seen
    2026-11-09 11:16 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 10:15 UTC to 2027-02-07 10:15 UTC
    Logged 2026-11-09 11:13 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,389,268
    SHA-256 2b1ee297cac96bbd7d70ddecd52ed62dd9fdf1a1e584e016786ad2dc2a6d1a37
    Public key SHA-256 c43c1beae39a50c6e10409cbd5d719187a92374bf41b2ed07c59413eb07f541c
    Addresses
    104.21.43.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.96 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.43.219, 172.67.186.96): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rorunoneb.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  66. site.cliudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cliudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    site.cliudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cliudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 10:12 UTC to 2027-02-07 10:12 UTC
    Logged 2026-11-09 11:10 UTC in Google ParcelYard2027h1, entry 696,546,788
    SHA-256 3d403f2eabecea35bb5aab04fcf2fea4d9630eee3a3a77d7b8b77bc1c1ae5b9e
    Public key SHA-256 607ee58fd8ecfe566a1b52525ee2a001fa4f51434abed4a81c32bd56b147f2ee
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cliudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 15:49 UTC

    Suggest a correction

  67. sonar.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    sonar.clouudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,412,730
    SHA-256 7d2f452d1a56531c6d946549cafab5f404e282b987dd0c8536e5ba2f10f29b80
    Public key SHA-256 9d202fb0fbfbd11d9db80a244d887b78a43862bbab7753e7592dde56350a8107
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  68. tevehivex.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    tevehivex.shop
    First seen
    2026-11-09 11:16 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 10:13 UTC to 2027-02-07 10:13 UTC
    Logged 2026-11-09 11:11 UTC in Let's Encrypt Willow2027h1, entry 1,037,951,326
    SHA-256 9e955b1837caa9997aa9a62b3dd33c19f102894c6584019e3157fe61c30a8cc0
    Public key SHA-256 c353e34c06d2e7c09409de85276c60b4f82ff01e490c1c76cc35eff37fb31a52
    Addresses
    104.21.71.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.102 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.138, 172.67.145.102): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevehivex.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  69. unifi.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    unifi.clouudflare.net
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 10:16 UTC to 2027-02-07 10:16 UTC
    Logged 2026-11-09 11:14 UTC in Let's Encrypt Sycamore2027h1, entry 1,082,412,730
    SHA-256 7d2f452d1a56531c6d946549cafab5f404e282b987dd0c8536e5ba2f10f29b80
    Public key SHA-256 9d202fb0fbfbd11d9db80a244d887b78a43862bbab7753e7592dde56350a8107
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:32 UTC

    Suggest a correction

  70. veneziaprimegptapp.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    veneziaprimegptapp.org
    First seen
    2026-11-09 11:16 UTC
    Listing
    CERT Polska listed it 2026-09-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 09:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:13 UTC to 2027-02-07 11:11 UTC
    Logged 2026-11-09 11:13 UTC in Geomys Tuscolo2027h1, entry 543,395,067
    SHA-256 5574cf0c0f2f59a24ed8235dba0e0b450d571aad832032dd48dc344c46190e4f
    Public key SHA-256 6034a85e78bef37ad7451ef89cdad95fd5891cab1a5a135eb34526758de21987
    Addresses
    104.21.57.70 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.240 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.57.70, 172.67.160.240): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    veneziaprimegptapp.org
    Registered
    2026-09-11 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  71. vsdw.top US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    vsdw.top
    First seen
    2026-11-09 11:16 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:11 UTC to 2027-02-07 11:10 UTC
    Logged 2026-11-09 11:11 UTC in IPng Networks Halloumi2027h1, entry 425,535,547
    SHA-256 d784a7090b6de4f5d7926efc8081b76cceccfbe3f5b532c09dc6df284a4cd60a
    Public key SHA-256 ce78dedfaf0f80ef1b53842fdd85fe8cc9b2ab3f39a37b606670d207e5cb262d
    Addresses
    104.21.9.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.9.153, 172.67.160.64): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vsdw.top
    Registered
    2025-11-10 · 阿里云计算有限公司
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  72. www.whatispancakeswap.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder whatispancakeswap.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 49 d ago
    DetailsHide
    Hostname
    www.whatispancakeswap.xyz
    First seen
    2026-11-09 11:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing whatispancakeswap.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 10:11 UTC to 2027-02-07 11:11 UTC
    Logged 2026-11-09 11:12 UTC in Google ParcelYard2027h1, entry 696,567,050
    SHA-256 ad2a028eb8e802b2ce53fe7072e267436e7d9e5dd19855039e0ae68224aa1ead
    Public key SHA-256 58f5bd3bdaab0279677323889c7234345f4d4adb31c599e4d5a6c732e2ece90e
    Addresses
    104.21.71.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.99 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.242, 172.67.172.99): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    whatispancakeswap.xyz
    Registered
    2026-09-21 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  73. yadr.top US · AS16509 · Amazon.com, Inc.4 addresses
    ListedAmazon Web ServicesListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    yadr.top
    First seen
    2026-11-09 11:16 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 S19 · precertificate
    Valid 2026-11-09 10:12 UTC to 2027-05-26 11:12 UTC
    Logged 2026-11-09 11:12 UTC in DigiCert Sphinx2027h1, entry 413,925,213
    SHA-256 be9db0d61d9e48888a54e4e2efaf326c54b2d467413c0fd67e34e86cc4632e65
    Public key SHA-256 bd1e96c2c406f00a91a2bdc8880d48cf6366c2f178994262d23bc7d362a81d2c
    Addresses
    18.239.36.28 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.36.77 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.36.88 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    18.239.36.103 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (18.239.36.28, 18.239.36.77, 18.239.36.88, 18.239.36.103): a cloud provider. It rents servers and addresses to its customers.
    Domain
    yadr.top
    Registered
    2025-11-10 · 阿里云计算有限公司
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  74. app.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    app.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  75. app.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    app.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  76. chat.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    chat.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  77. chat.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    chat.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  78. cn.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    cn.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  79. cn.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    cn.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  80. desktop.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    desktop.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  81. desktop.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    desktop.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  82. edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  83. en.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    en.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  84. en.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    en.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  85. guide.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    guide.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  86. guide.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    guide.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  87. h5.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    h5.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  88. h5.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    h5.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  89. home.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    home.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  90. home.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    home.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  91. info.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    info.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  92. info.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    info.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  93. login.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    login.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  94. login.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    login.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  95. m.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    m.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  96. m.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    m.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  97. online.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    online.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  98. online.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    online.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  99. pc.edit-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    pc.edit-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    edit-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  100. pc.view-whatsapp.com HK · AS136038 · HDTIDC LIMITED2 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    pc.view-whatsapp.com
    First seen
    2026-11-09 11:14 UTC
    First published
    2026-11-08 11:07 UTC
    DNS
    Resolves · checked 2026-11-09 11:14 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.59.152.4.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.59.152.4
    Brand
    WhatsApp
    Addresses
    2.59.152.4 · Hong Kong · AS136038 HDTIDCCLOUD-AS-AP - HDTIDC LIMITED
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    view-whatsapp.com
    Registered
    2026-09-08 · Guizhou Zhongyu Zhike Network Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

Showing 101–200 of 6,131 hostnames.Back to the start
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources