Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-09 16:36 UTC
Certificate-log entries · 24 h
404.9M
from 84 distinct feeds
Unique certificates · 24 h
38.2M
each reviewed
Names resolved · 24 h
22.7M
17.2M with an address
Findings · 24 h
6,325
210 of 1,061 brands targeted

6,325 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. www.australiantaxationoffice.org.au AU · AS45638 · SYNERGY WHOLESALE PTY LTDAustralian Taxation Office
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC policy none
    DetailsHide
    Hostname
    www.australiantaxationoffice.org.au
    First seen
    2026-11-09 16:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 103.42.108.46.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 103.42.108.46
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-02-07 23:59 UTC
    Logged 2026-11-09 16:30 UTC in Geomys Tuscolo2027h1, entry 547,181,008
    SHA-256 f923035301eb04108d8b2aeacc4863fcf477ee9497a4e9cfaf1976bc1b486bc3
    Public key SHA-256 4a3b6e59b85e0d90c8ee9dc2587abb7b88b328882bdaf173bd219083e04c52e4
    Brand
    Australian Taxation Office
    Addresses
    103.42.108.46 · Australia · AS45638 SYNERGYWHOLESALE-AP - SYNERGY WHOLESALE PTY LTD
    Domain
    australiantaxationoffice.org.au
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  2. starlink-installation.com.au AU · AS45638 · SYNERGY WHOLESALE PTY LTDStarlink
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC policy none
    DetailsHide
    Hostname
    starlink-installation.com.au
    First seen
    2026-11-09 16:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 103.42.108.46.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 103.42.108.46
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2
    Valid 2026-11-09 00:00 UTC to 2027-02-07 23:59 UTC
    Logged 2026-11-09 16:27 UTC in IPng Networks Halloumi2027h1, entry 428,782,636
    SHA-256 839e046656315a28f70d5665662ac32b66e899736c430b93709baae0d8bb375a
    Public key SHA-256 39735a20801c4efdecfcef6a295fd8025bd97b392c5bbf4a44fe4ec0cf4e5f29
    Brand
    Starlink
    Addresses
    103.42.108.46 · Australia · AS45638 SYNERGYWHOLESALE-AP - SYNERGY WHOLESALE PTY LTD
    Domain
    starlink-installation.com.au
    MX
    Receives mail at mx1.nameserver.net.au, mx2.nameserver.net.au, mx3.nameserver.net.au
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  3. alumni.cloufflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloufflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    alumni.cloufflare.net
    First seen
    2026-11-09 16:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloufflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 15:29 UTC to 2027-02-07 15:29 UTC
    Logged 2026-11-09 16:27 UTC in IPng Networks Gouda2027h1, entry 365,379,288
    SHA-256 d43fd555b4d02407e57027deca7cb10e3b3a482c4b6e3dc1fc06839452a9be33
    Public key SHA-256 f4e6a8c0f2fd128fe4578413ff6687f4f81508dee8e8a9d37fc2e48764673084
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloufflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  4. cankwe.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    cankwe.com
    First seen
    2026-11-09 16:31 UTC
    Listing
    CERT Polska listed it 2026-07-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:29 UTC to 2027-02-07 16:28 UTC
    Logged 2026-11-09 16:29 UTC in IPng Networks Halloumi2027h1, entry 428,808,356
    SHA-256 ca95d32499df4c1a25f54727a1bfaabb35ba556c127a998519d7ab4021450b3a
    Public key SHA-256 48cd757c2e026a2edecbbcaf3ae5c59267b975e867033ded7bd6b9b61d5b2872
    Addresses
    104.21.47.80 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.170.199 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.80, 172.67.170.199): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cankwe.com
    Registered
    2026-07-10 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  5. cdidev.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    cdidev.xyz
    First seen
    2026-11-09 16:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 13:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:17 UTC to 2027-02-07 16:26 UTC
    Logged 2026-11-09 16:27 UTC in DigiCert Sphinx2027h1, entry 416,892,066
    SHA-256 24a9cebca37b14b8cf959482617f23ef54a53b37334d223224971fe19c60a9be
    Public key SHA-256 4568e24a4d49cbc768348bd0fd05e1ac9d2ebd23ffacdbfeb133a91918e2ab5a
    Addresses
    104.21.64.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.179.114 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.85, 172.67.179.114): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cdidev.xyz
    Registered
    2025-12-15 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  6. cp.cloufflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloufflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    cp.cloufflare.net
    First seen
    2026-11-09 16:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloufflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 15:29 UTC to 2027-02-07 15:29 UTC
    Logged 2026-11-09 16:27 UTC in IPng Networks Gouda2027h1, entry 365,379,288
    SHA-256 d43fd555b4d02407e57027deca7cb10e3b3a482c4b6e3dc1fc06839452a9be33
    Public key SHA-256 f4e6a8c0f2fd128fe4578413ff6687f4f81508dee8e8a9d37fc2e48764673084
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloufflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  7. flarefndn-xrp.live US · AS13335 · Cloudflare, Inc.4 addressesFlare Network
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    flarefndn-xrp.live
    First seen
    2026-11-09 16:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 15:25 UTC to 2027-02-07 16:24 UTC
    Logged 2026-11-09 16:27 UTC in DigiCert Wyvern2027h1, entry 470,730,940
    SHA-256 a8d5fa4f9a4a9a211a3401258707332296bb3872ee6031010d3392a5bf176c05
    Public key SHA-256 0e28c3afd01da8dde1f0983fd95aefb8ff3920e5c730baa91bfcb1623f7fe4e6
    Brand
    Flare Network
    Addresses
    104.21.73.240 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3036::ac43:c174
    2606:4700:3037::6815:49f0
    Cloudflare
    Cloudflare (104.21.73.240, 172.67.193.116): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    flarefndn-xrp.live
    Registered
    2026-07-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:33 UTC

    Suggest a correction

  8. guildguard888.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    guildguard888.pro
    First seen
    2026-11-09 16:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:25 UTC to 2027-02-07 16:24 UTC
    Logged 2026-11-09 16:25 UTC in Geomys Tuscolo2027h1, entry 547,121,825
    SHA-256 db6f85804bca03e9c56e3a45f2a0bff086bdc13d6b347b6d2742a8368e5f02de
    Public key SHA-256 4417a9c344210b3de2da3e2c82b45a577ecaab45e0b529a53fa514dc5a4f9740
    PhishDestroy
    Addresses
    104.21.6.177 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.135.21 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.177, 172.67.135.21): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    guildguard888.pro
    Registered
    2026-01-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  9. inppvalidities.info SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 38 d ago
    DetailsHide
    Hostname
    inppvalidities.info
    First seen
    2026-11-09 16:31 UTC
    Listing
    CERT Polska listed it 2026-10-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 15:31 UTC to 2027-02-07 15:31 UTC
    Logged 2026-11-09 16:30 UTC in DigiCert Sphinx2027h1, entry 416,918,873
    SHA-256 61bf93a1098410784bd0ed8b51abd52be9ed0d1e16c2f9f6bfa90a44340f3fbd
    Public key SHA-256 667f90bd01c9f8788cf6dc3c220d2f38fd9aa91698702efc77324c211a233d0b
    Addresses
    5.187.39.44 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    inppvalidities.info
    Registered
    2026-10-02 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  10. jenkins.cloudflarw.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloudflarw.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    jenkins.cloudflarw.net
    First seen
    2026-11-09 16:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloudflarw.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 15:31 UTC to 2027-02-07 15:31 UTC
    Logged 2026-11-09 16:29 UTC in Google PlumbersArms2027h1, entry 701,676,568
    SHA-256 a46bd6e9bbaa88cc2cab158234ad9aa027fc87511c3d25d438444bec08b652d3
    Public key SHA-256 16726b502a7954256d5a20b0ff361bb09b4a5c9e85aa7e38367d79067dd0b4a0
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloudflarw.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 17:18 UTC

    Suggest a correction

  11. kunlunwanwei.net US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (lottery and gambling)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    kunlunwanwei.net
    First seen
    2026-11-09 16:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 13:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 15:27 UTC to 2027-02-07 15:27 UTC
    Logged 2026-11-09 16:26 UTC in Google PlumbersArms2027h1, entry 701,620,961
    SHA-256 057cd71ead92700e5f75b78a2f5d549441140da8c5b4aeac5810af95018aff4c
    Public key SHA-256 3854b902f06a3307cd42c11217f930551b4cd5f695c27ce169517b96b732aa30
    Addresses
    104.21.55.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.55.64, 172.67.145.94): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kunlunwanwei.net
    Registered
    2026-03-18 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  12. legacy.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    legacy.fresh-focus.pro
    First seen
    2026-11-09 16:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 15:29 UTC to 2027-02-07 15:29 UTC
    Logged 2026-11-09 16:27 UTC in DigiCert Wyvern2027h1, entry 470,734,874
    SHA-256 09cac51c9543f988b03c575c024d8e782f9d11b5429e798d022487aaee0d30d5
    Public key SHA-256 6ea9c0b27a2b35d966a1b65be9b863542551209c0e853fe2369981ba6d1c4817
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 14:46 UTC

    Suggest a correction

  13. live.cloydflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloydflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    live.cloydflare.net
    First seen
    2026-11-09 16:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloydflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 15:28 UTC to 2027-02-07 15:28 UTC
    Logged 2026-11-09 16:26 UTC in Google PlumbersArms2027h1, entry 701,625,874
    SHA-256 409c0693de33e2ec4f2da9a1926203756dd0c721e6167ce7d23769ce7f6460cd
    Public key SHA-256 4caf9b3f38b1c3dfbfe30a07daa4956f50c0a340238cbcb2ce4d98dcaa1ecc9c
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloydflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:21 UTC

    Suggest a correction

  14. pactswap.claims US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    pactswap.claims
    First seen
    2026-11-09 16:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:18 UTC to 2027-02-07 16:26 UTC
    Logged 2026-11-09 16:28 UTC in DigiCert Sphinx2027h1, entry 416,896,144
    SHA-256 e1ae0d109db2401ee2c0e7d6053fd76ffb98e7b2fd2b688e4c29b0b25eed188b
    Public key SHA-256 39e91c21e1529b67f266d6ec4d8cb36b86ef3790721497fbb302e322c04a89c5
    PhishDestroy
    Addresses
    104.21.70.141 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.70.141, 172.67.136.50): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pactswap.claims
    Registered
    2025-12-06 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  15. perlkonat.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    perlkonat.com
    First seen
    2026-11-09 16:31 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 15:29 UTC to 2027-02-07 16:27 UTC
    Logged 2026-11-09 16:30 UTC in IPng Networks Gouda2027h1, entry 365,399,654
    SHA-256 367f586577509dc4a348ba4e46ac2261122130e6dbbe316f2c19a6ad0444b468
    Public key SHA-256 756607c86b6107ede43cdaba0979f6e6c12f82a1bd356bf32bb1dcd29e78e10d
    Addresses
    104.21.83.99 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.83.99, 172.67.221.82): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    perlkonat.com
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  16. ploplo.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    ploplo.live
    First seen
    2026-11-09 16:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 15:31 UTC to 2027-02-07 15:31 UTC
    Logged 2026-11-09 16:29 UTC in Google PlumbersArms2027h1, entry 701,680,205
    SHA-256 3db0fddb75f630e0312acb1269c321874300ef0c715047a6df740905137a60e7
    Public key SHA-256 818de4c1e5c90928d8c606f3335467103fc89f5a2f04eef1d7a146ee0e873b8f
    Addresses
    104.21.79.170 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.79.170, 172.67.146.158): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ploplo.live
    Registered
    2026-09-11 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  17. teams6web.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    teams6web.com
    First seen
    2026-11-09 16:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 15:31 UTC to 2027-02-07 15:31 UTC
    Logged 2026-11-09 16:30 UTC in Let's Encrypt Sycamore2027h1, entry 1,090,610,194
    SHA-256 db883f31d0d2b1db9a7e904a0df288c38fff4e7b1e0e0da9cb8d539f1eacf4c8
    Public key SHA-256 644b3ce95248bc53bd270d19fcb8fc3bc453c8f765ac9cd62b9372307acdabe7
    Addresses
    104.21.88.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.8 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.88.50, 172.67.173.8): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    teams6web.com
    Registered
    2026-09-11 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  18. tebezvotintel.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    tebezvotintel.com
    First seen
    2026-11-09 16:31 UTC
    Listing
    CERT Polska listed it 2026-07-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:26 UTC to 2027-02-07 16:25 UTC
    Logged 2026-11-09 16:26 UTC in DigiCert Wyvern2027h1, entry 470,725,314
    SHA-256 01474c6b1fc7010bc8123c0f7fb881f8bbd8c8dd1ce319500531a31afe16bd6d
    Public key SHA-256 fa7580894fbfbf9684de617e2b5cd60a7117ff7945a6252364b9fff3f96a4a9b
    Addresses
    104.21.55.54 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.55.54, 172.67.144.214): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tebezvotintel.com
    Registered
    2026-07-14 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:33 UTC

    Suggest a correction

  19. web3.cloydflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloydflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    web3.cloydflare.net
    First seen
    2026-11-09 16:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloydflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 15:28 UTC to 2027-02-07 15:28 UTC
    Logged 2026-11-09 16:26 UTC in Google PlumbersArms2027h1, entry 701,625,874
    SHA-256 409c0693de33e2ec4f2da9a1926203756dd0c721e6167ce7d23769ce7f6460cd
    Public key SHA-256 4caf9b3f38b1c3dfbfe30a07daa4956f50c0a340238cbcb2ce4d98dcaa1ecc9c
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloydflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:21 UTC

    Suggest a correction

  20. www.loijh.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder loijh.shop, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.loijh.shop
    First seen
    2026-11-09 16:31 UTC
    Listing
    CERT Polska listed it 2026-09-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    Listed
    CERT Polska, listing loijh.shop and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 15:28 UTC to 2027-02-07 16:28 UTC
    Logged 2026-11-09 16:29 UTC in Sectigo Statue2027h1, entry 107,450,958
    SHA-256 24fd65da27648d120dd9b94b0764c2e842b7de347450866334dbedeb4ffee5d9
    Public key SHA-256 17301883e6e771997bb558b7e0e17c5b8190997e1fd5d3845e60db9b24a6b12e
    Addresses
    104.18.217.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.18.218.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.217.221, 104.18.218.221): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    loijh.shop
    Registered
    2026-09-09 · Alibaba Cloud Computing Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  21. yv03.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    yv03.cc
    First seen
    2026-11-09 16:27 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:27 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    yv03.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  22. yv15.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    yv15.cc
    First seen
    2026-11-09 16:27 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:27 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    yv15.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  23. xw70.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    xw70.cc
    First seen
    2026-11-09 16:27 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:27 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    xw70.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  24. xd07.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    xd07.cc
    First seen
    2026-11-09 16:27 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:27 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    xd07.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  25. ahproedge.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    ahproedge.com
    First seen
    2026-11-09 16:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:14 UTC to 2027-02-07 16:23 UTC
    Logged 2026-11-09 16:24 UTC in DigiCert Sphinx2027h1, entry 416,849,961
    SHA-256 0f8881a069f05a071e2dd4da47836d5e3470ad74001120d5b60892c104921bca
    Public key SHA-256 797f161ce99af7604223df7cfa535b0a10d8b5886911050deb5815e6d1ed6e51
    Domain
    ahproedge.com
    Registered
    2026-02-26 · Internet Domain Service BS Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  26. apps-moonshot.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    apps-moonshot.net
    First seen
    2026-11-09 16:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:24 UTC to 2027-02-07 16:23 UTC
    Logged 2026-11-09 16:24 UTC in DigiCert Sphinx2027h1, entry 416,850,627
    SHA-256 5184ae44a77cec473da0c0c1cc50d84fd21db28c37deb76e898f9419e401277f
    Public key SHA-256 fb3e6a26f0ddaa6a9b148824d72633809c47b6727e6dc613f0af7085de21f2f0
    PhishDestroy
    Addresses
    104.21.79.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.169.102 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.79.82, 172.67.169.102): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    apps-moonshot.net
    Registered
    2026-04-11 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  27. bitslot.life US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    bitslot.life
    First seen
    2026-11-09 16:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:15 UTC to 2027-02-07 16:23 UTC
    Logged 2026-11-09 16:25 UTC in DigiCert Wyvern2027h1, entry 470,702,819
    SHA-256 8328c36bfda24699f49c2b93ccd8a4ab845ee41566f713ac00c6205341799bad
    Public key SHA-256 f9fdc10d069ab2c00c93d21d5670dc9168d5b83b8f48e1d327dc8faf9e9e835d
    PhishDestroy
    Addresses
    104.21.73.231 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.136 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.73.231, 172.67.167.136): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bitslot.life
    Registered
    2025-12-21 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  28. brasil-renda-gpt.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    brasil-renda-gpt.org
    First seen
    2026-11-09 16:26 UTC
    Listing
    CERT Polska listed it 2026-09-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:20 UTC to 2027-02-07 16:17 UTC
    Logged 2026-11-09 16:20 UTC in DigiCert Sphinx2027h1, entry 416,814,571
    SHA-256 932ca841117d67f627a7dc7e0b981959efde8ddf59e1e93d8fe1142028e299ba
    Public key SHA-256 00400936bafbfb4094fefc63b4054b4fd6956e08134b221bb6f2aded1b32ef5e
    Addresses
    104.21.31.215 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.179.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.31.215, 172.67.179.253): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    brasil-renda-gpt.org
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  29. chip18.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    chip18.cc
    First seen
    2026-11-09 16:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 15:23 UTC to 2027-02-07 16:20 UTC
    Logged 2026-11-09 16:24 UTC in DigiCert Wyvern2027h1, entry 470,697,469
    SHA-256 44aa39f7dc019fe740398761e2e402a591d7ec5aa10e40531304eb498bd6f817
    Public key SHA-256 a71e269c46ca7094f8f8451e2882d3ba334dd2710983239391cd2500a279263a
    PhishDestroy
    Addresses
    104.21.58.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.58.116, 172.67.159.104): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    chip18.cc
    Registered
    2022-03-15 · DotWee Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  30. en-ledgr-hardware.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    en-ledgr-hardware.pages.dev
    First seen
    2026-11-09 16:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:14 UTC to 2027-02-07 16:23 UTC
    Logged 2026-11-09 16:24 UTC in DigiCert Sphinx2027h1, entry 416,851,575
    SHA-256 7d1a9e60776feae1170773c63fdb7153cb701372ec84ad7d08db0dbdd0ec791e
    Public key SHA-256 d51aef85a9122079736d798b952088c8383846602941d9a0a6144c7c3a629367
    Addresses
    172.66.44.53 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.203 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.53, 172.66.47.203): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  31. hdayv.asia US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    hdayv.asia
    First seen
    2026-11-09 16:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 13:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:23 UTC to 2027-02-07 16:21 UTC
    Logged 2026-11-09 16:23 UTC in DigiCert Wyvern2027h1, entry 470,676,149
    SHA-256 96e41f14edbcfd17837c2f8c502467ec7e43c58dd88eb5208e740ae187377eea
    Public key SHA-256 5e0f7b287ff598c2e5684826a9537b04a8b4c1cf1119bec12ef4cfcda9b34fa0
    Addresses
    104.21.75.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.59 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.75.214, 172.67.182.59): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hdayv.asia
    Registered
    2026-07-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  32. kryxexy.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    kryxexy.com
    First seen
    2026-11-09 16:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:11 UTC to 2027-02-07 16:18 UTC
    Logged 2026-11-09 16:21 UTC in Let's Encrypt Sycamore2027h1, entry 1,090,352,624
    SHA-256 797c8db6810a541a12b3b70173f58bccb89abb0576250105db2b919f8233242a
    Public key SHA-256 80a58746e3323a1bf04b5129a2aacd27180735b7343b39e385e69dbffb6ecda1
    Addresses
    104.21.50.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.196 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.50.182, 172.67.207.196): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kryxexy.com
    Registered
    2025-10-31 · Dynadot Inc
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  33. kta.fund US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    kta.fund
    First seen
    2026-11-09 16:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:11 UTC to 2027-02-07 16:20 UTC
    Logged 2026-11-09 16:21 UTC in DigiCert Sphinx2027h1, entry 416,820,072
    SHA-256 fd47f6ed20508270ff51fecfc8df9b6565ff8080f45f5bbafa6ec2722844d76e
    Public key SHA-256 81e2875915322f4b6c675f3b2f990253ac6879c2e9a68e175835edf35bd11c6d
    Addresses
    104.21.10.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.232 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.39, 172.67.189.232): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kta.fund
    Registered
    2026-04-27 · GNAME.COM PTE. LTD.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  34. mail.skypvausa.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    mail.skypvausa.com
    First seen
    2026-11-09 16:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 15:26 UTC to 2027-02-07 15:26 UTC
    Logged 2026-11-09 16:25 UTC in Google PlumbersArms2027h1, entry 701,600,528
    SHA-256 5f8efcfcfcdb6b187d0540d3d9d0b5d09442cc42be24c1534e71fc9d679e71f9
    Public key SHA-256 ee2492e8713669e25ae751d496f305d6211fe7f8df0a71d35ee766149856e7d3
    Addresses
    104.21.47.113 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.56 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.113, 172.67.147.56): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    skypvausa.com
    Registered
    2026-07-10 · Cloudflare, Inc.
    MX
    Receives mail at _dc-mx.b9bbead4a142.skypvausa.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  35. marshh.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    marshh.vip
    First seen
    2026-11-09 16:26 UTC
    Listing
    CERT Polska listed it 2026-07-26 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:22 UTC to 2027-02-07 16:20 UTC
    Logged 2026-11-09 16:22 UTC in Google PlumbersArms2027h1, entry 701,551,581
    SHA-256 71d5de409e82fc2d2284616c5efef0e2560db970f88133fce6f6cc49f6f03171
    Public key SHA-256 da930aca28070ca75959a038a0b109814fc2f07d8392bc0b7ee959292d9899c0
    Addresses
    104.21.49.8 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.139.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.8, 172.67.139.254): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    marshh.vip
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  36. payment.clloudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clloudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    payment.clloudflare.net
    First seen
    2026-11-09 16:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clloudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 15:26 UTC to 2027-02-07 15:26 UTC
    Logged 2026-11-09 16:24 UTC in Google PlumbersArms2027h1, entry 701,593,688
    SHA-256 1acb7be039f8742eed5ca1a155df57d003a843324478f4a4dc9fb680be7ac631
    Public key SHA-256 09fff3483360c7c82ffd8a4cca51dcb2fadab81d34ca15aabf805e2fd545cae9
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clloudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 14:46 UTC

    Suggest a correction

  37. qapib.icu US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    qapib.icu
    First seen
    2026-11-09 16:26 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 13:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:20 UTC to 2027-02-07 16:18 UTC
    Logged 2026-11-09 16:20 UTC in Geomys Tuscolo2027h1, entry 547,049,742
    SHA-256 8c9fd9141a2af355f359079a30f8f311fbef00ba8a5c158b347f3c8e49d3fd40
    Public key SHA-256 c3bbd2d0065f7cddeb9ef2223b8ab4f46bd2b7c2054c16788e60b4eb3542f532
    Addresses
    104.21.30.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.123 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.30.175, 172.67.173.123): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qapib.icu
    Registered
    2026-04-26 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  38. test1.crushxp.com GB · AS201738 · UFO-TECHNOLOGIES-LIMITED UF…
    ListedUnder crushxp.com, listed by CERT PolskaMX absentSPF -allDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    test1.crushxp.com
    First seen
    2026-11-09 16:26 UTC
    Listing
    CERT Polska listed it 2026-06-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    PhishDestroy: first observed in the feed 2026-10-26 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska, listing crushxp.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 15:24 UTC to 2027-02-07 15:24 UTC
    Logged 2026-11-09 16:23 UTC in Google ParcelYard2027h1, entry 701,291,651
    SHA-256 6e8493bfb16019969c1170744a900c695fcd995e3cba315ba163a59b1d82cad1
    Public key SHA-256 38f7419a245a3460152fbdca93d43a09dc01fc6528edcd75d5c6123225b1955c
    Addresses
    109.238.86.5 · United Kingdom · AS201738 UFO-TECHNOLOGIES-LIMITED UFO TECHNOLOGIES LIMITED
    Domain
    crushxp.com
    Registered
    2023-02-15 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 13:36 UTC

    Suggest a correction

  39. xn--monshots-3d1d.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    xn--monshots-3d1d.net
    First seen
    2026-11-09 16:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:12 UTC to 2027-02-07 16:21 UTC
    Logged 2026-11-09 16:22 UTC in Let's Encrypt Willow2027h1, entry 1,045,901,784
    SHA-256 50dd622d10689c0797f876b844c296b9bf254195dc86cd0b41be60173fecc652
    Public key SHA-256 1784fead30027b6adedeca9453cf77cb0cf0243e8582cb4aa4d63a151869a65c
    PhishDestroy
    Addresses
    104.21.53.146 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.146, 172.67.213.139): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xn--monshots-3d1d.net
    Registered
    2026-02-10 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  40. dv01.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    dv01.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    dv01.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  41. du02.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    du02.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    du02.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  42. dk01.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    dk01.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    dk01.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  43. dm60.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    dm60.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    dm60.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  44. dn80.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    dn80.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    dn80.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  45. db09.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    db09.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    db09.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  46. cu80.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    cu80.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    cu80.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  47. da20.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    da20.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    da20.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  48. cn09.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    cn09.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    cn09.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  49. cb06.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    cb06.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    cb06.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  50. ca07.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    ca07.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    ca07.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  51. bn16.cc HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as tencent-dns.cc, on Spamhaus DROP at 134.122.163.206MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    bn16.cc
    First seen
    2026-11-09 16:23 UTC
    Same certificate
    Same certificate as tencent-dns.cc: on Spamhaus DROP at 134.122.163.206; a QQ lookalike
    Listed: resolved to 134.122.163.206 on Spamhaus DROP
    18 of 21 domains on this certificate have their own listing evidence
    Certificate 8c2a32a91f4c9372… · 21 domains on it · first seen 2026-11-09 16:23 UTC
    Addresses
    134.122.163.206 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    bn16.cc
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  52. whatsapp-info.website GE · AS218688 · WL661-AS WULDI LLCWhatsApp
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    whatsapp-info.website
    First seen
    2026-11-09 16:22 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 185.102.115.81.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.102.115.81
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:09 UTC to 2027-02-07 16:18 UTC
    Logged 2026-11-09 16:19 UTC in DigiCert Sphinx2027h1, entry 416,803,404
    SHA-256 df7879aeb0d3041d35cd597c94a5921215810575e7eb95417749d11b033ee10a
    Public key SHA-256 8c3f836bee3bda9bc3b38fc9d70d9075c4d8b874fdbace61516049685c0a20f7
    Brand
    WhatsApp
    Addresses
    185.102.115.81 · Georgia · AS218688 WL661-AS WULDI LLC
    Domain
    whatsapp-info.website
    Registered
    2026-02-10 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:23 UTC

    Suggest a correction

  53. cachiqo.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    cachiqo.vip
    First seen
    2026-11-09 16:21 UTC
    Listing
    CERT Polska listed it 2026-07-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:15 UTC to 2027-02-07 16:13 UTC
    Logged 2026-11-09 16:15 UTC in Google PlumbersArms2027h1, entry 701,439,987
    SHA-256 1647bcc5f7da2a30fb7957a1ee801df475635aa3b8d3cc7c0ae209092ba7cbac
    Public key SHA-256 35482f8b510e839e94e16187bf74ec208a74e500238bf4318c2f61d3ef6c5073
    Addresses
    104.21.16.236 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.217 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.236, 172.67.216.217): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cachiqo.vip
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  54. ecuof.top SG · AS139341 · ACE14 addresses
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    ecuof.top
    First seen
    2026-11-09 16:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 13:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 15:20 UTC to 2027-02-07 15:20 UTC
    Logged 2026-11-09 16:19 UTC in Google PlumbersArms2027h1, entry 701,499,874
    SHA-256 0582b385244f89ebcc7e0f971370a6cc9a9419f92bda745dcc6b75c3aacfa2bc
    Public key SHA-256 7cb2e6158a40da885f7cc5910993f9b99decf5fec80027b3adb60d94c100c60d
    Addresses
    43.152.22.80 · Singapore · AS139341 ACE-AS-AP - ACE
    43.152.22.81 · Singapore · AS139341 ACE-AS-AP - ACE
    43.152.43.117 · Singapore · AS139341 ACE-AS-AP - ACE
    43.152.43.121 · Singapore · AS139341 ACE-AS-AP - ACE
    43.152.182.137 · Singapore · AS139341 ACE-AS-AP - ACE
    43.168.34.115 · Singapore · AS139341 ACE-AS-AP - ACE
    43.168.117.41 · Singapore · AS139341 ACE-AS-AP - ACE
    43.168.117.156 · Singapore · AS139341 ACE-AS-AP - ACE
    43.174.171.101 · Singapore · AS139341 ACE-AS-AP - ACE
    43.175.44.11 · Singapore · AS139341 ACE-AS-AP - ACE
    43.175.171.84 · Singapore · AS139341 ACE-AS-AP - ACE
    101.33.21.122 · Singapore · AS139341 ACE-AS-AP - ACE
    101.33.21.144 · Singapore · AS139341 ACE-AS-AP - ACE
    101.33.21.239 · Singapore · AS139341 ACE-AS-AP - ACE
    Domain
    ecuof.top
    Registered
    2022-11-29 · 成都西维数码科技有限公司
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  55. hyperfoundation.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    hyperfoundation.pages.dev
    First seen
    2026-11-09 16:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:18 UTC to 2027-02-07 16:16 UTC
    Logged 2026-11-09 16:18 UTC in DigiCert Sphinx2027h1, entry 416,793,473
    SHA-256 a0c2e2a1b47af340d3450c4225b0fa478a671f6221ecf0d3ed70c8cf62078599
    Public key SHA-256 a75b166292b8fde3d2fc0416ffc8311addfc4b619ace5cb4004b74e94e634bfc
    Addresses
    172.66.44.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.162 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.94, 172.66.47.162): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  56. hzlnsdanismanlk.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    hzlnsdanismanlk.info
    First seen
    2026-11-09 16:21 UTC
    Listing
    USOM listed it 2026-09-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 15:18 UTC to 2027-02-07 15:18 UTC
    Logged 2026-11-09 16:16 UTC in IPng Networks Gouda2027h1, entry 365,295,191
    SHA-256 4bb9f1ecfba6eadc57803eb41bf3d1757219f5b3d40ee33a477d7303568124a8
    Public key SHA-256 f96bad6a32f08210f3fcc010b4b1b4311db6d30d8f3cec76acef46cb97700541
    Addresses
    104.21.52.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.202.218 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.52.186, 172.67.202.218): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hzlnsdanismanlk.info
    Registered
    2026-09-07 · Turkticaret.net Yazılım Hizmetleri Sanayi ve Ticaret A.Ş.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  57. orxglobal.com US · AS214036 · ULTAHOST-AS Ultahost, Inc.
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    orxglobal.com
    First seen
    2026-11-09 16:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:06 UTC to 2027-02-07 16:14 UTC
    Logged 2026-11-09 16:16 UTC in DigiCert Wyvern2027h1, entry 470,604,414
    SHA-256 ce42f42bb7b0156a3bb41b8c4ddf8f740a35f80b23ad23e4181110c30afccfee
    Public key SHA-256 3135e5217f73e727ce3f15f768a2277886b14c985c577e3073855c5fd50f9f87
    PhishDestroy
    Addresses
    159.100.9.49 · United States · AS214036 ULTAHOST-AS Ultahost, Inc.
    Domain
    orxglobal.com
    Registered
    2025-12-24 · Dynadot Inc
    MX
    Receives mail at mx.zoho.com.au, mx2.zoho.com.au, mx3.zoho.com.au
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:01 UTC

    Suggest a correction

  58. piuwrh.info US · AS13335 · Cloudflare, Inc.2 addressesRakuten Card
    ListedCloudflareListed by JPCERT/CC as imitating 楽天カードMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    piuwrh.info
    First seen
    2026-11-09 16:21 UTC
    Listing
    JPCERT/CC confirmed it 2026-05-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 14:13 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 15:20 UTC to 2027-02-07 15:20 UTC
    Logged 2026-11-09 16:19 UTC in Let's Encrypt Sycamore2027h1, entry 1,090,299,108
    SHA-256 84799b65120d0479e2c07250c41c35be8a93bfa5a6baa29b0e358d86df937dd9
    Public key SHA-256 db60c9ea86c524143a4bf8e9332e8a3b5561b60b08b2b8762bc96a1958c5af56
    Brand
    Rakuten Card
    Addresses
    104.21.42.124 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.220 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.42.124, 172.67.205.220): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    piuwrh.info
    Registered
    2025-11-10 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  59. plirepsijr74.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    plirepsijr74.com
    First seen
    2026-11-09 16:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:06 UTC to 2027-02-07 16:15 UTC
    Logged 2026-11-09 16:16 UTC in DigiCert Wyvern2027h1, entry 470,609,144
    SHA-256 5d5c3d4cca769531f79ec7ad730a4e67323d442778ef547aa3606b5a26db2fe8
    Public key SHA-256 7d35fa92aedafc8d7b0dd893b046040ab9a9cd1a8d71caf33df5dcb9fae73a32
    PhishDestroy
    Addresses
    104.21.65.87 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.179 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.87, 172.67.189.179): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    plirepsijr74.com
    Registered
    2026-04-26 · CNOBIN INFORMATION TECHNOLOGY LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  60. service.cloudflear.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloudflear.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    service.cloudflear.net
    First seen
    2026-11-09 16:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloudflear.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 15:17 UTC to 2027-02-07 15:17 UTC
    Logged 2026-11-09 16:15 UTC in Google PlumbersArms2027h1, entry 701,445,778
    SHA-256 4048ee5aa39a5a1e44270c212a6a7ab3b83d62ca714a67aefd3bf4c47f98c034
    Public key SHA-256 9c1fe1773b7a1c564c977ba4ae18afebed9b3d755935d7070ccabd7c78896c38
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloudflear.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 18:26 UTC

    Suggest a correction

  61. spvtoto.com US · AS22612 · Namecheap, Inc.
    ReportedNamecheapReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 12 mo ago
    DetailsHide
    Hostname
    spvtoto.com
    First seen
    2026-11-09 16:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 15:17 UTC to 2027-02-07 15:17 UTC
    Logged 2026-11-09 16:16 UTC in Google PlumbersArms2027h1, entry 701,457,005
    SHA-256 991bf7f70973f20ee61fc73852476105192acbce70748dc1b5cb3f07af1fb1e2
    Public key SHA-256 c40106bb6202102b6aaa1e75d85ee1b3ff0cc570ba0a2d73a25b75277e1dfd66
    PhishDestroy
    Addresses
    66.29.132.91 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (66.29.132.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    spvtoto.com
    Registered
    2025-11-07 · NameCheap, Inc.
    MX
    Receives mail at mx1-hosting.jellyfish.systems, mx2-hosting.jellyfish.systems, mx3-hosting.jellyfish.systems
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  62. tickets.daddy-casino1.ru AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder daddy-casino1.ru, reported by PhishDestroyMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    tickets.daddy-casino1.ru
    First seen
    2026-11-09 16:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing daddy-casino1.ru and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 15:21 UTC to 2027-02-07 15:21 UTC
    Logged 2026-11-09 16:20 UTC in DigiCert Sphinx2027h1, entry 416,809,029
    SHA-256 5b29534d708960587cdc4127dd6c27b86b897d41b94950977e4a23843aa2fc67
    Public key SHA-256 e2341ff66d85ba52e0b69a6700cc934ee98bfe778ea51c20138a2684aa340cf7
    PhishDestroy
    Addresses
    186.2.174.131 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    daddy-casino1.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  63. walletconnect.help-risk-2.workers.dev US · AS13335 · Cloudflare, Inc.4 addressesWalletConnect
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    walletconnect.help-risk-2.workers.dev
    First seen
    2026-11-09 16:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:20 UTC to 2027-02-07 16:18 UTC
    Logged 2026-11-09 16:20 UTC in DigiCert Wyvern2027h1, entry 470,647,110
    SHA-256 3b66419ace79ea135c82ce3f24114b748f022903ecf53a987d9234e82ac4e557
    Public key SHA-256 5ff8eb08a9e71ddb3102d4412dee01c31b6a4e8695e50c2dd0c5b58d3cee9061
    Brand
    WalletConnect
    Addresses
    104.21.80.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:50ea
    2606:4700:3033::ac43:bba4
    Cloudflare
    Cloudflare (104.21.80.234, 172.67.187.164): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  64. wulqevor.surf US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    wulqevor.surf
    First seen
    2026-11-09 16:21 UTC
    Listing
    USOM listed it 2026-05-25 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:19 UTC to 2027-02-07 16:18 UTC
    Logged 2026-11-09 16:19 UTC in Geomys Tuscolo2027h1, entry 547,040,411
    SHA-256 9add215016c54d1c11ad435d281a8709dfef600b1ffead793231199db5d6732c
    Public key SHA-256 6541987d23779956477239d898e25be1274c76c639815f4fc9742275bb6e99ac
    Addresses
    104.21.40.133 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.151.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.40.133, 172.67.151.244): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    wulqevor.surf
    Registered
    2026-04-22 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  65. access-ledger-live-en-us.pages.dev US · AS13335 · Cloudflare, Inc.4 addressesLedger
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    access-ledger-live-en-us.pages.dev
    First seen
    2026-11-09 16:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:11 UTC to 2027-02-07 16:10 UTC
    Logged 2026-11-09 16:11 UTC in Google ParcelYard2027h1, entry 701,099,593
    SHA-256 a6ec4a5f0cb7c837b604c606b42c87454955efff29b3a75ced516e3c03459a5f
    Public key SHA-256 581ef6a036ab137334fa9cde871b6a31ad27db395d027f82b0fff7cb3cb5cd74
    Brand
    Ledger
    Addresses
    172.66.44.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.9 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cf7
    2606:4700:310c::ac42:2f09
    Cloudflare
    Cloudflare (172.66.44.247, 172.66.47.9): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  66. globlee.ru US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    globlee.ru
    First seen
    2026-11-09 16:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:11 UTC to 2027-02-07 16:09 UTC
    Logged 2026-11-09 16:11 UTC in Google PlumbersArms2027h1, entry 701,361,780
    SHA-256 0ec4790e693a663797eb37538a5568fc4a729f3aa3413e131f130fc5be4ed28f
    Public key SHA-256 a71cf50bd329f09cc460395cba1a7656106fbc0ca5b810623f00697773d13bc7
    PhishDestroy
    Addresses
    104.21.49.150 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.150, 172.67.146.178): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    globlee.ru
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:18 UTC

    Suggest a correction

  67. ibafl.buzz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    ibafl.buzz
    First seen
    2026-11-09 16:16 UTC
    Listing
    USOM listed it 2026-08-30 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:03 UTC to 2027-02-07 16:12 UTC
    Logged 2026-11-09 16:13 UTC in DigiCert Sphinx2027h1, entry 416,748,308
    SHA-256 cbbaa33c6b1e9ddb1ac7604bf46080f59a613e123f818e33cac410414df38b18
    Public key SHA-256 5d983f3919fc2031bf7566e36fdd925dc421d4673cdb875fd21da7ffc5658c75
    Addresses
    104.21.50.160 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.36 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.50.160, 172.67.164.36): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ibafl.buzz
    Registered
    2026-01-02 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  68. perlkonat-netherlands.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    perlkonat-netherlands.com
    First seen
    2026-11-09 16:16 UTC
    Listing
    CERT Polska listed it 2026-09-11 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:13 UTC to 2027-02-07 16:11 UTC
    Logged 2026-11-09 16:13 UTC in IPng Networks Halloumi2027h1, entry 428,636,340
    SHA-256 72e6fd4b089a9efda01f82b9f2a1d129eac0c82aa7c387985536cae00051b528
    Public key SHA-256 d70ed0b5d8f0d0eb13b6fe3ec55c531239110c5e60de51f025b65b6f75ff7471
    Addresses
    104.21.49.54 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.11 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.54, 172.67.159.11): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    perlkonat-netherlands.com
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  69. portainer.lcoudflare.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder lcoudflare.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    portainer.lcoudflare.com
    First seen
    2026-11-09 16:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing lcoudflare.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 15:16 UTC to 2027-02-07 15:16 UTC
    Logged 2026-11-09 16:14 UTC in DigiCert Sphinx2027h1, entry 416,758,415
    SHA-256 0636955347d5f31ac2ecbd8a2a0885fe7da96621952d016968d5509de21fe86f
    Public key SHA-256 b24248f4da61cd198a04a030afd1829dacdc48913db687df933f1adb6abde39b
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lcoudflare.com
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 22:01 UTC

    Suggest a correction

  70. slon1at.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    slon1at.com
    First seen
    2026-11-09 16:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:04 UTC to 2027-02-07 16:12 UTC
    Logged 2026-11-09 16:14 UTC in DigiCert Wyvern2027h1, entry 470,587,781
    SHA-256 b2d197bb345610a21414201178b490082f83a6d675fc8e69770c069944020da5
    Public key SHA-256 f210b955c4b48a95e9b6d0d8cca713c752ba6980e930247bc568191a8b9b1d8e
    PhishDestroy
    Addresses
    104.21.44.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.179 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.44.68, 172.67.196.179): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    slon1at.com
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  71. stg.clloudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clloudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    stg.clloudflare.net
    First seen
    2026-11-09 16:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing clloudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 15:15 UTC to 2027-02-07 15:15 UTC
    Logged 2026-11-09 16:14 UTC in Let's Encrypt Willow2027h1, entry 1,045,669,082
    SHA-256 5a5d03ef18e025c66d79bfa0ad2fd2e2ddeae8169caa77cae5fd3be88a25576b
    Public key SHA-256 bdd0a79842c77e59284a5fa4958b445f96c0de4a4d440fb15ae861da057a5929
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clloudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 14:46 UTC

    Suggest a correction

  72. teleitepro.help US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    teleitepro.help
    First seen
    2026-11-09 16:16 UTC
    Listing
    CERT Polska listed it 2026-09-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:10 UTC to 2027-02-07 16:08 UTC
    Logged 2026-11-09 16:10 UTC in IPng Networks Halloumi2027h1, entry 428,608,318
    SHA-256 cd74abc9b4119ceae05ac583bda47e50810a61ff327059fa988d1d165d50080e
    Public key SHA-256 f180dae75980c0ec5d5e8d2b18d191bc527d204361a66f0a5002286f040dca2c
    Addresses
    104.21.33.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.69 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.63, 172.67.159.69): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    teleitepro.help
    Registered
    2026-09-11 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  73. tulavishcreations.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    tulavishcreations.com
    First seen
    2026-11-09 16:16 UTC
    Listing
    CERT Polska listed it 2026-07-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:13 UTC to 2027-02-07 16:11 UTC
    Logged 2026-11-09 16:13 UTC in Google PlumbersArms2027h1, entry 701,402,567
    SHA-256 6ad138f7a629c3b9f263d607f1aea91af10e5cc8c357cde49811b6e257fac5ad
    Public key SHA-256 f6157c3633dfca24454ecfb50dc79b3a3d7c4fe1e1d0d4093a1b422287244d20
    Addresses
    104.21.25.24 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.222.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.25.24, 172.67.222.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tulavishcreations.com
    Registered
    2026-07-13 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:18 UTC

    Suggest a correction

  74. v3-hyperliquid.com US · AS13335 · Cloudflare, Inc.4 addressesHyperliquid
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    v3-hyperliquid.com
    First seen
    2026-11-09 16:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-11 15:00 UTC to 2026-12-10 15:59 UTC
    Logged 2026-11-09 16:14 UTC in DigiCert Wyvern2026h2, entry 2,214,612,271
    SHA-256 12137d578762c80b9acb31cd8ba4377a106af86233a7e90c74b36c71cad8c232
    Public key SHA-256 8d7dd0ab844b8327f9c0635d4c1276b183f1466863b85660e9b3877b0fae6d4f
    Brand
    Hyperliquid
    Addresses
    104.21.60.177 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.198.239 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:3cb1
    2606:4700:3036::ac43:c6ef
    Cloudflare
    Cloudflare (104.21.60.177, 172.67.198.239): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v3-hyperliquid.com
    Registered
    2026-07-14 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  75. v3-hyperliquid.com.mx US · AS13335 · Cloudflare, Inc.4 addressesHyperliquid
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    v3-hyperliquid.com.mx
    First seen
    2026-11-09 16:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:14 UTC to 2027-02-07 16:13 UTC
    Logged 2026-11-09 16:14 UTC in Google ParcelYard2027h1, entry 701,150,822
    SHA-256 84ea1a7a71997a53f201eed7fc8b940a00b12cac1efb5275809697de018db585
    Public key SHA-256 cc9dc28bd15e22e713416df372f119ec964f184e8f9364b4c0b4a8f56d7441f9
    Brand
    Hyperliquid
    Addresses
    104.21.1.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.189 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:142
    2606:4700:3034::ac43:80bd
    Cloudflare
    Cloudflare (104.21.1.66, 172.67.128.189): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v3-hyperliquid.com.mx
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:18 UTC

    Suggest a correction

  76. www.v3-hyperliquid.com.mx US · AS13335 · Cloudflare, Inc.4 addressesHyperliquid
    ListedCloudflareUnder v3-hyperliquid.com.mx, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.v3-hyperliquid.com.mx
    First seen
    2026-11-09 16:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask, listing v3-hyperliquid.com.mx and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:14 UTC to 2027-02-07 16:13 UTC
    Logged 2026-11-09 16:14 UTC in Google ParcelYard2027h1, entry 701,150,822
    SHA-256 84ea1a7a71997a53f201eed7fc8b940a00b12cac1efb5275809697de018db585
    Public key SHA-256 cc9dc28bd15e22e713416df372f119ec964f184e8f9364b4c0b4a8f56d7441f9
    Brand
    Hyperliquid
    Addresses
    104.21.1.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.189 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:142
    2606:4700:3034::ac43:80bd
    Cloudflare
    Cloudflare (104.21.1.66, 172.67.128.189): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v3-hyperliquid.com.mx
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:18 UTC

    Suggest a correction

  77. www.mooneyes.kr KR · AS4766 · Korea TelecomMooney
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    www.mooneyes.kr
    First seen
    2026-11-09 16:15 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 203.245.12.123.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 203.245.12.123
    Certificate
    Issued by YR2
    Valid 2026-11-09 15:07 UTC to 2027-02-07 15:07 UTC
    Logged 2026-11-09 16:05 UTC in Google ParcelYard2027h1, entry 700,992,558
    SHA-256 42f4b369db771f489e675684aa4fe07d9640b9d40e5f22d3f1db26f8675303bb
    Public key SHA-256 14b5c0aa9cf95fe76f0ff1ee778d5ae6b8d3c6200e8cee0ed9d8b1cb74002463
    Brand
    Mooney
    Addresses
    203.245.12.123 · South Korea · AS4766 KIXS-AS-KR-KR - Korea Telecom
    Domain
    mooneyes.kr
    Registered
    2017-03-01
    MX
    Receives mail at 14.128.132.28, mooneyes.kr
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  78. www.kistango.seo-google.hu GB · AS52148 · ENIXLTD Enix LtdGoogle
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    www.kistango.seo-google.hu
    First seen
    2026-11-09 16:15 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.204.209.12.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.204.209.12
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 15:11 UTC to 2027-02-07 15:11 UTC
    Logged 2026-11-09 16:09 UTC in IPng Networks Gouda2027h1, entry 365,253,485
    SHA-256 8d4e143611f7eba7ea22d30ad16d585027743f382b12adcaed4a7af470f1db7d
    Public key SHA-256 7865af5c3a52fe2bd1e6904481390f19944494b8e0863133eb396abe6a7be941
    Brand
    Google
    Addresses
    91.204.209.12 · United Kingdom · AS52148 ENIXLTD Enix Ltd
    Domain
    seo-google.hu
    MX
    Receives mail at entrap-01.hostns.io, entrap-02.hostns.io, entrap-03.hostns.io
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  79. mooneyes.kr KR · AS4766 · Korea TelecomMooney
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    mooneyes.kr
    First seen
    2026-11-09 16:15 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 203.245.12.123.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 203.245.12.123
    Certificate
    Issued by YR2
    Valid 2026-11-09 15:07 UTC to 2027-02-07 15:07 UTC
    Logged 2026-11-09 16:05 UTC in Google ParcelYard2027h1, entry 700,992,558
    SHA-256 42f4b369db771f489e675684aa4fe07d9640b9d40e5f22d3f1db26f8675303bb
    Public key SHA-256 14b5c0aa9cf95fe76f0ff1ee778d5ae6b8d3c6200e8cee0ed9d8b1cb74002463
    Brand
    Mooney
    Addresses
    203.245.12.123 · South Korea · AS4766 KIXS-AS-KR-KR - Korea Telecom
    Domain
    mooneyes.kr
    Registered
    2017-03-01
    MX
    Receives mail at 14.128.132.28, mooneyes.kr
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  80. m.mooneyes.kr KR · AS4766 · Korea TelecomMooney
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    m.mooneyes.kr
    First seen
    2026-11-09 16:15 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 203.245.12.123.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 203.245.12.123
    Certificate
    Issued by YR2
    Valid 2026-11-09 15:07 UTC to 2027-02-07 15:07 UTC
    Logged 2026-11-09 16:05 UTC in Google ParcelYard2027h1, entry 700,992,558
    SHA-256 42f4b369db771f489e675684aa4fe07d9640b9d40e5f22d3f1db26f8675303bb
    Public key SHA-256 14b5c0aa9cf95fe76f0ff1ee778d5ae6b8d3c6200e8cee0ed9d8b1cb74002463
    Brand
    Mooney
    Addresses
    203.245.12.123 · South Korea · AS4766 KIXS-AS-KR-KR - Korea Telecom
    Domain
    mooneyes.kr
    Registered
    2017-03-01
    MX
    Receives mail at 14.128.132.28, mooneyes.kr
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  81. kistango.seo-google.hu GB · AS52148 · ENIXLTD Enix LtdGoogle
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    kistango.seo-google.hu
    First seen
    2026-11-09 16:15 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.204.209.12.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.204.209.12
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 15:11 UTC to 2027-02-07 15:11 UTC
    Logged 2026-11-09 16:09 UTC in IPng Networks Gouda2027h1, entry 365,253,485
    SHA-256 8d4e143611f7eba7ea22d30ad16d585027743f382b12adcaed4a7af470f1db7d
    Public key SHA-256 7865af5c3a52fe2bd1e6904481390f19944494b8e0863133eb396abe6a7be941
    Brand
    Google
    Addresses
    91.204.209.12 · United Kingdom · AS52148 ENIXLTD Enix Ltd
    Domain
    seo-google.hu
    MX
    Receives mail at entrap-01.hostns.io, entrap-02.hostns.io, entrap-03.hostns.io
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  82. a101kapindakasim.com HK · AS154177 · LIGHT NODE LIMITED
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    a101kapindakasim.com
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 14:04 UTC to 2027-02-07 14:04 UTC
    Logged 2026-11-09 15:02 UTC in Let's Encrypt Willow2027h1, entry 1,043,815,794
    SHA-256 4ea20718e39aa5c52fdf10c07edbef5c7c30354bae1000086088cd67968ebde1
    Public key SHA-256 04641b4716ed8a582bbc1b3d55cd734b2bf226702df3325dbd5ac09fd1eae12a
    Addresses
    130.94.62.21 · Hong Kong · AS154177 LIGHT4-AS-AP - LIGHT NODE LIMITED
    Domain
    a101kapindakasim.com
    Registered
    2026-11-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  83. h-saglkrhb.cfd US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    h-saglkrhb.cfd
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 11:33 UTC to 2027-02-07 11:33 UTC
    Logged 2026-11-09 12:31 UTC in Google PlumbersArms2027h1, entry 697,975,517
    SHA-256 27fd0ca2da0a99d3caf7520ece5fc169369ede9b1ff0f77c9d7fe589665009df
    Public key SHA-256 dc48c85c42bb29fa041ee93a162d387c4839e9e716ecb6738a86ce9e56ae2158
    Addresses
    104.21.44.238 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:2cee
    2606:4700:3036::ac43:cd42
    Cloudflare
    Cloudflare (104.21.44.238, 172.67.205.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    h-saglkrhb.cfd
    Registered
    2026-11-09 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  84. mhrs-yenidenoo.sbs US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 9 d ago
    DetailsHide
    Hostname
    mhrs-yenidenoo.sbs
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 12:41 UTC to 2027-02-07 12:41 UTC
    Logged 2026-11-09 13:40 UTC in Let's Encrypt Willow2027h1, entry 1,041,633,972
    SHA-256 ac8bb213ddb75d7a22742fbc8edc7a45e303e01603b0e5460a8e0c082b398e53
    Public key SHA-256 f4c6d237c694c16b85175e958f6f2421c6c6ec333875a1d5a8390b229fa6abf1
    Addresses
    104.21.36.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.25 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:2475
    2606:4700:3037::ac43:c119
    Cloudflare
    Cloudflare (104.21.36.117, 172.67.193.25): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mhrs-yenidenoo.sbs
    Registered
    2026-10-31 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  85. prormsynbasvr1.xyz US · AS197769 · VPSDEDICATED-AS VPS Dedicat…
    ListedListed by USOMMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    prormsynbasvr1.xyz
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 07:04 UTC to 2027-02-07 07:04 UTC
    Logged 2026-11-09 08:02 UTC in Let's Encrypt Willow2027h1, entry 1,032,801,875
    SHA-256 2da704c206b96fd3e368f25693a469b16438435b01a5b41297683f86e6d6d0d5
    Public key SHA-256 5fcdd592dd4d6adf00de40a1fc9417e17873230fe2469790508bd8536c95475b
    Addresses
    102.220.161.58 · United States · AS197769 VPSDEDICATED-AS VPS Dedicated LLC
    Domain
    prormsynbasvr1.xyz
    Registered
    2026-11-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  86. rndsglk.cfd US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered today
    DetailsHide
    Hostname
    rndsglk.cfd
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 11:26 UTC to 2027-02-07 11:26 UTC
    Logged 2026-11-09 12:24 UTC in DigiCert Sphinx2027h1, entry 414,511,565
    SHA-256 4216fc5001c110cff48776eb9446f2a25331c3af7835702023e560d90823abef
    Public key SHA-256 f071891a9f5a30a4db4a4923d1ab471294c052b615f5d9f99a9537aea205b103
    Addresses
    104.21.31.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:b03a
    2606:4700:3033::6815:1f6c
    Cloudflare
    Cloudflare (104.21.31.108, 172.67.176.58): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rndsglk.cfd
    Registered
    2026-11-09 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  87. sahibinden-get.islemsepetler-15.sbs US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    sahibinden-get.islemsepetler-15.sbs
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 00:10 UTC to 2027-02-07 00:10 UTC
    Logged 2026-11-09 01:09 UTC in Let's Encrypt Sycamore2027h1, entry 1,066,053,806
    SHA-256 460d62a975568dcd113e4155e579ee683b170d46a4984f8e1dec9bbd3ccf426f
    Public key SHA-256 206072369bfa7894dea4152b48207971bc5071552e17cab4ef94edb7821fa688
    Addresses
    104.21.47.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:2fcf
    2606:4700:3034::ac43:aca8
    Cloudflare
    Cloudflare (104.21.47.207, 172.67.172.168): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    islemsepetler-15.sbs
    Registered
    2026-11-08 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:18 UTC

    Suggest a correction

  88. tarimkopmarketonlayn.blogdns.com US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by USOM
    DetailsHide
    Hostname
    tarimkopmarketonlayn.blogdns.com
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 09:51 UTC to 2027-02-07 09:51 UTC
    Logged 2026-11-09 10:49 UTC in DigiCert Wyvern2027h1, entry 467,263,286
    SHA-256 5272efc06970463a5c6e9924f6b9518c45778a4de68bf71948421e49d516c74a
    Public key SHA-256 97e80fe4dc5d92cf47abdd154c1d3cdfa36509f8869cf1bde9069aca9dc3dd03
    Addresses
    13.63.158.187 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.63.158.187): a cloud provider. It rents servers and addresses to its customers.

    Suggest a correction

  89. tarmkoperatif.blogdns.com US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by USOM
    DetailsHide
    Hostname
    tarmkoperatif.blogdns.com
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 13:23 UTC to 2027-02-06 13:23 UTC
    Logged 2026-11-08 14:22 UTC in Let's Encrypt Willow2027h1, entry 1,006,472,493
    SHA-256 89b12907038648432e1124566d14a2333bd556d767ba4e2c041642ab4cd6ec61
    Public key SHA-256 32d858eae6835dda750df96a1c4c936c39ce36ccb398bd31f0c82fbb3b0e1121
    Addresses
    13.63.158.187 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.63.158.187): a cloud provider. It rents servers and addresses to its customers.

    Suggest a correction

  90. tarmyonmsdddd.blogdns.com US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by USOM
    DetailsHide
    Hostname
    tarmyonmsdddd.blogdns.com
    First seen
    2026-11-09 16:13 UTC
    Listing
    USOM listed it 2026-11-09 · still listed at the last successful feed check 2026-11-09 16:13 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 09:52 UTC to 2027-02-07 09:52 UTC
    Logged 2026-11-09 10:51 UTC in DigiCert Wyvern2027h1, entry 467,276,012
    SHA-256 85cf94a1b63efe6832702aedeee81ccf53a2c48c397b09ab5328e0ef081933e2
    Public key SHA-256 b845385830cb81fe685eb1c04cab0b9c2590697a4383362dec55203c8eaac59d
    Addresses
    13.63.158.187 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.63.158.187): a cloud provider. It rents servers and addresses to its customers.

    Suggest a correction

  91. 305918-crypto.com US · AS13335 · Cloudflare, Inc.4 addressesCrypto.com
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    305918-crypto.com
    First seen
    2026-11-09 16:11 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 15:09 UTC to 2027-02-07 15:09 UTC
    Logged 2026-11-09 16:08 UTC in Geomys Tuscolo2027h1, entry 546,885,290
    SHA-256 13efd1ed3bd89056272dbc26bb4ab8d3e9b083dbc35f684b694376c5f0591f8a
    Public key SHA-256 dc2ca0044c4af8bd5c541326af7c644630641fafdbff8b2482ef7a94b6fb6bc0
    Brand
    Crypto.com
    Addresses
    104.21.83.73 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.136 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:d988
    2606:4700:3037::6815:5349
    Cloudflare
    Cloudflare (104.21.83.73, 172.67.217.136): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    305918-crypto.com
    Registered
    2026-09-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  92. aattlloving.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by NPA 165 (information services)MX absentSPF missingDMARC quarantineRegistered 2 y ago
    DetailsHide
    Hostname
    aattlloving.com
    First seen
    2026-11-09 16:11 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 13:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-09 16:08 UTC to 2027-05-26 16:08 UTC
    Logged 2026-11-09 16:08 UTC in GoDaddy Aquamarine2027h1, entry 202,445,132
    SHA-256 19bfcc03d7056b3df72dbe8cfd56934996f3ffe4b7857aac778e388200a15a09
    Public key SHA-256 7efac505513205b81d981293800fcd299ca4dc81f714556d688fb9b8f52ac4f9
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    aattlloving.com
    Registered
    2024-11-02 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  93. andafbit.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    andafbit.cc
    First seen
    2026-11-09 16:11 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 15:58 UTC to 2027-02-07 16:07 UTC
    Logged 2026-11-09 16:08 UTC in DigiCert Wyvern2027h1, entry 470,519,681
    SHA-256 d5fe967ed8beb0e6bee00b4149da434401432008d33d68d65e0732059b5e61b5
    Public key SHA-256 e605526a7e5f3a363e9c04b46d909e6a20ef5861d7f64442758adc5b4205b49c
    PhishDestroy
    Addresses
    104.21.21.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.87 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.21.158, 172.67.199.87): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    andafbit.cc
    Registered
    2026-04-26 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  94. britkonedgeval.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    britkonedgeval.pro
    First seen
    2026-11-09 16:11 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 15:08 UTC to 2027-02-07 16:07 UTC
    Logged 2026-11-09 16:08 UTC in Geomys Tuscolo2027h1, entry 546,887,487
    SHA-256 cb8fdf5cf53ceb55bf700d54f59064c93d7713bae845749db7c026746bb272c5
    Public key SHA-256 29023982742193fc708c4aa73073edeaaa2401c38555abc240d71ae5d174bdcf
    Addresses
    104.21.12.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.152.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.12.168, 172.67.152.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    britkonedgeval.pro
    Registered
    2026-04-12 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  95. catalog.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    catalog.fresh-focus.pro
    First seen
    2026-11-09 16:11 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 15:08 UTC to 2027-02-07 15:08 UTC
    Logged 2026-11-09 16:06 UTC in Google ParcelYard2027h1, entry 701,005,574
    SHA-256 1e87f845c1d4e81db8f0439b48c154a39a670f4b38e90d810b6ef18f26c1cf82
    Public key SHA-256 a9a6815d3c65d9628f755263aafe8b7e9d6081535a6ea1862f8180ae0739010a
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 14:46 UTC

    Suggest a correction

  96. exchange.cloydflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloydflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    exchange.cloydflare.net
    First seen
    2026-11-09 16:11 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloydflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 15:11 UTC to 2027-02-07 15:11 UTC
    Logged 2026-11-09 16:10 UTC in Google PlumbersArms2027h1, entry 701,346,761
    SHA-256 659e081e2744897617ef9324b2bce2fd1dcde6e27ba92d6783062adb6e0aa538
    Public key SHA-256 ea959d5dacc63d553467a97f3325a50007c18cd1691eee1e861753332f19b94f
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloydflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 10:21 UTC

    Suggest a correction

  97. flexosamine-digital.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    flexosamine-digital.pages.dev
    First seen
    2026-11-09 16:11 UTC
    Listing
    CERT Polska listed it 2026-09-13 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 15:38 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-13 14:07 UTC to 2027-01-11 14:07 UTC
    Logged 2026-11-09 16:09 UTC in HARICA Selene2027h1, entry 61,948,196
    SHA-256 24f2e0e83318fec6a553889912c81e29a569ef885eb01c4a1827f1430f229d39
    Public key SHA-256 55b4c8f01b2db5b3b7920d004c1b8350c9a6addb2d424ef6e382fd09c71ae759
    Addresses
    172.66.44.119 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.137 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.119, 172.66.47.137): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  98. gesgrdhtdh.top
    ListedListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 17 mo ago
    DetailsHide
    Hostname
    gesgrdhtdh.top
    First seen
    2026-11-09 16:11 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 13:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 16:00 UTC to 2027-02-07 16:07 UTC
    Logged 2026-11-09 16:10 UTC in DigiCert Wyvern2027h1, entry 470,547,413
    SHA-256 2e969a259c7fbcae6796a41775eec366109bf55e368b7c812852f702435e7af8
    Public key SHA-256 5d180f38f36843fef8facd951ba244d9842dae3d6f4b8ebab745e8c45f470c0e
    Domain
    gesgrdhtdh.top
    Registered
    2025-06-25 · 阿里云计算有限公司
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 16:40 UTC

    Suggest a correction

  99. library.cloudfalre.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloudfalre.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    library.cloudfalre.net
    First seen
    2026-11-09 16:11 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloudfalre.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 15:09 UTC to 2027-02-07 15:09 UTC
    Logged 2026-11-09 16:07 UTC in Let's Encrypt Sycamore2027h1, entry 1,089,975,086
    SHA-256 57ee4221ebca68441852ba4291d5a909155bc14b661704bf0d5bd451ef8a8838
    Public key SHA-256 c0960221d49d905b044c3389868c673fa42dfd0e8aaaeb850b78406281e68ac9
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloudfalre.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:28 UTC

    Suggest a correction

  100. librenms.cloudfalre.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder cloudfalre.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    librenms.cloudfalre.net
    First seen
    2026-11-09 16:11 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 12:00 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 11:59 UTC
    Listed
    MetaMask, listing cloudfalre.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 15:09 UTC to 2027-02-07 15:09 UTC
    Logged 2026-11-09 16:07 UTC in Let's Encrypt Sycamore2027h1, entry 1,089,975,086
    SHA-256 57ee4221ebca68441852ba4291d5a909155bc14b661704bf0d5bd451ef8a8838
    Public key SHA-256 c0960221d49d905b044c3389868c673fa42dfd0e8aaaeb850b78406281e68ac9
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cloudfalre.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 12:28 UTC

    Suggest a correction

Showing 1–100 of 6,325 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources