Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-09 13:04 UTC
Certificate-log entries · 24 h
397.0M
from 84 distinct feeds
Unique certificates · 24 h
37.2M
each reviewed
Names resolved · 24 h
21.9M
16.6M with an address
Findings · 24 h
6,210
212 of 1,061 brands targeted

6,210 hostnames from the last 24 hours.

  1. pl-92827729f27272oferta111028280202982.cfd fd10:aec2:5dae::
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    pl-92827729f27272oferta111028280202982.cfd
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 08:29 UTC to 2027-02-07 08:29 UTC
    Logged 2026-11-09 09:27 UTC in Google PlumbersArms2027h1, entry 695,188,370
    SHA-256 850fd3d4e19fe6e93d095510aef17a1826d40912ffd940140430cf0957700061
    Public key SHA-256 c077e65839930e74da7b9521c08069c56a1de712d22b498ff3f32dc44da5eaa0
    Addresses
    fd10:aec2:5dae::
    Domain
    pl-92827729f27272oferta111028280202982.cfd
    Registered
    2026-11-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  2. pnuvelbar.net US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    pnuvelbar.net
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 04:25 UTC to 2027-02-07 05:22 UTC
    Logged 2026-11-09 05:25 UTC in Google ParcelYard2027h1, entry 691,429,306
    SHA-256 38bb84d29d2a827cf7e79023a42b6fdd391091889d4823c52d0b327d4a3427cc
    Public key SHA-256 15ca9cb38ad9c7f7e35f7fea3ea3f943f5e669ef59aa137eb17c7661515ca7ea
    Addresses
    104.21.55.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:37b8
    2606:4700:3036::ac43:ac1e
    Cloudflare
    Cloudflare (104.21.55.184, 172.67.172.30): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pnuvelbar.net
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  3. preapinfan.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    preapinfan.store
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-08 04:45 UTC to 2027-02-06 04:45 UTC
    Logged 2026-11-08 05:43 UTC in Geomys Tuscolo2027h1, entry 523,867,300
    SHA-256 39cf94fe14829f0b027e75b7751b0797b0b542bd26d61277791423c024595b43
    Public key SHA-256 63b54920011eaeaab92296afc3528148ff3cf359c48960f17f2a805765a953ad
    Addresses
    104.21.59.233 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.26 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:b91a
    2606:4700:3037::6815:3be9
    Cloudflare
    Cloudflare (104.21.59.233, 172.67.185.26): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    preapinfan.store
    Registered
    2026-11-08 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  4. renee-fashion.shop US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    renee-fashion.shop
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 05:10 UTC to 2027-02-07 06:10 UTC
    Logged 2026-11-09 06:10 UTC in Sectigo Statue2027h1, entry 102,448,551
    SHA-256 40c73a6c976b3b8b594003c02969f7b8d332052f662fdb4e43a77de6919ada6e
    Public key SHA-256 4ea2fb7b0c7100543b6c2139062e9091b59c28ce836cd0fa87f5e093d5e31233
    Addresses
    104.18.20.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.20.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    renee-fashion.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:44 UTC

    Suggest a correction

  5. reneestock.shop US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    reneestock.shop
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 06:56 UTC to 2027-02-07 07:54 UTC
    Logged 2026-11-09 07:56 UTC in Google ParcelYard2027h1, entry 693,529,994
    SHA-256 3500ef78407773e4e1682ffbb3a00c5c50c1e695c6fe2312f1b980f1730573ad
    Public key SHA-256 2779f02b9358ca28998eb09a396da7141f08e1a6f5e15e226312453e5434b1ec
    Addresses
    104.18.20.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.20.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    reneestock.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:44 UTC

    Suggest a correction

  6. siliccicch.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    siliccicch.store
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-08 04:46 UTC to 2027-02-06 04:46 UTC
    Logged 2026-11-08 05:44 UTC in Google ParcelYard2027h1, entry 672,112,778
    SHA-256 5062b83d1fa0a900ca3d6f02f7286709554018027dcf0fd62b5e7231ac454c0e
    Public key SHA-256 2d202a322fcda5ff33d0a25d661af9fdfca04db7695ac0dbd68b3572e68a8cb8
    Addresses
    104.21.8.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.157.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:9d4a
    2606:4700:3032::6815:868
    Cloudflare
    Cloudflare (104.21.8.104, 172.67.157.74): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    siliccicch.store
    Registered
    2026-11-08 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  7. truly1-sit6.cfd
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    truly1-sit6.cfd
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 08:22 UTC to 2027-02-07 08:22 UTC
    Logged 2026-11-09 09:21 UTC in Geomys Tuscolo2027h1, entry 542,056,622
    SHA-256 467376fe2b882ab81363ea18c209b3003c2210c4b1375ed88199c7ac5dcbe966
    Public key SHA-256 777c0ff997d00f47c6b216ed748b539c234d0c354cca25d4a1f1a009597883d3
    Domain
    truly1-sit6.cfd
    Registered
    2026-11-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  8. truly5-eum70.cfd US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    truly5-eum70.cfd
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 10:00 UTC to 2027-02-07 10:08 UTC
    Logged 2026-11-09 10:10 UTC in DigiCert Wyvern2027h1, entry 466,835,519
    SHA-256 8d7c309cdbee3f16e5539b479ad937c4e197b49c6af06ebaa5817bfc41d3ed68
    Public key SHA-256 e25e5b9d5a02c1ac5fefec58218084780db9191df618b933b2c9af089572ef72
    Addresses
    104.21.47.160 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.149.16 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:9510
    2606:4700:3032::6815:2fa0
    Cloudflare
    Cloudflare (104.21.47.160, 172.67.149.16): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    truly5-eum70.cfd
    Registered
    2026-11-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  9. unvismorp.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    unvismorp.store
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-08 05:34 UTC to 2027-02-06 05:42 UTC
    Logged 2026-11-08 05:44 UTC in DigiCert Sphinx2027h1, entry 398,163,137
    SHA-256 13e6a7dfccd2a0497717bd795c67a6d9bc9679ebb4ae4d00f581fdc5e4bbc473
    Public key SHA-256 6e653be88a42ebc8d04a87d1cc70cfbcbf68cd8a6b97c953821c3c2df79f8083
    Addresses
    104.21.53.210 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:35d2
    2606:4700:3034::ac43:dad6
    Cloudflare
    Cloudflare (104.21.53.210, 172.67.218.214): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    unvismorp.store
    Registered
    2026-11-08 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  10. verghadfre.store US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    verghadfre.store
    First seen
    2026-11-09 12:39 UTC
    Listing
    CERT Polska listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Certificate logged in CT
    2. Listed by CERT Polska
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-08 00:00 UTC to 2027-02-06 05:42 UTC
    Logged 2026-11-08 05:44 UTC in IPng Networks Gouda2027h1, entry 350,721,220
    SHA-256 7cd3547ad1235e1c286b16f6c29a4f2df99ea2e22f1acdc3840fb1930d1032cd
    Public key SHA-256 c799b987cde72370657ef24adaf2d6f02efd6b4c32ba3a40e5acf254964209f1
    Addresses
    104.21.58.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.162.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3037::6815:3ab2
    2606:4700:3037::ac43:a268
    Cloudflare
    Cloudflare (104.21.58.178, 172.67.162.104): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    verghadfre.store
    Registered
    2026-11-08 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  11. www.alyak-naver-seoul.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.alyak-naver-seoul.site
    First seen
    2026-11-09 12:36 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR2
    Valid 2026-11-09 11:32 UTC to 2027-02-07 11:32 UTC
    Logged 2026-11-09 12:30 UTC in Google PlumbersArms2027h1, entry 697,959,862
    SHA-256 d96d51dc362b4e58b22ed5296962aa19045e75f619181990a68422d2db4dafc7
    Public key SHA-256 2999f9246a20f214436327d90cbafe804db675136d527e3259e1d390d6911d9e
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    alyak-naver-seoul.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  12. alyak-naver-seoul.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    alyak-naver-seoul.site
    First seen
    2026-11-09 12:36 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR2
    Valid 2026-11-09 11:32 UTC to 2027-02-07 11:32 UTC
    Logged 2026-11-09 12:30 UTC in Google PlumbersArms2027h1, entry 697,959,862
    SHA-256 d96d51dc362b4e58b22ed5296962aa19045e75f619181990a68422d2db4dafc7
    Public key SHA-256 2999f9246a20f214436327d90cbafe804db675136d527e3259e1d390d6911d9e
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    alyak-naver-seoul.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  13. bioro.site US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    bioro.site
    First seen
    2026-11-09 12:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:33 UTC to 2027-02-07 12:32 UTC
    Logged 2026-11-09 12:33 UTC in Google ParcelYard2027h1, entry 697,725,820
    SHA-256 b8c4199503775a63216424184cdffd16f2b1deb6fe74599fea67e7a7ef47d800
    Public key SHA-256 1df3c208115f3f9a1685856fe5f4baf2569a6b3fb00f60f1b7231a26240763e9
    Addresses
    104.21.44.166 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.201.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.44.166, 172.67.201.94): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bioro.site
    Registered
    2026-09-11 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  14. fentrax.sbs
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    fentrax.sbs
    First seen
    2026-11-09 12:36 UTC
    Listing
    USOM listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 11:41 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:33 UTC to 2027-02-07 12:30 UTC
    Logged 2026-11-09 12:33 UTC in IPng Networks Halloumi2027h1, entry 426,324,658
    SHA-256 baf1ffcab3d6260b7b612173a6d1b600cd4ef59a74e8388dc2ab179e32b9f3a6
    Public key SHA-256 5476d1c47be3435d4ff75060f698cdcc31fb5e90b45107052c5db913170c846a
    Domain
    fentrax.sbs
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  15. gw.cloudfalre.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloudfalre.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    gw.cloudfalre.net
    First seen
    2026-11-09 12:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloudfalre.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:34 UTC to 2027-02-07 11:34 UTC
    Logged 2026-11-09 12:32 UTC in Google ParcelYard2027h1, entry 697,705,707
    SHA-256 1608f7cf519545d610031eba2244b1c99614d0a5567a7dd43f5404fae38ea809
    Public key SHA-256 a202bf234fe50cafb4c3b3f20c910e67c2559dd3b2be2d15385ab059f32b0f8b
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloudfalre.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:28 UTC

    Suggest a correction

  16. hv.hbnsgnnxe38.cc HK · AS133752 · LEASEWEB HONG KONG LIMITED
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    hv.hbnsgnnxe38.cc
    First seen
    2026-11-09 12:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:33 UTC to 2027-02-07 11:33 UTC
    Logged 2026-11-09 12:32 UTC in DigiCert Sphinx2027h1, entry 414,575,827
    SHA-256 264e9385626d0f7985960427a62c652391fb1b1981eb54dc50f1f0aff1e9648b
    Public key SHA-256 4f13d2c1c2930216821dcc3b629abdb2ffd01cdf04175719e1a4d7db87e53b3d
    Addresses
    27.0.232.35 · Hong Kong · AS133752 LEASEWEB-APAC-HKG-10 - LEASEWEB HONG KONG LIMITED
    Domain
    hbnsgnnxe38.cc
    Registered
    2026-09-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  17. illudschia.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    illudschia.cyou
    First seen
    2026-11-09 12:36 UTC
    Listing
    CERT Polska listed it 2026-07-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:32 UTC to 2027-02-07 12:31 UTC
    Logged 2026-11-09 12:32 UTC in Google ParcelYard2027h1, entry 697,705,248
    SHA-256 14421caa9a65bea84ab7732ca66037f7a60f148b5ca44a803bfb4a39051eb86e
    Public key SHA-256 6a26b06adb7a096d968368c73d4e57b69f8d8d3429390538e481817e34723677
    Domain
    illudschia.cyou
    Registered
    2026-07-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  18. prof-9263.eu.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    prof-9263.eu.cc
    First seen
    2026-11-09 12:36 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 11:34 UTC to 2027-02-07 11:34 UTC
    Logged 2026-11-09 12:32 UTC in Geomys Tuscolo2027h1, entry 544,273,686
    SHA-256 1b3774c304a7cb26e2455f4675f86b4ccac794dd6a5d431f30d802c2f5a709bb
    Public key SHA-256 d105e271157f405130328b1de6fa195e0ef96e4ef5e10cd0e49f289cf5ff39c9
    Addresses
    104.21.79.252 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.80 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.79.252, 172.67.172.80): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  19. tsldg.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tsldg.com
    First seen
    2026-11-09 12:36 UTC
    Listing
    CERT Polska listed it 2026-05-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 11:32 UTC to 2027-02-07 11:32 UTC
    Logged 2026-11-09 12:30 UTC in Google PlumbersArms2027h1, entry 697,959,231
    SHA-256 841bccc24f2c3323ce1f7ab252a412836414cbc1ce3a1f73360a523a149df4d6
    Public key SHA-256 83c395fd3c438dafc70910da11c00d4c62938a15e652945e5e1e3c4b0747ede2
    Addresses
    104.21.30.110 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.30.110, 172.67.172.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tsldg.com
    Registered
    2026-05-16 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  20. vvddct.lat US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    vvddct.lat
    First seen
    2026-11-09 12:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 11:35 UTC to 2027-02-07 11:35 UTC
    Logged 2026-11-09 12:34 UTC in Google PlumbersArms2027h1, entry 698,008,917
    SHA-256 62af624fff624aeaff468a5385b6722bba063d7b8478bd610f6bea1139c06305
    Public key SHA-256 22bfc421119f25c8595e211bd555f4ca907d0daa47ab43013733841a49f640b6
    Addresses
    104.21.75.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.177.124 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.75.143, 172.67.177.124): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vvddct.lat
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  21. www.modnakiecka-off.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.modnakiecka-off.shop
    First seen
    2026-11-09 12:36 UTC
    Listing
    CERT Polska listed it 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:33 UTC to 2027-02-07 12:33 UTC
    Logged 2026-11-09 12:33 UTC in IPng Networks Halloumi2027h1, entry 426,324,116
    SHA-256 8728968e019029aa2b87816f189e80eb110bece2bb4a896f2ba9ac085b551d4d
    Public key SHA-256 1d798e4f004cc20d14466a719662d18e8bb813a5ec90755ab9019273f5c2af98
    Addresses
    104.21.63.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.177 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.63.251, 172.67.173.177): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    modnakiecka-off.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  22. www.smoke-naver-ulsan.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.smoke-naver-ulsan.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:29 UTC to 2027-02-07 11:29 UTC
    Logged 2026-11-09 12:28 UTC in IPng Networks Halloumi2027h1, entry 426,268,913
    SHA-256 237a90b327e6ca12e98827457b4f91c069e6b0b621095cab0719d61db3e08b0a
    Public key SHA-256 b738bae8fc63f117c421a9c60b8dac3259d2bfb66a4f8ec8d547aef2702402ff
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    smoke-naver-ulsan.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  23. www.thca-naver-daegu.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.thca-naver-daegu.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:30 UTC to 2027-02-07 11:30 UTC
    Logged 2026-11-09 12:28 UTC in Let's Encrypt Willow2027h1, entry 1,039,835,222
    SHA-256 4f38c1e681f43c731dbbe140d39f7598bfabbb6a8d226f2d347f73d4df7c0edc
    Public key SHA-256 af787b0122f6cab37f03fb2c6ad201663a6a26668158d46c0bb44725c2d783d4
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    thca-naver-daegu.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  24. www.tteol-naver-gwangju.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.tteol-naver-gwangju.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:31 UTC to 2027-02-07 11:31 UTC
    Logged 2026-11-09 12:30 UTC in Google PlumbersArms2027h1, entry 697,954,754
    SHA-256 d0c4dbbddc87f6283f85c5ca4bdd94121728054cdda69dd73335f8261936e787
    Public key SHA-256 918b28e8ef081742aa993ec8bfb11321716488a101ee7952df7b4a3dbe3f6633
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    tteol-naver-gwangju.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  25. www.yaba-naver-ulsan.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.yaba-naver-ulsan.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 11:31 UTC to 2027-02-07 11:31 UTC
    Logged 2026-11-09 12:29 UTC in Geomys Tuscolo2027h1, entry 544,240,637
    SHA-256 3bfac4ae4b44708d2419b88d2e9e23fe1525bb924484db2f031e561113369cf8
    Public key SHA-256 5be9b59d0fa9f46322dd192e1ebfa015bc5158e873b3257d579494f1b0cc0c7b
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    yaba-naver-ulsan.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  26. yaba-naver-ulsan.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    yaba-naver-ulsan.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 11:31 UTC to 2027-02-07 11:31 UTC
    Logged 2026-11-09 12:29 UTC in Geomys Tuscolo2027h1, entry 544,240,637
    SHA-256 3bfac4ae4b44708d2419b88d2e9e23fe1525bb924484db2f031e561113369cf8
    Public key SHA-256 5be9b59d0fa9f46322dd192e1ebfa015bc5158e873b3257d579494f1b0cc0c7b
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    yaba-naver-ulsan.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  27. www.candies-naver-seoul.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.candies-naver-seoul.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:30 UTC to 2027-02-07 11:30 UTC
    Logged 2026-11-09 12:29 UTC in Google ParcelYard2027h1, entry 697,657,976
    SHA-256 ee3e70de77eff28a5cdcde32b721aaac343c7d3c825f350e2a6427f2dfe3f08a
    Public key SHA-256 1c9b5f45fc93e0877d3efec98fd1ad45a716926ca6a80eee56f97e2c4938267c
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    candies-naver-seoul.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  28. www.ketamine-naver-jeju.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.ketamine-naver-jeju.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:31 UTC to 2027-02-07 11:31 UTC
    Logged 2026-11-09 12:29 UTC in Google ParcelYard2027h1, entry 697,665,520
    SHA-256 1d3a682caa8912be5a98a504f7d402b119f0032898ddb60b7f82df39d2e925e9
    Public key SHA-256 d7ecb75b20cbb0dff2334676e4563e8ac171ded68493bdb0e400b6281fe4d809
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    ketamine-naver-jeju.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  29. smoke-naver-ulsan.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    smoke-naver-ulsan.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:29 UTC to 2027-02-07 11:29 UTC
    Logged 2026-11-09 12:28 UTC in IPng Networks Halloumi2027h1, entry 426,268,913
    SHA-256 237a90b327e6ca12e98827457b4f91c069e6b0b621095cab0719d61db3e08b0a
    Public key SHA-256 b738bae8fc63f117c421a9c60b8dac3259d2bfb66a4f8ec8d547aef2702402ff
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    smoke-naver-ulsan.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  30. thca-naver-daegu.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    thca-naver-daegu.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:30 UTC to 2027-02-07 11:30 UTC
    Logged 2026-11-09 12:28 UTC in Let's Encrypt Willow2027h1, entry 1,039,835,222
    SHA-256 4f38c1e681f43c731dbbe140d39f7598bfabbb6a8d226f2d347f73d4df7c0edc
    Public key SHA-256 af787b0122f6cab37f03fb2c6ad201663a6a26668158d46c0bb44725c2d783d4
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    thca-naver-daegu.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  31. tteol-naver-gwangju.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    tteol-naver-gwangju.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:31 UTC to 2027-02-07 11:31 UTC
    Logged 2026-11-09 12:30 UTC in Google PlumbersArms2027h1, entry 697,954,754
    SHA-256 d0c4dbbddc87f6283f85c5ca4bdd94121728054cdda69dd73335f8261936e787
    Public key SHA-256 918b28e8ef081742aa993ec8bfb11321716488a101ee7952df7b4a3dbe3f6633
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    tteol-naver-gwangju.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  32. uat.1xbet-yandex.top AE · AS59692 · IQWEB IQWeb FZ-LLCYandex
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    uat.1xbet-yandex.top
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 186.2.174.131.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 186.2.174.131
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 11:29 UTC to 2027-02-07 11:29 UTC
    Logged 2026-11-09 12:28 UTC in IPng Networks Gouda2027h1, entry 363,719,748
    SHA-256 cd3c164f1821f48e6e8341d1c26a372ee1b36fc276c26ea931789dcf106f665d
    Public key SHA-256 8ec1be87c3630ea9aebc6947cbe26e342b5e7a91bcdf2b498fa1bfe40dd20d9a
    Brand
    Yandex
    Addresses
    186.2.174.131 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    1xbet-yandex.top
    Registered
    2026-02-12 · PDR Ltd.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 20:53 UTC

    Suggest a correction

  33. ketamine-naver-jeju.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ketamine-naver-jeju.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:31 UTC to 2027-02-07 11:31 UTC
    Logged 2026-11-09 12:29 UTC in Google ParcelYard2027h1, entry 697,665,520
    SHA-256 1d3a682caa8912be5a98a504f7d402b119f0032898ddb60b7f82df39d2e925e9
    Public key SHA-256 d7ecb75b20cbb0dff2334676e4563e8ac171ded68493bdb0e400b6281fe4d809
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    ketamine-naver-jeju.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  34. candies-naver-seoul.site RU · AS197695 · AS-REGRU "Domain names regi…Naver
    Phishing hostRegistrar page · REG.RUAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    candies-naver-seoul.site
    First seen
    2026-11-09 12:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 95.163.244.138
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:30 UTC to 2027-02-07 11:30 UTC
    Logged 2026-11-09 12:29 UTC in Google ParcelYard2027h1, entry 697,657,976
    SHA-256 ee3e70de77eff28a5cdcde32b721aaac343c7d3c825f350e2a6427f2dfe3f08a
    Public key SHA-256 1c9b5f45fc93e0877d3efec98fd1ad45a716926ca6a80eee56f97e2c4938267c
    Brand
    Naver
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd · REG.RU (registrar page)
    Registrar page · REG.RU
    REG.RU (95.163.244.138): a registrar’s default page. The registrar shows it for the domains it holds that have no website yet.
    Domain
    candies-naver-seoul.site
    Registered
    2026-07-14 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:39 UTC

    Suggest a correction

  35. aazzjo.mom US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    aazzjo.mom
    First seen
    2026-11-09 12:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 11:29 UTC to 2027-02-07 11:29 UTC
    Logged 2026-11-09 12:27 UTC in Google ParcelYard2027h1, entry 697,637,337
    SHA-256 5f4f94dc00a049e3fc03ec6a0ee33cbeaaa8a8233658d032a021b15b30bbbb26
    Public key SHA-256 8e0af5a525f00baa67b4814ffa4c07fcb2c4cbc43df92fa4015b18ac64497881
    Addresses
    104.21.48.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.136 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.48.82, 172.67.182.136): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aazzjo.mom
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  36. acsnceshopping.shop
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    acsnceshopping.shop
    First seen
    2026-11-09 12:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:26 UTC to 2027-02-07 12:24 UTC
    Logged 2026-11-09 12:26 UTC in Google PlumbersArms2027h1, entry 697,901,375
    SHA-256 fc6903165433069d28fdfe01314576d250ee2a62fb254984fa1738519a8f5ce2
    Public key SHA-256 d1a265077f9040b3cda2931542e5bb4587a58a6bf5360dc3081b145aff52392a
    Domain
    acsnceshopping.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:34 UTC

    Suggest a correction

  37. ajufeey.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    ajufeey.xyz
    First seen
    2026-11-09 12:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 11:29 UTC to 2027-02-07 11:29 UTC
    Logged 2026-11-09 12:27 UTC in Google PlumbersArms2027h1, entry 697,920,038
    SHA-256 8ec86e84aee4f26f5a81869f44751c529419c7acfb99444c62db518cf00b77df
    Public key SHA-256 7b4a8eb6286523deb7fb74ce519edf49d3dfd1fa6de95c82b2338d52f568338a
    Addresses
    104.21.64.241 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.138.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.241, 172.67.138.44): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ajufeey.xyz
    Registered
    2026-03-18 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  38. alfcasino.games US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    alfcasino.games
    First seen
    2026-11-09 12:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:28 UTC to 2027-02-07 12:26 UTC
    Logged 2026-11-09 12:28 UTC in Geomys Tuscolo2027h1, entry 544,231,245
    SHA-256 35b340c51a9cadf7704f97f525fe3c612addb87b044eeef255894ea13713d020
    Public key SHA-256 cfb17e5ddba7a8a6f206e2f37bab338c63b467c94ca9c2c6e384cdcf401aed3f
    PhishDestroy
    Addresses
    104.21.75.109 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.200 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.75.109, 172.67.221.200): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    alfcasino.games
    Registered
    2026-01-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  39. apps-ledgre-live.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    apps-ledgre-live.pages.dev
    First seen
    2026-11-09 12:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:28 UTC to 2027-02-07 12:25 UTC
    Logged 2026-11-09 12:28 UTC in Google PlumbersArms2027h1, entry 697,925,320
    SHA-256 0313cc05348015ce00c6b95ee0402ea84b171e688b4a9a5a2f8c111c48e598fe
    Public key SHA-256 3cdeb5691b29d0d23e77e43cc678416aa786d37086889f33085f2d93cf145c55
    Addresses
    172.66.44.145 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.111 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.145, 172.66.47.111): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  40. base.hyperpeak.ai DE · AS24940 · HETZNER-AS Hetzner Online G…
    ReportedHetznerUnder hyperpeak.ai, reported by PhishDestroyMX absentSPF ?allDMARC policy noneRegistered 19 mo ago
    DetailsHide
    Hostname
    base.hyperpeak.ai
    First seen
    2026-11-09 12:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing hyperpeak.ai and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 11:31 UTC to 2027-02-07 11:31 UTC
    Logged 2026-11-09 12:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,084,236,432
    SHA-256 5e803b25f816abee8eb2fcbf6825a7da93a22b4ac3a6e03e8a8f59ff2a2a154f
    Public key SHA-256 bd15fae0dd47df23695b87366100a432d95da32e471e21c33f9dbe665cb3519d
    PhishDestroy
    Addresses
    128.140.15.134 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (128.140.15.134): a cloud provider. It rents servers and addresses to its customers.
    Domain
    hyperpeak.ai
    Registered
    2025-04-17 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ?all: other senders are neutral
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 08:49 UTC

    Suggest a correction

  41. creatorrequestcenter.com DK · AS214902 · PFWEBSOLUTIONS Philip Fjaer…
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    creatorrequestcenter.com
    First seen
    2026-11-09 12:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 11:27 UTC to 2027-02-07 11:27 UTC
    Logged 2026-11-09 12:26 UTC in Let's Encrypt Willow2027h1, entry 1,039,775,068
    SHA-256 75450d2396dc0ae9b07fb0009777ff5fd2b53df97932aa63d4f412ed649fe9c5
    Public key SHA-256 eb6d542c6b7ca323f6f2dcbd94d32b1910056827ab6b01943852f6b71beadd66
    Addresses
    5.175.171.191 · Denmark · AS214902 PFWEBSOLUTIONS Philip Fjaera trading as PFWeb Solutions
    Domain
    creatorrequestcenter.com
    Registered
    2026-03-23 · Turkticaret.net Yazilim Hizmetleri Sanayi ve Ticaret A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  42. darknetfaq.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    darknetfaq.com
    First seen
    2026-11-09 12:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:29 UTC to 2027-02-07 12:28 UTC
    Logged 2026-11-09 12:29 UTC in DigiCert Sphinx2027h1, entry 414,546,415
    SHA-256 572177fed973511524e99264a0aeccc3a3af491f1282bf5a073474f524a2993e
    Public key SHA-256 b2883d4243cda7ad4091bd26baa8ee7642ef1e353cf8e93b0b539b1f5b861293
    PhishDestroy
    Addresses
    104.21.42.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.156.22 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.42.39, 172.67.156.22): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    darknetfaq.com
    Registered
    2022-10-24 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  43. frumzi-casino6.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    frumzi-casino6.com
    First seen
    2026-11-09 12:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:26 UTC to 2027-02-07 12:26 UTC
    Logged 2026-11-09 12:26 UTC in DigiCert Sphinx2027h1, entry 414,522,451
    SHA-256 0e18e83c830d393795c8fa3947e58a84bed3aede3e531fad9bf0afd4e674de94
    Public key SHA-256 b69771e3d52b7e8200f017b21dfbcf2f86aafb994470eb0b89259bb3bfe070ef
    PhishDestroy
    Addresses
    104.21.6.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.139, 172.67.154.228): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    frumzi-casino6.com
    Registered
    2026-02-02 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  44. lbqkg.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    lbqkg.com
    First seen
    2026-11-09 12:31 UTC
    Listing
    CERT Polska listed it 2026-05-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 11:28 UTC to 2027-02-07 11:28 UTC
    Logged 2026-11-09 12:26 UTC in IPng Networks Halloumi2027h1, entry 426,251,727
    SHA-256 03a1d5c67b538ea191baadfd76ca251e9c171bbdcd38c74f7b6f23e0ceb0aa47
    Public key SHA-256 6e96a669fe78ff70b635fbaf095e9be5acf748753f8611ea80e0b076e5fc3029
    Addresses
    104.21.62.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.139.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.213, 172.67.139.88): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lbqkg.com
    Registered
    2026-05-16 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  45. mafia-casinos-france.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    mafia-casinos-france.com
    First seen
    2026-11-09 12:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:28 UTC to 2027-02-07 12:28 UTC
    Logged 2026-11-09 12:28 UTC in DigiCert Sphinx2027h1, entry 414,539,734
    SHA-256 2bcc288eea7edbef54d0cc89e77561ecca0ec35a0e9c939bbed6e692aed5ac1e
    Public key SHA-256 a108b227244b3fd1109135790d0c5cc35a50688e6abd0901c41c9da2adcdc339
    PhishDestroy
    Addresses
    104.21.31.129 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.136 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.31.129, 172.67.176.136): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mafia-casinos-france.com
    Registered
    2026-04-09 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  46. opendota.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    opendota.net
    First seen
    2026-11-09 12:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-11 10:46 UTC to 2026-12-10 11:43 UTC
    Logged 2026-11-09 12:27 UTC in DigiCert Wyvern2026h2, entry 2,214,299,037
    SHA-256 5f83222b26970891d4c41e0ae259996f176fd645351e33c28016ee084437602e
    Public key SHA-256 f9b75180572dc51844abb7b224c96f4c8f5b4bcd437633e052c61c795412eac2
    PhishDestroy
    Addresses
    104.21.75.60 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.214.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.75.60, 172.67.214.249): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    opendota.net
    Registered
    2025-11-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  47. qzovarel-official.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    qzovarel-official.com
    First seen
    2026-11-09 12:31 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:28 UTC to 2027-02-07 12:27 UTC
    Logged 2026-11-09 12:28 UTC in Let's Encrypt Willow2027h1, entry 1,039,830,068
    SHA-256 451b312b36f7e1da539a810258ca91a520d39547a2b29f284ac66916b67c4f77
    Public key SHA-256 41b0d18895ffe41a0cf37ea4fd2f03c677624935212dc5cbe4768ee754cb7744
    Addresses
    104.21.79.128 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.174 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.79.128, 172.67.145.174): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qzovarel-official.com
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  48. s2-quant.network US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    s2-quant.network
    First seen
    2026-11-09 12:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 11:27 UTC to 2027-02-07 12:25 UTC
    Logged 2026-11-09 12:30 UTC in DigiCert Wyvern2027h1, entry 468,166,785
    SHA-256 4c7668e152eebbe05c3262eb1da9c377f4d54108b7ea63e3de778df2d5d35a6e
    Public key SHA-256 9dc7bf948cca4ad5385aa3c633e1ae5da4e35ac4455855c38edc76ff7354c515
    PhishDestroy
    Addresses
    104.21.67.223 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.14 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.67.223, 172.67.182.14): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    s2-quant.network
    Registered
    2025-11-19 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:34 UTC

    Suggest a correction

  49. vaxubai.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX presentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    vaxubai.pro
    First seen
    2026-11-09 12:31 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:28 UTC to 2027-02-07 12:27 UTC
    Logged 2026-11-09 12:28 UTC in IPng Networks Halloumi2027h1, entry 426,272,358
    SHA-256 329ba18d388b10c8a8eb8456f34928f016a5e0c923612f96ad5a8438d266b44f
    Public key SHA-256 0992a9d7bf4a49934f6601ad7ed6a948e0197743de55483452adf93ee7d0d629
    Addresses
    104.21.22.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.22.175, 172.67.205.247): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vaxubai.pro
    Registered
    2026-07-14 · NameCheap, Inc.
    MX
    Receives mail at mail.vaxubai.pro
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  50. xeunoeu.top US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by NPA 165 (e-commerce)MX absentSPF missingDMARC quarantineRegistered 13 mo ago
    DetailsHide
    Hostname
    xeunoeu.top
    First seen
    2026-11-09 12:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-09 12:26 UTC to 2027-05-26 12:26 UTC
    Logged 2026-11-09 12:26 UTC in GoDaddy Aquamarine2027h1, entry 201,568,488
    SHA-256 343f3d2880745b06eaa71208dd6fac4bb60911fa5f49273f229fddd1b3465ee6
    Public key SHA-256 83b19a58822335b14c9b23c33b7a3d45158d8aab9474aee858ca72a67e5ef962
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    xeunoeu.top
    Registered
    2025-10-21 · GoDaddy.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  51. lafeedor-disney.fr FR · AS16276 · OVH OVH SASDisney+
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 18 mo ago
    DetailsHide
    Hostname
    lafeedor-disney.fr
    First seen
    2026-11-09 12:26 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.135.23.164.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.135.23.164
    Certificate
    Issued by YE1
    Valid 2026-11-09 11:25 UTC to 2027-02-07 11:25 UTC
    Logged 2026-11-09 12:24 UTC in Google PlumbersArms2027h1, entry 697,866,370
    SHA-256 231d4b85e45aafd9042f028d790f6236692aba51a7e898ce8fb7dc7311aa6474
    Public key SHA-256 662588297284be8ceabfe0308264c9f0ae2169096af75b87e7fc520bb5c023d9
    Brand
    Disney+
    Addresses
    5.135.23.164 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (5.135.23.164): a cloud provider. It rents servers and addresses to its customers.
    Domain
    lafeedor-disney.fr
    Registered
    2025-05-23 · OVH
    MX
    Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:01 UTC

    Suggest a correction

  52. bitmarrt.trade US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    bitmarrt.trade
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:24 UTC to 2027-02-07 12:21 UTC
    Logged 2026-11-09 12:24 UTC in Geomys Tuscolo2027h1, entry 544,183,105
    SHA-256 dadf9389233d8fb2d4c0556312e33d873180e176ff1acad96535c53d1b830e7a
    Public key SHA-256 1cdd16d095b24acef92a28ef44bac761d731d346af26eaf1c6b1467ec8b46f04
    Addresses
    104.21.31.71 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.65 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.31.71, 172.67.175.65): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bitmarrt.trade
    Registered
    2026-07-14 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:27 UTC

    Suggest a correction

  53. cashcat.onsol.fun US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    cashcat.onsol.fun
    First seen
    2026-11-09 12:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:22 UTC to 2027-02-07 12:21 UTC
    Logged 2026-11-09 12:22 UTC in Google PlumbersArms2027h1, entry 697,846,990
    SHA-256 3fcf3625ab8d4f5da9986a3f2e42360e52a71f9c921bc34e9151ad2c7abfd414
    Public key SHA-256 33ae32602f9250cd5f92f9f08bd6a29e2988b1ae75804fe16067818938869d0c
    PhishDestroy
    Addresses
    104.21.42.187 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.208.92 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.42.187, 172.67.208.92): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    onsol.fun
    Registered
    2026-07-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  54. changeiiy.to US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    changeiiy.to
    First seen
    2026-11-09 12:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:25 UTC to 2027-02-07 12:22 UTC
    Logged 2026-11-09 12:25 UTC in DigiCert Sphinx2027h1, entry 414,515,653
    SHA-256 902509f733e8484041735ec5e14181e3a182a8398573b8261ddf26677111f275
    Public key SHA-256 6aec89a0ffccd6b5843f08fdee88a6e6deee4f71fd5ce7b4fee5ad7b4b7c5d43
    PhishDestroy
    Addresses
    104.21.58.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.215 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.58.228, 172.67.165.215): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changeiiy.to
    Registered
    2025-11-19 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  55. content.cloydflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloydflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    content.cloydflare.net
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloydflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 11:22 UTC to 2027-02-07 11:22 UTC
    Logged 2026-11-09 12:21 UTC in IPng Networks Halloumi2027h1, entry 426,192,710
    SHA-256 94279ecafae97e0d95b81f27e9c039f3ea23644c7d26309b73f96e39e405c5c4
    Public key SHA-256 25c3d140a22bae8773d62273059a9ebf6b98811bb997d6cdce415ac026a68a94
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloydflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:21 UTC

    Suggest a correction

  56. crownlessgame.app US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    crownlessgame.app
    First seen
    2026-11-09 12:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:21 UTC to 2027-02-07 12:20 UTC
    Logged 2026-11-09 12:21 UTC in Geomys Tuscolo2027h1, entry 544,151,475
    SHA-256 38cb41b4faeb289593046edda610d305b3a8a7005d45fef20f7828399165311d
    Public key SHA-256 a3763647d9f94a4f3b60ccc8caa84a6411e3e7ec476ab656fecc4baf5cbe3270
    PhishDestroy
    Addresses
    104.21.60.2 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.161 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.60.2, 172.67.186.161): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    crownlessgame.app
    Registered
    2025-11-19 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  57. frameinfil.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    frameinfil.cyou
    First seen
    2026-11-09 12:26 UTC
    Listing
    CERT Polska listed it 2026-05-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 11:23 UTC to 2027-02-07 11:23 UTC
    Logged 2026-11-09 12:22 UTC in Google ParcelYard2027h1, entry 697,561,402
    SHA-256 3df5606e7799457b2e02a908efc0ea31a7f042dc13c6a3651ab1d43b6dde6406
    Public key SHA-256 4d824256f44ace0f5fd7fdb756118bf7345c4abe72f5e9b582869d4651df0d2e
    Domain
    frameinfil.cyou
    Registered
    2026-05-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  58. kxrhj.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    kxrhj.asia
    First seen
    2026-11-09 12:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:21 UTC to 2027-02-07 12:20 UTC
    Logged 2026-11-09 12:21 UTC in Google PlumbersArms2027h1, entry 697,829,149
    SHA-256 74fa0914ac3d783e6a23597c2791a71bd7748de0c621443f82f165336f25e1ba
    Public key SHA-256 89020209cfaebaf5aad01afe309c7ad77b2f9685b6f80b5b7ee42f9c3c66a1fd
    Addresses
    104.21.36.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.18 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.36.17, 172.67.183.18): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kxrhj.asia
    Registered
    2026-07-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  59. mteamsmisoft.world US · AS14956 · RouterHosting LLC
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 14 d ago
    DetailsHide
    Hostname
    mteamsmisoft.world
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-28 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:25 UTC to 2027-02-07 11:25 UTC
    Logged 2026-11-09 12:24 UTC in IPng Networks Gouda2027h1, entry 363,697,232
    SHA-256 2193d1ce6debc29fb29b747ba01adaaa5d0781a596917b868116c51d454681f4
    Public key SHA-256 8c7b48704388cd21786de2aa50f0cc8fcdcb17b780c3883e106fb1801fe4d1a8
    Addresses
    172.86.89.132 · United States · AS14956 ROUTERHOSTING - RouterHosting LLC
    Domain
    mteamsmisoft.world
    Registered
    2026-10-26 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  60. service.hyperpeak.ai DE · AS24940 · HETZNER-AS Hetzner Online G…
    ReportedHetznerUnder hyperpeak.ai, reported by PhishDestroyMX absentSPF ?allDMARC policy noneRegistered 19 mo ago
    DetailsHide
    Hostname
    service.hyperpeak.ai
    First seen
    2026-11-09 12:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing hyperpeak.ai and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:25 UTC to 2027-02-07 11:25 UTC
    Logged 2026-11-09 12:24 UTC in Let's Encrypt Willow2027h1, entry 1,039,731,708
    SHA-256 4262e537f7e64312f0e4e7b321794f8f33ea5bef1ddac30375742b3d31415bcd
    Public key SHA-256 7be9cd1f1152a6b94450226a9352178fce1c336cc7e7fea6a6a60ad97405cbc1
    PhishDestroy
    Addresses
    157.180.78.83 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (157.180.78.83): a cloud provider. It rents servers and addresses to its customers.
    Domain
    hyperpeak.ai
    Registered
    2025-04-17 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ?all: other senders are neutral
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 08:49 UTC

    Suggest a correction

  61. spinqora.vip PA · AS51852 · PLI-AS Private Layer INC
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    spinqora.vip
    First seen
    2026-11-09 12:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 11:24 UTC to 2027-02-07 11:24 UTC
    Logged 2026-11-09 12:22 UTC in DigiCert Wyvern2027h1, entry 468,096,533
    SHA-256 06e93c719c1ca3d6fa19ac0bfae98c7e761a27a1f4cca55cf5201cda7be74871
    Public key SHA-256 3a114f77b0c3042fe9ef8ca0128a876392e6a4284b9774785701eaf4c604170d
    PhishDestroy
    Addresses
    94.26.35.38 · Panama · AS51852 PLI-AS Private Layer INC
    Domain
    spinqora.vip
    Registered
    2026-05-16 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  62. sso.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    sso.fresh-focus.pro
    First seen
    2026-11-09 12:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 11:24 UTC to 2027-02-07 11:24 UTC
    Logged 2026-11-09 12:23 UTC in IPng Networks Gouda2027h1, entry 363,691,387
    SHA-256 743602ef30d832d1d6c15ca9eaa6fe627bf3439287064c1b2f5df89c9e2fd177
    Public key SHA-256 fdc9385f35ffbe9d2cc84febec389a63d50b26561a4f2bad89ee64d36c83bbb0
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  63. trackvesit.com AE · AS59692 · IQWEB IQWeb FZ-LLC
    ListedListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    trackvesit.com
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 11:24 UTC to 2027-02-07 11:24 UTC
    Logged 2026-11-09 12:23 UTC in Google PlumbersArms2027h1, entry 697,854,958
    SHA-256 0af7e291da63b27f89ccd8537b3792cec3b9aa2f2857a567004e2fcbf95244ad
    Public key SHA-256 220cca71469208ffcc9deeea33b72ef29827fc2081bec9cd8a2c2be8b1bdc977
    Addresses
    190.115.31.132 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    trackvesit.com
    Registered
    2026-09-05 · Porkbun LLC
    MX
    Receives mail at fwd1.porkbun.com, fwd2.porkbun.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  64. vasakronan.stage.io-ext.se BE · AS34762 · COMBELL-AS Combell NV
    ListedUnder io-ext.se, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    vasakronan.stage.io-ext.se
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing io-ext.se and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:23 UTC to 2027-02-07 11:23 UTC
    Logged 2026-11-09 12:21 UTC in Google PlumbersArms2027h1, entry 697,829,549
    SHA-256 2b1f7ace004d153d34cd36017df0a00b0972446dbb04f556c1a4a20269ac1e26
    Public key SHA-256 d7f2e1ae1f57b5d3e9fc454fa3727d6c3e7cdae7cb109a1286c575b3bdead69a
    Addresses
    188.208.37.137 · Belgium · AS34762 COMBELL-AS Combell NV
    Domain
    io-ext.se
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:17 UTC

    Suggest a correction

  65. wap.cloydflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloydflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    wap.cloydflare.net
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloydflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 11:22 UTC to 2027-02-07 11:22 UTC
    Logged 2026-11-09 12:21 UTC in IPng Networks Halloumi2027h1, entry 426,192,710
    SHA-256 94279ecafae97e0d95b81f27e9c039f3ea23644c7d26309b73f96e39e405c5c4
    Public key SHA-256 25c3d140a22bae8773d62273059a9ebf6b98811bb997d6cdce415ac026a68a94
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloydflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:21 UTC

    Suggest a correction

  66. ww16.nmxquantify.com AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicUnder nmxquantify.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    ww16.nmxquantify.com
    First seen
    2026-11-09 12:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing nmxquantify.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 11:25 UTC to 2027-02-07 11:25 UTC
    Logged 2026-11-09 12:24 UTC in Google PlumbersArms2027h1, entry 697,866,022
    SHA-256 bc745fd7a25e56bb5122f6ea39059f6625e2736b800498fc6671b147f8976ac7
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.241 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates nmxquantify.com to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.241): a parking service. It answers for names that are typically for sale or unused.
    Domain
    nmxquantify.com
    Registered
    2024-05-16 · Dynadot Inc
    MX
    Receives mail at mx156.hostedmxserver.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 19:05 UTC

    Suggest a correction

  67. www.curve-finance.com.mx US · AS13335 · Cloudflare, Inc.4 addressesCurve Finance
    ListedCloudflareUnder curve-finance.com.mx, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.curve-finance.com.mx
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing curve-finance.com.mx and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 11:22 UTC to 2027-02-07 12:19 UTC
    Logged 2026-11-09 12:22 UTC in DigiCert Wyvern2027h1, entry 468,090,330
    SHA-256 3dbd368fd3faafde353d4af0e1f6a9841186ce1c1d5944a2c84d7b48e172ccb2
    Public key SHA-256 fd4f9cb8297afb11def47492be80828cc67d5cad6d67a33309c8bcaf7477b8c2
    Brand
    Curve Finance
    Addresses
    104.21.60.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:bf70
    2606:4700:3037::6815:3c26
    Cloudflare
    Cloudflare (104.21.60.38, 172.67.191.112): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    curve-finance.com.mx
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:42 UTC

    Suggest a correction

  68. zebec-superapp.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    zebec-superapp.org
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 11:23 UTC to 2027-02-07 12:22 UTC
    Logged 2026-11-09 12:24 UTC in DigiCert Wyvern2027h1, entry 468,116,607
    SHA-256 41cc7171016a8c77f8a126b8d428994aba3f6d5616baadcbbac30e57a3fad44e
    Public key SHA-256 9aa546e5a9014e311a3ef74d8b6bcec9578acab8f669ba73ed0356cde3ccaa18
    Addresses
    104.21.45.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.45.186, 172.67.218.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zebec-superapp.org
    Registered
    2026-07-08 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  69. zebec-supperapp.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    zebec-supperapp.net
    First seen
    2026-11-09 12:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 11:22 UTC to 2027-02-07 12:21 UTC
    Logged 2026-11-09 12:22 UTC in Sectigo Statue2027h1, entry 105,378,478
    SHA-256 089cd3dcc5991091547aa12655032eacef11de8fa740c9e9e2c97c2ffc63086a
    Public key SHA-256 ce87e9bc8964946e75fd81603ef6c8c56dc9a007ca59fce243a711b09509fe17
    Addresses
    104.21.13.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.155.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.13.112, 172.67.155.225): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zebec-supperapp.net
    Registered
    2026-07-08 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  70. cn-whatsapp.com.cn SC · AS197170 · TECHTIES-AS TechTies Inc.3 addressesWhatsApp
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    cn-whatsapp.com.cn
    First seen
    2026-11-09 12:24 UTC
    First published
    2026-11-06 12:10 UTC
    DNS
    Resolves · checked 2026-11-09 12:24 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 94.26.106.98.
    1. Phishing-host list fetched with the address
    2. Resolved to 94.26.106.98
    Brand
    WhatsApp
    Addresses
    94.26.106.98 · Seychelles · AS197170 TECHTIES-AS TechTies Inc.
    45.156.87.201 · Seychelles · AS197170 TECHTIES-AS TechTies Inc.
    154.219.113.52 · Hong Kong · AS137899 ILAYERLIMITED-AS-AP - I LAYER LIMITED
    Domain
    cn-whatsapp.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:05 UTC

    Suggest a correction

  71. site.pokerdom-iphone-ios.ru AE · AS59692 · IQWEB IQWeb FZ-LLCApple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    site.pokerdom-iphone-ios.ru
    First seen
    2026-11-09 12:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 186.2.174.131.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 186.2.174.131
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:18 UTC to 2027-02-07 11:18 UTC
    Logged 2026-11-09 12:16 UTC in IPng Networks Halloumi2027h1, entry 426,144,291
    SHA-256 4b29a8acf293bd461a094accd6f706a6b92812482ea1dff2b271fff266bf3ccd
    Public key SHA-256 4c0833e1de2d52fd8d2fc5dd0bd13958d91c79506fa1f9b9802e770a136ba4f6
    Brand
    Apple
    Addresses
    186.2.174.131 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    pokerdom-iphone-ios.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 22:34 UTC

    Suggest a correction

  72. online.pokerdom-iphone-ios.ru AE · AS59692 · IQWEB IQWeb FZ-LLCApple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    online.pokerdom-iphone-ios.ru
    First seen
    2026-11-09 12:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 186.2.174.131.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 186.2.174.131
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:17 UTC to 2027-02-07 11:17 UTC
    Logged 2026-11-09 12:16 UTC in DigiCert Sphinx2027h1, entry 414,415,758
    SHA-256 0a4f65934eb25b0b7afa824c8b49356475c50f1d052a284a154ead9b8ab134b9
    Public key SHA-256 105a2cf5d135ad901f0875f3e197fdcc054da8d370bd0cd680d8c3ce6e8630d8
    Brand
    Apple
    Addresses
    186.2.174.131 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    pokerdom-iphone-ios.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 22:34 UTC

    Suggest a correction

  73. 2fawalletauthenticator.us US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 59 d ago
    DetailsHide
    Hostname
    2fawalletauthenticator.us
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:21 UTC to 2027-02-07 11:21 UTC
    Logged 2026-11-09 12:20 UTC in DigiCert Sphinx2027h1, entry 414,461,849
    SHA-256 9b31f75fdc2d9e83194600e6242e817582818a05e4eab717afb8269416bfeeb4
    Public key SHA-256 575f3bb76c27ef98849a75197a05aec3329bc5fc2e9237f277e088cf2de3569f
    Addresses
    104.21.12.223 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.128 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.12.223, 172.67.196.128): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    2fawalletauthenticator.us
    Registered
    2026-09-11 · NameSilo, LLC
    MX
    Receives mail at _dc-mx.1e8ed4eb9e25.2fawalletauthenticator.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  74. aboutyou.svip-pl.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    aboutyou.svip-pl.com
    First seen
    2026-11-09 12:20 UTC
    Listing
    CERT Polska listed it 2026-07-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    CERT Polska listed it 2026-07-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-11 09:42 UTC to 2026-12-10 10:42 UTC
    Logged 2026-11-09 12:16 UTC in DigiCert Wyvern2026h2, entry 2,214,280,574
    SHA-256 aa3d3209491f6f6d2bdfedda50916fa4b3595c7e76b18936d38d6304f07a542e
    Public key SHA-256 7592b5c362835ce26386df5aad162f180e34d1c47162b817a139b1f9cb725fd4
    Addresses
    104.21.25.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.134.98 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.25.164, 172.67.134.98): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    svip-pl.com
    Registered
    2026-07-14 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:12 UTC

    Suggest a correction

  75. alice.mywallet.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under mywallet.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 29 y ago
    DetailsHide
    Hostname
    alice.mywallet.com
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing mywallet.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:19 UTC to 2027-02-07 11:19 UTC
    Logged 2026-11-09 12:18 UTC in IPng Networks Gouda2027h1, entry 363,649,416
    SHA-256 083fcc0c8094b959d1839d649ae1c99a5cdfd21814e35c3d9fc30a505819a77a
    Public key SHA-256 0f43122657a1ab0c8b99d53e848c5d24fc988e81a766ef9919390b0ca47e2c8a
    Addresses
    185.53.179.200 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.200): a parking service. It answers for names that are typically for sale or unused.
    Domain
    mywallet.com
    Registered
    1998-01-22 · MarkMonitor Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  76. app.kitlv.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder kitlv.cc, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    app.kitlv.cc
    First seen
    2026-11-09 12:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing kitlv.cc and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:19 UTC to 2027-02-07 11:19 UTC
    Logged 2026-11-09 12:18 UTC in IPng Networks Gouda2027h1, entry 363,649,367
    SHA-256 2678a4e0f84fc561c18be8d3145bfdc544cd9ea1b27e9d80503aef76dd115b4c
    Public key SHA-256 6b00d960911f7e8a98651d92718c402ccda12197ce1d3d9a03b7b2bb09a03a5f
    PhishDestroy
    Addresses
    103.224.212.211 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates kitlv.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.211): a parking service. It answers for names that are typically for sale or unused.
    Domain
    kitlv.cc
    Registered
    2026-07-17 · Thirdroundnames LLC
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  77. bbb.crushxp.com GB · AS201738 · UFO-TECHNOLOGIES-LIMITED UF…
    ListedUnder crushxp.com, listed by CERT PolskaMX absentSPF -allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    bbb.crushxp.com
    First seen
    2026-11-09 12:20 UTC
    Listing
    CERT Polska listed it 2026-06-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    PhishDestroy: first observed in the feed 2026-10-26 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska, listing crushxp.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 11:17 UTC to 2027-02-07 11:17 UTC
    Logged 2026-11-09 12:15 UTC in Let's Encrypt Sycamore2027h1, entry 1,083,850,651
    SHA-256 40f073d0af1fed0ce49847409ad6fd1ad98d44d5e3beb4c1c7b56e4fe18e1792
    Public key SHA-256 3c3a22c70fe61811499e9ccc83f912c6893f0ed0a4274974fe1127dcb86bbba1
    Addresses
    109.238.86.5 · United Kingdom · AS201738 UFO-TECHNOLOGIES-LIMITED UFO TECHNOLOGIES LIMITED
    Domain
    crushxp.com
    Registered
    2023-02-15 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 13:33 UTC

    Suggest a correction

  78. bytexa.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    bytexa.vip
    First seen
    2026-11-09 12:20 UTC
    Listing
    CERT Polska listed it 2026-07-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:17 UTC to 2027-02-07 12:15 UTC
    Logged 2026-11-09 12:17 UTC in Google ParcelYard2027h1, entry 697,479,741
    SHA-256 0f588e15ce7d37b212a27479e0f03b37d3baa066254107d8937cd0257d66c5ec
    Public key SHA-256 8f7f0ca6e7a7274d1da8d781f6fd6e46c7f1995dbc94f42ec6d12c422cfaf2a6
    Addresses
    104.21.94.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.139.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.94.206, 172.67.139.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bytexa.vip
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  79. campabedel.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    campabedel.cyou
    First seen
    2026-11-09 12:20 UTC
    Listing
    CERT Polska listed it 2026-05-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:17 UTC to 2027-02-07 11:17 UTC
    Logged 2026-11-09 12:16 UTC in DigiCert Sphinx2027h1, entry 414,417,605
    SHA-256 397c96dcba3a80c5b1e0bcb16519588d3304bec98576f468175bba4dcaa8f591
    Public key SHA-256 d69d5117d55d09ea7b4429d32deaeb0983c47a59a1702ece5e7ee0a5aa14ff2f
    Domain
    campabedel.cyou
    Registered
    2026-05-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  80. claim-nova.xyz US · AS14956 · RouterHosting LLC
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 d ago
    DetailsHide
    Hostname
    claim-nova.xyz
    First seen
    2026-11-09 12:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:21 UTC to 2027-02-07 11:21 UTC
    Logged 2026-11-09 12:20 UTC in IPng Networks Gouda2027h1, entry 363,666,866
    SHA-256 218c620647f02675206436f545e439ae47c371a683502a194dd1941e7c909665
    Public key SHA-256 60577d805b77acad9725d65c19bfce644b62ff85cf2c3084b4e9f6435ce447eb
    PhishDestroy
    Addresses
    107.189.27.113 · United States · AS14956 ROUTERHOSTING - RouterHosting LLC
    Domain
    claim-nova.xyz
    Registered
    2026-10-28 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  81. claimallocation.autos DE · AS47846 · SEDO-AS SEDO GmbH
    ListedParking page · SedoListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    claimallocation.autos
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Encryption Everywhere DV TLS CA - G2 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-02-06 23:59 UTC
    Logged 2026-11-09 12:15 UTC in Let's Encrypt Sycamore2027h1, entry 1,083,856,798
    SHA-256 1271d4124d994cae212bc0e04a943dd8a1c22fbc00edbbbecf413c62992d4225
    Public key SHA-256 5360e37b3bf5d2e04e9be8d88381de7b5386fa46272cfe8ba740e8eba3e8fcad
    Addresses
    91.195.240.94 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.94): a parking service. It answers for names that are typically for sale or unused.
    Domain
    claimallocation.autos
    Registered
    2026-05-22 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  82. ddqqjm.cfd US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    ddqqjm.cfd
    First seen
    2026-11-09 12:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 11:17 UTC to 2027-02-07 11:17 UTC
    Logged 2026-11-09 12:15 UTC in Google ParcelYard2027h1, entry 697,461,410
    SHA-256 2dd72ec1f4b6088bb332d2151959e653ae74394d28f5a462238b500de0c9e5f4
    Public key SHA-256 f0e5f1d0fd6161626ffda91e126039565c8efd565b93746f0c5180b84de89d47
    Addresses
    104.21.53.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.195, 172.67.217.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ddqqjm.cfd
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  83. dimiamosci.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    dimiamosci.cyou
    First seen
    2026-11-09 12:20 UTC
    Listing
    CERT Polska listed it 2026-05-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 11:18 UTC to 2027-02-07 11:18 UTC
    Logged 2026-11-09 12:16 UTC in Let's Encrypt Willow2027h1, entry 1,039,525,173
    SHA-256 6891b010d4489b9ed7181df2ca76b15ce49481b5e79be1a27383ddea7b9e3082
    Public key SHA-256 406b6fae195678399b16b0cac47055e26265889c931dcc28458cf6f050410e9d
    Domain
    dimiamosci.cyou
    Registered
    2026-05-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  84. drive.clloudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clloudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    drive.clloudflare.net
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clloudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 11:21 UTC to 2027-02-07 11:21 UTC
    Logged 2026-11-09 12:19 UTC in Google ParcelYard2027h1, entry 697,519,806
    SHA-256 5d84d8a2e5ce5804b889c7944452ad99a5d6d4d301f895dc66e2e25acdb85a92
    Public key SHA-256 684c816900d8e7890b57245a316e710b84eff908a303626e192e981cd30462b7
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clloudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 14:46 UTC

    Suggest a correction

  85. foreignmartbd.com BD · AS63969 · Race Online Limited
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 10 mo ago
    DetailsHide
    Hostname
    foreignmartbd.com
    First seen
    2026-11-09 12:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 11:17 UTC to 2027-02-07 11:17 UTC
    Logged 2026-11-09 12:16 UTC in Google ParcelYard2027h1, entry 697,467,093
    SHA-256 d609e960a049ffcc454e76eb6bf552d7bd0bbb613b56bccd6c47115db38d1b25
    Public key SHA-256 8b67f7a4f3ef4286b66cd96e093fdf770b739cb14c58f3182d94a8a296ad4aa0
    PhishDestroy
    Addresses
    154.89.7.100 · Bangladesh · AS63969 RACEONLINE-BD - Race Online Limited
    Domain
    foreignmartbd.com
    Registered
    2026-01-08 · Realtime Register B.V.
    MX
    Receives mail at foreignmartbd.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  86. haopingwuxing.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    haopingwuxing.com
    First seen
    2026-11-09 12:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-11 14:30 UTC to 2026-12-10 15:30 UTC
    Logged 2026-11-09 12:19 UTC in DigiCert Wyvern2026h2, entry 2,214,285,881
    SHA-256 f277f12b3f9f5104d384e629239b07d4bd0175966760263fbb544a636c3ab145
    Public key SHA-256 e820c65f39232280264696a3ea667190689bd64b5b776361611c1d66ca557ff1
    Addresses
    104.21.58.102 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.58.102, 172.67.159.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    haopingwuxing.com
    Registered
    2026-07-14 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  87. jwzsc.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    jwzsc.asia
    First seen
    2026-11-09 12:20 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:19 UTC to 2027-02-07 12:17 UTC
    Logged 2026-11-09 12:19 UTC in Google ParcelYard2027h1, entry 697,509,720
    SHA-256 b6d720339be424d0ccb0b6506581da2d4abb14d7b1e8be99f14d8d42bf4c6882
    Public key SHA-256 2edd96c55afeeb44184b838dffb172b1e5db3ef52006f3b1fe8410c9b6fe0aea
    Addresses
    104.21.20.109 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.192.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.20.109, 172.67.192.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jwzsc.asia
    Registered
    2026-07-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  88. kitlv.cc AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    kitlv.cc
    First seen
    2026-11-09 12:20 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:19 UTC to 2027-02-07 11:19 UTC
    Logged 2026-11-09 12:18 UTC in IPng Networks Gouda2027h1, entry 363,649,367
    SHA-256 2678a4e0f84fc561c18be8d3145bfdc544cd9ea1b27e9d80503aef76dd115b4c
    Public key SHA-256 6b00d960911f7e8a98651d92718c402ccda12197ce1d3d9a03b7b2bb09a03a5f
    PhishDestroy
    Addresses
    103.224.212.211 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates kitlv.cc to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.211): a parking service. It answers for names that are typically for sale or unused.
    Domain
    kitlv.cc
    Registered
    2026-07-17 · Thirdroundnames LLC
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  89. lighters.digital US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    lighters.digital
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 11:17 UTC to 2027-02-07 11:17 UTC
    Logged 2026-11-09 12:15 UTC in Google ParcelYard2027h1, entry 697,461,919
    SHA-256 1d824c529ba150eec9092bc9383180f2fea31bd8a7c27aef5e6449b4f2f6e057
    Public key SHA-256 b7ce2e3618e0702a792d4fa08a950ee1ba6fa0bcd21010d26a5fd6b80d6414d9
    Addresses
    104.21.60.245 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.202.202 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.60.245, 172.67.202.202): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lighters.digital
    Registered
    2026-05-15 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  90. microsoftonline.us.orgMicrosoft
    ListedListed by MetaMask
    DetailsHide
    Hostname
    microsoftonline.us.org
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 11:18 UTC to 2027-02-07 11:18 UTC
    Logged 2026-11-09 12:16 UTC in IPng Networks Gouda2027h1, entry 363,638,968
    SHA-256 6a8299358ecfd41a11bd6cf959b9b60e96bb231b0b3601993a462663eb9ba20e
    Public key SHA-256 0dadf69fe4037970d8cc9096de88d3415025532cc03a49c96a859f65efc42085
    Brand
    Microsoft

    Suggest a correction

  91. oxgeyvgl.bim-mx.info DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under bim-mx.info, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    oxgeyvgl.bim-mx.info
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing bim-mx.info and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:19 UTC to 2027-02-07 11:19 UTC
    Logged 2026-11-09 12:17 UTC in DigiCert Sphinx2027h1, entry 414,429,602
    SHA-256 96c09cd94df3b37de8bdb91714f3234212a87e1748195e9c6b87af54cc8becda
    Public key SHA-256 bf06aa7d1e8ea2c142a2dd7b1849118347c4e366d7c53017ac7c120f760edd1b
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    bim-mx.info
    Registered
    2026-06-05 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 23:42 UTC

    Suggest a correction

  92. polymarket-world.com US · AS14061 · DigitalOcean, LLCPolymarket
    ListedPhishing hostDigitalOceanListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    polymarket-world.com
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 209.38.105.192.
    1. Phishing-host list fetched with the address
    2. Resolved to 209.38.105.192
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:19 UTC to 2027-02-07 11:19 UTC
    Logged 2026-11-09 12:18 UTC in Google ParcelYard2027h1, entry 697,496,312
    SHA-256 2135212905bd8a095b9c3b8ae171fccf1a1e01dc192dcbad0b9ab4fcc3e3ec0f
    Public key SHA-256 1ac9612d3d1ce7fe7915c1332e4238997d229a41263f9e3c71401658ab2bf0df
    Brand
    Polymarket
    Addresses
    209.38.105.192 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (209.38.105.192): a cloud provider. It rents servers and addresses to its customers.
    Domain
    polymarket-world.com
    Registered
    2026-07-24 · Internet Domain Service BS Corp
    MX
    Receives mail at mx1.forwardemail.net, mx2.forwardemail.net
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  93. stackiq.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    stackiq.vip
    First seen
    2026-11-09 12:20 UTC
    Listing
    CERT Polska listed it 2026-10-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:37 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:19 UTC to 2027-02-07 12:18 UTC
    Logged 2026-11-09 12:19 UTC in Google PlumbersArms2027h1, entry 697,798,937
    SHA-256 86cc0ee2e87ee6bfdc38d1296a1ad4d3c6a74e0ed125f163b4e1e95078fab52f
    Public key SHA-256 8281888e873f8b6a675c1fcbc8988e0cf91e76c9179bb0fbf386b88d97f3e96d
    Addresses
    104.21.15.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.27 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.15.159, 172.67.163.27): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    stackiq.vip
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  94. www.polymarket-world.com US · AS14061 · DigitalOcean, LLCPolymarket
    ListedPhishing hostDigitalOceanUnder polymarket-world.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.polymarket-world.com
    First seen
    2026-11-09 12:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing polymarket-world.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 209.38.105.192.
    1. Phishing-host list fetched with the address
    2. Resolved to 209.38.105.192
    Certificate
    Issued by YR1
    Valid 2026-11-09 11:19 UTC to 2027-02-07 11:19 UTC
    Logged 2026-11-09 12:18 UTC in Google ParcelYard2027h1, entry 697,496,312
    SHA-256 2135212905bd8a095b9c3b8ae171fccf1a1e01dc192dcbad0b9ab4fcc3e3ec0f
    Public key SHA-256 1ac9612d3d1ce7fe7915c1332e4238997d229a41263f9e3c71401658ab2bf0df
    Brand
    Polymarket
    Addresses
    209.38.105.192 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (209.38.105.192): a cloud provider. It rents servers and addresses to its customers.
    Domain
    polymarket-world.com
    Registered
    2026-07-24 · Internet Domain Service BS Corp
    MX
    Receives mail at mx1.forwardemail.net, mx2.forwardemail.net
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  95. atuboasset.com US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by NPA 165 (finance and insurance)MX presentSPF ~allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    atuboasset.com
    First seen
    2026-11-09 12:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 01:35 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 11:12 UTC to 2027-02-07 12:12 UTC
    Logged 2026-11-09 12:12 UTC in Google PlumbersArms2027h1, entry 697,707,258
    SHA-256 43089f5ed63979aa9754d24f96e4f0c45351a81fdcfed58655db04893f3775e2
    Public key SHA-256 9453c779ebf30a7de147e8d1a4a00e6239508622e0d02772ff1f53ec8b9bfbf7
    Addresses
    104.18.220.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.220.38): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    atuboasset.com
    Registered
    2026-07-14 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  96. autoconfig.groupman.net GB · AS209341 · WHG-FRA WHG Hosting Service…
    ReportedUnder groupman.net, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 14 mo ago
    DetailsHide
    Hostname
    autoconfig.groupman.net
    First seen
    2026-11-09 12:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing groupman.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 11:14 UTC to 2027-02-07 11:14 UTC
    Logged 2026-11-09 12:12 UTC in Google ParcelYard2027h1, entry 697,422,742
    SHA-256 05cda9f700c21a7ef5ef43842b42f0af6472596f6cbb5381854cfc941e23304b
    Public key SHA-256 7ff7f80819233ce4865017920f2d5b5df1f2f066ed59e37567d63be2b464c610
    PhishDestroy
    Addresses
    209.124.66.7 · United Kingdom · AS209341 WHG-FRA WHG Hosting Services Ltd
    Domain
    groupman.net
    Registered
    2025-09-06 · NameSilo, LLC
    MX
    Receives mail at mail.groupman.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  97. autodiscover.groupman.net GB · AS209341 · WHG-FRA WHG Hosting Service…
    ReportedUnder groupman.net, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 14 mo ago
    DetailsHide
    Hostname
    autodiscover.groupman.net
    First seen
    2026-11-09 12:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing groupman.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 11:14 UTC to 2027-02-07 11:14 UTC
    Logged 2026-11-09 12:12 UTC in Google ParcelYard2027h1, entry 697,422,742
    SHA-256 05cda9f700c21a7ef5ef43842b42f0af6472596f6cbb5381854cfc941e23304b
    Public key SHA-256 7ff7f80819233ce4865017920f2d5b5df1f2f066ed59e37567d63be2b464c610
    PhishDestroy
    Addresses
    209.124.66.7 · United Kingdom · AS209341 WHG-FRA WHG Hosting Services Ltd
    Domain
    groupman.net
    Registered
    2025-09-06 · NameSilo, LLC
    MX
    Receives mail at mail.groupman.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  98. capitalflowtrader.com US · AS13335 · Cloudflare, Inc.3 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF -allDMARC quarantineRegistered 24 mo ago
    DetailsHide
    Hostname
    capitalflowtrader.com
    First seen
    2026-11-09 12:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: observed back in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-09 11:59 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-01 (7 days)
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 11:16 UTC to 2027-02-07 11:16 UTC
    Logged 2026-11-09 12:14 UTC in Google PlumbersArms2027h1, entry 697,729,274
    SHA-256 416410936602413725cf5cdff08c156a7fb5d20134df22b26972cc5f879b4794
    Public key SHA-256 709da8e0f0b0ad5cdf0d993853910f217ae647a95f3c67680dcece9e03cf13fa
    Addresses
    104.26.12.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.26.13.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.68.71 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.26.12.142, 104.26.13.142, 172.67.68.71): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    capitalflowtrader.com
    Registered
    2024-11-22 · GoDaddy.com, LLC
    MX
    Receives mail at capitalflowtrader-com.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 07:04 UTC

    Suggest a correction

  99. capscutapk.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    capscutapk.com
    First seen
    2026-11-09 12:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 11:15 UTC to 2027-02-07 11:15 UTC
    Logged 2026-11-09 12:13 UTC in DigiCert Sphinx2027h1, entry 414,392,866
    SHA-256 47333db9e3f68aaabeadd9c45d48ca5c26a7619c8b0a6ff53d74fba8fa9015e5
    Public key SHA-256 26465476b58402c18ad1f5a4c51fee26b032ea47e70a623128f3aae1a4a45cc5
    PhishDestroy
    Addresses
    104.21.47.113 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.56 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.113, 172.67.147.56): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    capscutapk.com
    Registered
    2023-06-01 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

  100. cpanel.groupman.net GB · AS209341 · WHG-FRA WHG Hosting Service…
    ReportedUnder groupman.net, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 14 mo ago
    DetailsHide
    Hostname
    cpanel.groupman.net
    First seen
    2026-11-09 12:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing groupman.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 11:14 UTC to 2027-02-07 11:14 UTC
    Logged 2026-11-09 12:12 UTC in Google ParcelYard2027h1, entry 697,422,742
    SHA-256 05cda9f700c21a7ef5ef43842b42f0af6472596f6cbb5381854cfc941e23304b
    Public key SHA-256 7ff7f80819233ce4865017920f2d5b5df1f2f066ed59e37567d63be2b464c610
    PhishDestroy
    Addresses
    209.124.66.7 · United Kingdom · AS209341 WHG-FRA WHG Hosting Services Ltd
    Domain
    groupman.net
    Registered
    2025-09-06 · NameSilo, LLC
    MX
    Receives mail at mail.groupman.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 13:10 UTC

    Suggest a correction

Showing 101–200 of 6,210 hostnames.Back to the start
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources