Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-09 23:31 UTC
Certificate-log entries · 24 h
396.3M
from 84 distinct feeds
Unique certificates · 24 h
37.3M
each reviewed
Names resolved · 24 h
23.0M
17.3M with an address
Findings · 24 h
6,694
212 of 1,061 brands targeted

6,694 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. arfiz499ecmv5140.ab5zdtthg0hcbbye.gfldcvbh.warhqnuy.ijdyvoge.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    arfiz499ecmv5140.ab5zdtthg0hcbbye.gfldcvbh.warhqnuy.ijdyvoge.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 23:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:24 UTC to 2027-02-07 22:24 UTC
    Logged 2026-11-09 23:22 UTC in Google ParcelYard2027h1, entry 707,247,531
    SHA-256 0b0894f06c265a4dc45b5a8ecffac0457584f80eba93b9dadcdd30cdfbe2448b
    Public key SHA-256 d4078e671dd52d06b1599446bb50699fcf851401bc02415121b5675923d89669
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  2. arfiz499ecmv5140.ijdyvoge.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    arfiz499ecmv5140.ijdyvoge.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 23:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 22:24 UTC to 2027-02-07 22:24 UTC
    Logged 2026-11-09 23:22 UTC in Google ParcelYard2027h1, entry 707,247,695
    SHA-256 423b8acb1267bf885e8658c4e52652b6d53d9329338da40db4f591128a68be59
    Public key SHA-256 f5087efb5bbba7a5d534167efbd45ed6a7bcfbf09ea829d29db238a1b0328b46
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  3. cjmrsdlb.egpsudnt.cvfzyois.akpjabzxt.eklvdour.kqiovdce.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    cjmrsdlb.egpsudnt.cvfzyois.akpjabzxt.eklvdour.kqiovdce.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 23:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:24 UTC to 2027-02-07 22:24 UTC
    Logged 2026-11-09 23:22 UTC in Google ParcelYard2027h1, entry 707,247,788
    SHA-256 e9c1c362a8a1d480b4656870fb0b19254c76f1b0b69782682b496b1da7bb7dc7
    Public key SHA-256 8a5047833f15090ed42d6994b10e233f1951a386339298646924f9339f7e442c
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  4. cohjspef.aizbjqrl.iplvwhsm.jvbmkpj6y4gen0g6.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    cohjspef.aizbjqrl.iplvwhsm.jvbmkpj6y4gen0g6.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 23:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 22:24 UTC to 2027-02-07 22:24 UTC
    Logged 2026-11-09 23:22 UTC in Google ParcelYard2027h1, entry 707,247,364
    SHA-256 0088edb9d845e8203ed295bac7f2c045f6943dcde633e3c599275668714d424c
    Public key SHA-256 53a19acf8d6f9c873986497ae20e8045cc8b916b2a891063061dec41952f9c8b
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  5. cybrotrade.org US · AS53667 · FranTech Solutions
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    cybrotrade.org
    First seen
    2026-11-09 23:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 22:25 UTC to 2027-02-07 22:25 UTC
    Logged 2026-11-09 23:24 UTC in DigiCert Sphinx2027h1, entry 420,629,401
    SHA-256 16e462c5d2040de06a0daf4d8a3ca13690b030125312da254c58a10ac23034e2
    Public key SHA-256 980b3e7776f8cd142003a52453718a7c9560cfbf63f6956a6f4963a088363bd2
    PhishDestroy
    Addresses
    198.251.84.200 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    cybrotrade.org
    Registered
    2026-02-09 · Dynadot Inc
    MX
    Receives mail at cybrotrade.org
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  6. gkfeiuqv.yqdfgekr.vzchbewo.yidmvuao.tkmxdgnv.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    gkfeiuqv.yqdfgekr.vzchbewo.yidmvuao.tkmxdgnv.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 23:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 22:24 UTC to 2027-02-07 22:24 UTC
    Logged 2026-11-09 23:22 UTC in Let's Encrypt Sycamore2027h1, entry 1,101,772,970
    SHA-256 5641dd96faa9b689732485b5841c7474e426f14d4207c69a45bbc1979925ef7b
    Public key SHA-256 7b6aa6f12fc228bacec7540b68017ccfa7de61be4d337159805c60089927700d
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  7. investgtx.com US · AS395092 · Shock Hosting LLC
    ReportedReported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 6 mo ago
    DetailsHide
    Hostname
    investgtx.com
    First seen
    2026-11-09 23:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 22:22 UTC to 2027-02-07 22:22 UTC
    Logged 2026-11-09 23:21 UTC in Google PlumbersArms2027h1, entry 707,506,594
    SHA-256 62b6a33a426f8a3b0aaa35300bec9148d160b678ee7a5b8f6a38bd99e85da8ac
    Public key SHA-256 eb0cd8bb36b83bb00febc63c7b7d743be7415093723c465c50635427dc8a02f3
    PhishDestroy
    Addresses
    203.96.176.174 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    investgtx.com
    Registered
    2026-05-20 · EuroDNS S.A.
    MX
    Receives mail at investgtx-com.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  8. meritmind.stage.io-ext.se BE · AS34762 · COMBELL-AS Combell NV2 addresses
    ListedUnder io-ext.se, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    meritmind.stage.io-ext.se
    First seen
    2026-11-09 23:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask, listing io-ext.se and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 22:26 UTC to 2027-02-07 22:26 UTC
    Logged 2026-11-09 23:24 UTC in Google PlumbersArms2027h1, entry 707,545,063
    SHA-256 2d0847933908735a89eff3837e98fec067b321ac53518c822e9527ffe5cc816a
    Public key SHA-256 7c8d456540ff0fc506c836844377a645d58f8bfce51ac99091e265a8d09736cc
    Addresses
    188.208.37.135 · Belgium · AS34762 COMBELL-AS Combell NV
    2a00:1c98:1000:12e1:0:4:111c:2850
    Domain
    io-ext.se
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 05:17 UTC

    Suggest a correction

  9. svdtmklsp.yjahpkrn.cbvuxylq.fuyndtoc.nirfhjym.uatmfwcq.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    svdtmklsp.yjahpkrn.cbvuxylq.fuyndtoc.nirfhjym.uatmfwcq.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 23:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:24 UTC to 2027-02-07 22:24 UTC
    Logged 2026-11-09 23:22 UTC in Google ParcelYard2027h1, entry 707,247,342
    SHA-256 ecd6d402ff3bf0c8116eb37c8fd5c73e74d8c320628ef87e3360911bf04bfd76
    Public key SHA-256 18fd77b14e719e6e7d6f54856419a7ac950634af3511c345127b3d568dad8592
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  10. www.dusitd2nairobi.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesUnder dusitd2nairobi.com, listed by CERT PolskaMX absentSPF missingDMARC quarantineRegistered 14 y ago
    DetailsHide
    Hostname
    www.dusitd2nairobi.com
    First seen
    2026-11-09 23:26 UTC
    Listing
    CERT Polska listed it 2026-07-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska, listing dusitd2nairobi.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-09 23:24 UTC to 2027-05-26 23:24 UTC
    Logged 2026-11-09 23:24 UTC in GoDaddy Aquamarine2027h1, entry 204,165,801
    SHA-256 f5be201b6c3a933866a6a00d389802a4f930efa60290b96163ebbb4b71f51251
    Public key SHA-256 a99362f871623298a34d7977f91b464fe61f4c775f004d40e34aa5cafe1e8aa5
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    dusitd2nairobi.com
    Registered
    2012-10-05 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  11. www.investgtx.com US · AS395092 · Shock Hosting LLC
    ReportedUnder investgtx.com, reported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 6 mo ago
    DetailsHide
    Hostname
    www.investgtx.com
    First seen
    2026-11-09 23:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing investgtx.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 22:22 UTC to 2027-02-07 22:22 UTC
    Logged 2026-11-09 23:21 UTC in Google PlumbersArms2027h1, entry 707,506,594
    SHA-256 62b6a33a426f8a3b0aaa35300bec9148d160b678ee7a5b8f6a38bd99e85da8ac
    Public key SHA-256 eb0cd8bb36b83bb00febc63c7b7d743be7415093723c465c50635427dc8a02f3
    PhishDestroy
    Addresses
    203.96.176.174 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    investgtx.com
    Registered
    2026-05-20 · EuroDNS S.A.
    MX
    Receives mail at investgtx-com.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  12. xayopctc.rgjemern.rtyvkyca.bbpqlwao.rbl2jkv1f4qkmyqq.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    xayopctc.rgjemern.rtyvkyca.bbpqlwao.rbl2jkv1f4qkmyqq.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 23:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:24 UTC to 2027-02-07 22:24 UTC
    Logged 2026-11-09 23:22 UTC in Google ParcelYard2027h1, entry 707,247,564
    SHA-256 4ae88c517be344b52e0fd145171bf44fc6efa77821efd53fb1f7dadea2887bb7
    Public key SHA-256 882c49e18fea60cde9b1db9383aa88c45a44f44d041ee232feceb2889e92822e
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  13. yokrnjxg.idxmzovq.xcmzihbj.aengjbuil.wviyzmqf.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    yokrnjxg.idxmzovq.xcmzihbj.aengjbuil.wviyzmqf.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-09 23:26 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:24 UTC to 2027-02-07 22:24 UTC
    Logged 2026-11-09 23:22 UTC in Google ParcelYard2027h1, entry 707,247,536
    SHA-256 4654daed0dd20ac444a9d70f543debbf8a1f32da356568a014a66659f44bdb2e
    Public key SHA-256 2a98fb3c8e13316cc34e79f84606b08504f767f651ddac1c4db0a2115cc13868
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  14. zooomtalk.com
    ListedListed by MetaMaskMX presentSPF ?allDMARC quarantineRegistered 4 mo ago
    DetailsHide
    Hostname
    zooomtalk.com
    First seen
    2026-11-09 23:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 22:21 UTC to 2027-02-07 23:19 UTC
    Logged 2026-11-09 23:21 UTC in Google PlumbersArms2027h1, entry 707,508,128
    SHA-256 7c5749e2f2e5560ff2c0d9b7b54b3eb6694482beffda5d5c50185984bd345f62
    Public key SHA-256 727846ea68e7d1e4fb1e5b3fec86430b4433b0db9430d07fa5587c5e16c0dbfb
    Domain
    zooomtalk.com
    Registered
    2026-07-13 · GoDaddy.com, LLC
    MX
    Receives mail at smtp.secureserver.net, mailstore1.secureserver.net
    SPF
    SPF record with ?all: other senders are neutral
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 07:57 UTC

    Suggest a correction

  15. upstatecardshow.com US · AS26347 · New Dream Network, LLC
    ListedListed by CERT PolskaMX presentSPF -allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    upstatecardshow.com
    First seen
    2026-11-09 23:21 UTC
    Listing
    CERT Polska listed it 2026-07-04 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 22:18 UTC to 2027-02-07 22:18 UTC
    Logged 2026-11-09 23:17 UTC in Google ParcelYard2027h1, entry 707,189,826
    SHA-256 11f89629c376af717bfc346ee8a61a671c38643591677c21552c6f14d9ac0845
    Public key SHA-256 df0c14bc848eb244ee100dbcb08681d70f099de4175a878f2afc8da1cc252dbe
    Addresses
    67.205.21.29 · United States · AS26347 DREAMHOST-AS - New Dream Network, LLC
    Domain
    upstatecardshow.com
    Registered
    2024-04-25 · GoDaddy.com, LLC
    MX
    Receives mail at mx1.dreamhost.com, mx2.dreamhost.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  16. www.upstatecardshow.com US · AS26347 · New Dream Network, LLC
    ListedUnder upstatecardshow.com, listed by CERT PolskaMX presentSPF -allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    www.upstatecardshow.com
    First seen
    2026-11-09 23:21 UTC
    Listing
    CERT Polska listed it 2026-07-04 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska, listing upstatecardshow.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 22:18 UTC to 2027-02-07 22:18 UTC
    Logged 2026-11-09 23:17 UTC in Google ParcelYard2027h1, entry 707,189,826
    SHA-256 11f89629c376af717bfc346ee8a61a671c38643591677c21552c6f14d9ac0845
    Public key SHA-256 df0c14bc848eb244ee100dbcb08681d70f099de4175a878f2afc8da1cc252dbe
    Addresses
    67.205.21.29 · United States · AS26347 DREAMHOST-AS - New Dream Network, LLC
    Domain
    upstatecardshow.com
    Registered
    2024-04-25 · GoDaddy.com, LLC
    MX
    Receives mail at mx1.dreamhost.com, mx2.dreamhost.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  17. www.signup.pokerdom-iphone-ios.ru AE · AS59692 · IQWEB IQWeb FZ-LLCApple
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.signup.pokerdom-iphone-ios.ru
    First seen
    2026-11-09 23:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 186.2.174.131.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 186.2.174.131
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 22:15 UTC to 2027-02-07 22:15 UTC
    Logged 2026-11-09 23:14 UTC in Let's Encrypt Willow2027h1, entry 1,056,862,351
    SHA-256 3d240ccbfcc305ba2404d1caa976531d0cf0b45f54ed52150315e230ddf84bb9
    Public key SHA-256 4e37847dc793b04bb2f39629946ede0f8341640101ba0d6aa6727b7cf3caf704
    Brand
    Apple
    Addresses
    186.2.174.131 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    pokerdom-iphone-ios.ru
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 22:37 UTC

    Suggest a correction

  18. allocation-mage.xyz US · AS16509 · Amazon.com, Inc.2 addresses
    ListedParking page · AfternicListed by MetaMaskMX absentSPF -allDMARC missingRegistered 30 d ago
    DetailsHide
    Hostname
    allocation-mage.xyz
    First seen
    2026-11-09 23:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-09 23:10 UTC to 2027-05-26 23:10 UTC
    Logged 2026-11-09 23:10 UTC in GoDaddy Aquamarine2027h1, entry 204,118,527
    SHA-256 d647bfb21f7675c41ee53e166668475a1b32da48c34bc0da4fd68edb373658ce
    Public key SHA-256 1f120630c7a8fad759f27ec528bf3da0d19ff12a7c08d74fc1a811690600202a
    Addresses
    13.248.169.48 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    76.223.54.146 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    Parking page · Afternic
    The registry delegates allocation-mage.xyz to Afternic’s nameservers, which answer for it. Afternic (13.248.169.48, 76.223.54.146): a parking service. It answers for names that are typically for sale or unused.
    Domain
    allocation-mage.xyz
    Registered
    2026-10-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  19. casebatle.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 20 mo ago
    DetailsHide
    Hostname
    casebatle.net
    First seen
    2026-11-09 23:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 22:12 UTC to 2027-02-07 23:10 UTC
    Logged 2026-11-09 23:12 UTC in Geomys Tuscolo2027h1, entry 551,797,498
    SHA-256 ac367db91d70c05fae9c0535d3cd412942f2b7082e5ac7f3ea600a75f2f3ea68
    Public key SHA-256 0c68b22bfb664cb152944e3d96a5e7986cca4c015be7586777afd8033341e35b
    PhishDestroy
    Addresses
    104.21.7.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.40 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.7.182, 172.67.137.40): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    casebatle.net
    Registered
    2025-03-08 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  20. launch.lightchain.ai US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder lightchain.ai, reported by PhishDestroyMX presentSPF -allDMARC policy noneRegistered 24 mo ago
    DetailsHide
    Hostname
    launch.lightchain.ai
    First seen
    2026-11-09 23:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing lightchain.ai and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 22:12 UTC to 2027-02-07 22:12 UTC
    Logged 2026-11-09 23:11 UTC in DigiCert Wyvern2027h1, entry 474,728,211
    SHA-256 7c955d4a17adbb96a5c6a867ba9510b59dfe9cfb0e6d40b92f0e8d48d94e64a2
    Public key SHA-256 4be868b96dbe69bd61209e056a906736243ea95d14bac832e633a949091066e6
    PhishDestroy
    Addresses
    216.150.1.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.1, 216.150.16.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    lightchain.ai
    Registered
    2024-11-21 · Name.com, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 08:53 UTC

    Suggest a correction

  21. primorisfin.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    primorisfin.com
    First seen
    2026-11-09 23:16 UTC
    Listing
    CERT Polska listed it 2026-09-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 22:12 UTC to 2027-02-07 22:12 UTC
    Logged 2026-11-09 23:11 UTC in Google PlumbersArms2027h1, entry 707,403,406
    SHA-256 d445b8e043cffc2483c367e737ccacf7d694ab568455baa2e7ab1eec99577cef
    Public key SHA-256 c63ba8f8faf87942a28347593d5a2f081cb3dd9194434a69e31a30ad41527787
    Addresses
    104.21.22.84 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.203.124 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.22.84, 172.67.203.124): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    primorisfin.com
    Registered
    2026-07-23 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  22. spin-games.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    spin-games.cc
    First seen
    2026-11-09 23:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 22:13 UTC to 2027-02-07 23:11 UTC
    Logged 2026-11-09 23:13 UTC in Google PlumbersArms2027h1, entry 707,427,552
    SHA-256 0f0b03c302d76b1cf7c72345ff6da699188076e9574d47d1d86e53890a8ac3a7
    Public key SHA-256 b187f39536918af0f6c7fe2724dbe6e3ec0d610dae29b3f463bda0e1bbd172c3
    PhishDestroy
    Addresses
    104.21.42.127 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.162.9 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.42.127, 172.67.162.9): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    spin-games.cc
    Registered
    2026-01-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  23. unitrans.cloud
    ListedListed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    unitrans.cloud
    First seen
    2026-11-09 23:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:13 UTC to 2027-02-07 22:13 UTC
    Logged 2026-11-09 23:11 UTC in DigiCert Wyvern2027h1, entry 474,733,071
    SHA-256 615f2a948a2582161e272d7fa43d5872af0eae7710261b05b8a332b3ac5ba700
    Public key SHA-256 e890291d34135cd1c8cdfda1d65ceb0f6794ca0aa7fa285d66839df72522c915
    Domain
    unitrans.cloud
    Registered
    2026-05-16 · NAMECHEAP
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  24. untukprimarysaja.com US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    untukprimarysaja.com
    First seen
    2026-11-09 23:16 UTC
    Listing
    CERT Polska listed it 2026-05-26 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-09 23:14 UTC to 2027-05-26 23:14 UTC
    Logged 2026-11-09 23:14 UTC in GoDaddy Aquamarine2027h1, entry 204,131,658
    SHA-256 417455b89037b5820cffb66d050d59920cac8e68dfa25f35fbf01abac67b7459
    Public key SHA-256 42f792c7ecaee51411c22668540466afd2706b0f01d34a27586b89c88aab6541
    Addresses
    15.197.172.60 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (15.197.172.60): a cloud provider. It rents servers and addresses to its customers.
    Domain
    untukprimarysaja.com
    Registered
    2024-11-08 · eNom, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  25. wallet.zurfx.com DE · AS24940 · HETZNER-AS Hetzner Online G…
    ReportedHetznerUnder zurfx.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    wallet.zurfx.com
    First seen
    2026-11-09 23:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing zurfx.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 22:14 UTC to 2027-02-07 22:14 UTC
    Logged 2026-11-09 23:13 UTC in Google ParcelYard2027h1, entry 707,146,049
    SHA-256 17c1dc8450bef32d5c9bc3d29e2022426fb6422ff1afbb673fbacb835adb2d56
    Public key SHA-256 33af513f3b42ab9c0bab52c42514f928d668a7164dae92447063866ad395b3e0
    PhishDestroy
    Addresses
    204.168.155.130 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (204.168.155.130): a cloud provider. It rents servers and addresses to its customers.
    Domain
    zurfx.com
    Registered
    2026-07-01 · GoDaddy.com, LLC
    MX
    Receives mail at mx.stackmail.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 17:06 UTC

    Suggest a correction

  26. www.zoeyloves.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesUnder zoeyloves.com, listed by CERT PolskaMX absentSPF missingDMARC quarantineRegistered 12 mo ago
    DetailsHide
    Hostname
    www.zoeyloves.com
    First seen
    2026-11-09 23:16 UTC
    Listing
    CERT Polska listed it 2026-10-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska, listing zoeyloves.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-09 23:09 UTC to 2027-05-26 23:09 UTC
    Logged 2026-11-09 23:09 UTC in Google Argon2027h1, entry 954,696,267
    SHA-256 123f48d1e53bf2f7acc1ee66fc9d545d27f36ee4e100b2a1fea063803c0efe83
    Public key SHA-256 f460b4e61d23a6ef7d23a60a01c59e383611ca66cd909ef65cf4f82262cdce76
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    zoeyloves.com
    Registered
    2025-11-03 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 00:48 UTC

    Suggest a correction

  27. tokenpocket73.top HK · AS152194 · CTG Server LimitedTokenPocket
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    tokenpocket73.top
    First seen
    2026-11-09 23:14 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 137.220.225.148.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 137.220.225.148
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 22:06 UTC to 2027-02-07 23:04 UTC
    Logged 2026-11-09 23:06 UTC in Google ParcelYard2027h1, entry 707,070,959
    SHA-256 f0285f68577b1071b1b692e1a30254373875a71d646d29da94675fc479ae3058
    Public key SHA-256 d6ffa6e85e9029aee0927f3da54276b3a50eec31ed30d7b714d7e197c3c965e5
    Brand
    TokenPocket
    Addresses
    137.220.225.148 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    tokenpocket73.top
    Registered
    2026-07-14 · Dynadot LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:18 UTC

    Suggest a correction

  28. algosimpletrader.com US · AS395092 · Shock Hosting LLC
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 18 mo ago
    DetailsHide
    Hostname
    algosimpletrader.com
    First seen
    2026-11-09 23:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:11 UTC to 2027-02-07 22:11 UTC
    Logged 2026-11-09 23:09 UTC in Google ParcelYard2027h1, entry 707,110,007
    SHA-256 23ee3597f0bbcd42501a68f0f73c7bb7bb561bc3d1cfc9ac11fca83e4830c599
    Public key SHA-256 38935f67c155b5e1ed23fcba42def1ecbc648c66c64be1aa5e398aa071b4792d
    PhishDestroy
    Addresses
    213.108.246.233 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    algosimpletrader.com
    Registered
    2025-05-15 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Receives mail at algosimpletrader.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  29. auctortrade.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    auctortrade.com
    First seen
    2026-11-09 23:10 UTC
    Listing
    CERT Polska listed it 2026-09-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:09 UTC to 2027-02-07 22:09 UTC
    Logged 2026-11-09 23:07 UTC in Google ParcelYard2027h1, entry 707,090,892
    SHA-256 69b9b99313c474da1cebb961242daf9a72b5fdde3a324621b28f8bfd5934a885
    Public key SHA-256 759203c1fd2fd86313ae3bffcb23dfc106d8a544e6e4d2bd32c1b1c7faee2596
    Addresses
    104.21.34.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.34.168, 172.67.163.74): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    auctortrade.com
    Registered
    2026-07-23 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  30. deadtargets.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    deadtargets.com
    First seen
    2026-11-09 23:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 22:07 UTC to 2027-02-07 22:07 UTC
    Logged 2026-11-09 23:05 UTC in Google ParcelYard2027h1, entry 707,064,086
    SHA-256 67ed72ec1b695bf426a6306c8c684bdb6cd200354ee8be1903cd5e6344922142
    Public key SHA-256 178c04c862a192014e16d6f63fb6d3a7d8cba5ac337ba61c948a208508b7a306
    PhishDestroy
    Addresses
    104.21.90.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.90.250, 172.67.163.90): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    deadtargets.com
    Registered
    2025-07-09 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  31. maclegend.com US · AS14618 · Amazon.com, Inc.4 addresses
    ReportedParking page · HugeDomainsReported by PhishDestroyMX absentSPF -allDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    maclegend.com
    First seen
    2026-11-09 23:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-08 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 22:10 UTC to 2027-02-07 22:10 UTC
    Logged 2026-11-09 23:09 UTC in Google PlumbersArms2027h1, entry 707,380,911
    SHA-256 05451f9f7eb0e857c9fbaae09fc65b3c98cf38e5f61723f24d3c73d49d17dd0d
    Public key SHA-256 dca37804aa2362874030242140d56fb68e1b94554d23718da9f6a5d2f21027f9
    PhishDestroy
    Addresses
    13.223.25.84 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    54.243.117.197 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · HugeDomains (parking page)
    2600:1f18:4ae:c605:dd5d:b838:5816:d7fb
    2600:1f18:4ae:c606:78d4:4260:db4e:aeee
    Parking page · HugeDomains
    HugeDomains (13.223.25.84, 54.243.117.197): a parking service. It answers for names that are typically for sale or unused.
    Domain
    maclegend.com
    Registered
    2026-09-11 · DropCatch.com 543 LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  32. qaldrim.vip US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    qaldrim.vip
    First seen
    2026-11-09 23:10 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 22:08 UTC to 2027-02-07 23:06 UTC
    Logged 2026-11-09 23:08 UTC in DigiCert Sphinx2027h1, entry 420,496,250
    SHA-256 de56106e95ed7ace4b28e7dc434b3fe8e98d1c0d6281dc63c9da753c90978f4c
    Public key SHA-256 6509b88111b7a9b70bd51ac8a66102f2b8039f3352f799ae43543ed721d9d53c
    Addresses
    104.21.62.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.152, 172.67.136.184): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qaldrim.vip
    Registered
    2026-07-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  33. quaestustrade.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    quaestustrade.com
    First seen
    2026-11-09 23:10 UTC
    Listing
    CERT Polska listed it 2026-09-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 22:08 UTC to 2027-02-07 22:08 UTC
    Logged 2026-11-09 23:06 UTC in Let's Encrypt Willow2027h1, entry 1,056,676,173
    SHA-256 35c4d05ccbc5c97697354f1926c1278cd1d278e93024d998f4715bdc605d22c5
    Public key SHA-256 7126bf629ce3321e3afb55ada96b47f66480e03d6c2819e98ff9d3e6c51f0c47
    Addresses
    104.21.66.65 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.201.137 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.65, 172.67.201.137): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    quaestustrade.com
    Registered
    2026-07-23 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  34. saugatr-arts417570.mauicreativos.com US · AS219082 · BOUGH Bough Limited
    ListedUnder mauicreativos.com, listed by USOMMX presentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    saugatr-arts417570.mauicreativos.com
    First seen
    2026-11-09 23:10 UTC
    Listing
    USOM listed it 2026-08-05 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing mauicreativos.com and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 22:09 UTC to 2027-02-07 22:09 UTC
    Logged 2026-11-09 23:07 UTC in IPng Networks Halloumi2027h1, entry 432,722,005
    SHA-256 38c13cd7beb972c88292aad5e6b05883f40f1f6f2d80a81d4726b0443f31320b
    Public key SHA-256 e5b873a582a4677fa73f7563666d223055786794eeff972c7e902b8d5510bd88
    Addresses
    153.76.4.10 · United States · AS219082 BOUGH Bough Limited
    Domain
    mauicreativos.com
    Registered
    2026-06-19 · HOSTINGER operations, UAB
    MX
    Receives mail at mail.mauicreativos.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 04:41 UTC

    Suggest a correction

  35. www.deadtargets.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder deadtargets.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    www.deadtargets.com
    First seen
    2026-11-09 23:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing deadtargets.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 22:07 UTC to 2027-02-07 22:07 UTC
    Logged 2026-11-09 23:05 UTC in Google ParcelYard2027h1, entry 707,064,086
    SHA-256 67ed72ec1b695bf426a6306c8c684bdb6cd200354ee8be1903cd5e6344922142
    Public key SHA-256 178c04c862a192014e16d6f63fb6d3a7d8cba5ac337ba61c948a208508b7a306
    PhishDestroy
    Addresses
    104.21.90.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.90.250, 172.67.163.90): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    deadtargets.com
    Registered
    2025-07-09 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  36. admin.kktcedevlet.console.icont.ai US · AS396982 · Google LLC
    ListedGoogle CloudUnder kktcedevlet.console.icont.ai, listed by USOMMX presentSPF ~allDMARC policy noneRegistered 20 mo ago
    DetailsHide
    Hostname
    admin.kktcedevlet.console.icont.ai
    First seen
    2026-11-09 23:05 UTC
    Listing
    USOM listed it 2026-09-24 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM, listing kktcedevlet.console.icont.ai and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:06 UTC to 2027-02-07 22:06 UTC
    Logged 2026-11-09 23:04 UTC in Geomys Tuscolo2027h1, entry 551,719,591
    SHA-256 3a1f204ffce3994408923e8ab50556fee3bbc44a4d0b948eca6150d35178c6e8
    Public key SHA-256 5a9171d5c799a3adca42a17d558fb234d71630dcccfe3fae106f67bf37cff602
    Addresses
    35.197.206.178 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (35.197.206.178): a cloud provider. It rents servers and addresses to its customers.
    Domain
    icont.ai
    Registered
    2025-04-02 · GoDaddy.com, LLC
    MX
    Receives mail at mail.icont.ai
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  37. al-shahid.com.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    al-shahid.com.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  38. amirhameed.com US · AS16509 · Amazon.com, Inc.
    ReportedAmazon Web ServicesReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 22:17 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    76.76.21.21 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (76.76.21.21): a cloud provider. It rents servers and addresses to its customers.
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  39. etherbank.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    etherbank.net
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 22:03 UTC to 2027-02-07 23:00 UTC
    Logged 2026-11-09 23:03 UTC in Google ParcelYard2027h1, entry 707,034,057
    SHA-256 69e395d43c4440ac9658c237b6a5456a21da3a1c4f697ee597b8c07ccce4f427
    Public key SHA-256 6b8a5d94328fe13ae3af4a507a45f83afbf4bab8b2c4356cd839918c6b166fa9
    PhishDestroy
    Addresses
    104.21.93.125 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.226 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.93.125, 172.67.209.226): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    etherbank.net
    Registered
    2026-01-18 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  40. justlennd.lat US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    justlennd.lat
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:03 UTC to 2027-02-07 22:03 UTC
    Logged 2026-11-09 23:01 UTC in Google PlumbersArms2027h1, entry 707,290,928
    SHA-256 6f24e87514924072d83c7de7325055fba4941d0592701d53ac6dc14cc9c476f8
    Public key SHA-256 b8e8a6e51d261884eed31b43968657f838b59ff3aef38b35438c88a608b7f732
    PhishDestroy
    Addresses
    104.21.88.69 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.88.69, 172.67.173.164): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    justlennd.lat
    Registered
    2026-03-18 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  41. trust-cards.pro 45.87.249.35
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    trust-cards.pro
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 22:04 UTC to 2027-02-07 22:04 UTC
    Logged 2026-11-09 23:03 UTC in Google ParcelYard2027h1, entry 707,033,586
    SHA-256 14bd630bf7e4aedbf63df9fa1394ff608224b1239de3625bab9c902c2018403f
    Public key SHA-256 3a04559c0b66f546f652ff824cf4f3e90d719735aa158c784416cd896bf4b190
    PhishDestroy
    Addresses
    45.87.249.35
    Domain
    trust-cards.pro
    Registered
    2026-05-17 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  42. vote-flaregovernances.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    vote-flaregovernances.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 22:03 UTC to 2027-02-07 23:01 UTC
    Logged 2026-11-09 23:03 UTC in IPng Networks Halloumi2027h1, entry 432,681,798
    SHA-256 4f37140599c896af751e52587c41cc65d9f3f4cd309bc2054564fda2facb7cf0
    Public key SHA-256 089bf621757eee83687dca95a3ff75411a3dc76d6ad7331bf50b029519305073
    Addresses
    104.21.46.145 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.4 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.46.145, 172.67.140.4): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    vote-flaregovernances.com
    Registered
    2026-07-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  43. vustation.pk.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    vustation.pk.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  44. ww17.837024-coinbase.com VG · AS40034 · Confluence Networks IncCoinbase
    ListedParking page · Above.comUnder 837024-coinbase.com, listed by MetaMaskMX presentSPF -allDMARC missingRegistered 20 mo ago
    DetailsHide
    Hostname
    ww17.837024-coinbase.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Listed
    MetaMask, listing 837024-coinbase.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-02-07 23:59 UTC
    Logged 2026-11-09 23:00 UTC in DigiCert Sphinx2027h1, entry 420,444,080
    SHA-256 6f50a5477acdb18ebabff279d1211539e41e7f704849270d70443873844f48dc
    Public key SHA-256 353ffb2a3f55d0e12359f3f026d578abb606fe7787829c800ed5a1760504162a
    Brand
    Coinbase
    Addresses
    199.191.50.190 · British Virgin Islands · AS40034 CONFLUENCE-NETWORK-INC - Confluence Networks Inc · Confluence Networks (parking page)
    Parking page · Above.com
    The registry delegates 837024-coinbase.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Confluence Networks (199.191.50.190): a parking service. It answers for names that are typically for sale or unused.
    Domain
    837024-coinbase.com
    Registered
    2025-04-01 · Above.com Pty Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 06:52 UTC

    Suggest a correction

  45. www.al-shahid.com.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.al-shahid.com.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  46. www.ch.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.ch.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  47. www.chat.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.chat.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  48. www.chirpchat.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.chirpchat.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  49. www.cv.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.cv.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  50. www.elgg.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.elgg.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  51. www.forum.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.forum.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  52. www.from.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.from.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  53. www.fuegobase.io US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder fuegobase.io, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    www.fuegobase.io
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing fuegobase.io and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 22:04 UTC to 2027-02-07 22:04 UTC
    Logged 2026-11-09 23:02 UTC in Google PlumbersArms2027h1, entry 707,305,760
    SHA-256 0c91a0d20b6fe4e8867e9f7b72d97a2c92b45f1e1e262fac8a61de91f0af8bb9
    Public key SHA-256 1b2472415bc63a16b76437c63efdc3d2b9e7f92b1a18d19f149dd95ccf3802e0
    PhishDestroy
    Addresses
    64.29.17.65 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.198.79.65 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (64.29.17.65, 216.198.79.65): a cloud provider. It rents servers and addresses to its customers.
    Domain
    fuegobase.io
    Registered
    2024-10-24 · NameCheap, Inc.
    MX
    Receives mail at mx1.privateemail.com, mx2.privateemail.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  54. www.journal.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.journal.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:03 UTC to 2027-02-07 22:03 UTC
    Logged 2026-11-09 23:01 UTC in Geomys Tuscolo2027h1, entry 551,686,395
    SHA-256 3ef1532f0d6ad3bb47411d2d91e28eac6d97740ab09da300800d4405cd11da9b
    Public key SHA-256 0554c2c78397092e3bb81e39cc9b0354bbdc3251a4c0456f76c4ff8803cfc59a
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  55. www.mj.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.mj.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  56. www.network.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.network.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  57. www.photos.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.photos.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  58. www.seekhay-ga.amirhameed.com
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.seekhay-ga.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  59. www.space.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.space.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  60. www.store.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.store.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  61. www.uraan3d.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.uraan3d.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  62. www.vustation.pk.amirhameed.com US · AS395092 · Shock Hosting LLC
    ReportedUnder amirhameed.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 15 y ago
    DetailsHide
    Hostname
    www.vustation.pk.amirhameed.com
    First seen
    2026-11-09 23:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing amirhameed.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 23:00 UTC in Let's Encrypt Willow2027h1, entry 1,056,519,520
    SHA-256 56a6775aaf7d682de2ae19474c82c5d0a2cb0be0462c8abba3c00563addb6a16
    Public key SHA-256 c0671712686ffb2ebc24775a0baefbd272adb7644548a4c4bf7fd1ef8532d4e1
    PhishDestroy
    Addresses
    45.155.38.78 · United States · AS395092 SHOCK-1 - Shock Hosting LLC
    Domain
    amirhameed.com
    Registered
    2012-01-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at amirhameed.com, aspmx.l.google.com, alt1.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 07:49 UTC

    Suggest a correction

  63. trustwalletau.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…Trust Wallet
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered today
    DetailsHide
    Hostname
    trustwalletau.com
    First seen
    2026-11-09 23:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1
    Valid 2026-11-09 21:57 UTC to 2027-02-07 21:57 UTC
    Logged 2026-11-09 22:56 UTC in DigiCert Sphinx2027h1, entry 420,419,400
    SHA-256 159e3d240d7afb06da714918cf443952628904e548433e525f59fb02674ee751
    Public key SHA-256 806cb6d068c2f4d26e0c51ab76032c426b9362df2171ac5682007e415bf8f988
    Brand
    Trust Wallet
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    trustwalletau.com
    Registered
    2026-11-09 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  64. www.trustwalletau.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…Trust Wallet
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered today
    DetailsHide
    Hostname
    www.trustwalletau.com
    First seen
    2026-11-09 23:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    Certificate
    Issued by YE1
    Valid 2026-11-09 21:57 UTC to 2027-02-07 21:57 UTC
    Logged 2026-11-09 22:56 UTC in DigiCert Sphinx2027h1, entry 420,419,400
    SHA-256 159e3d240d7afb06da714918cf443952628904e548433e525f59fb02674ee751
    Public key SHA-256 806cb6d068c2f4d26e0c51ab76032c426b9362df2171ac5682007e415bf8f988
    Brand
    Trust Wallet
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    trustwalletau.com
    Registered
    2026-11-09 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  65. betowex.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    betowex.com
    First seen
    2026-11-09 23:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 21:58 UTC to 2027-02-07 21:58 UTC
    Logged 2026-11-09 22:56 UTC in IPng Networks Gouda2027h1, entry 367,849,294
    SHA-256 bb835e62b38d7fee6b42de0a62df00ded760f75121fd146a7ad45f9dcd9edae0
    Public key SHA-256 09b7208c4d0bc71af74a1bf120f9e7af030e721c544d9aed364558281404de34
    PhishDestroy
    Addresses
    104.21.63.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.171.9 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.63.157, 172.67.171.9): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    betowex.com
    Registered
    2026-05-16 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  66. chilloutvr.org US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    chilloutvr.org
    First seen
    2026-11-09 23:00 UTC
    Listing
    CERT Polska listed it 2026-07-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 21:59 UTC to 2027-02-07 21:59 UTC
    Logged 2026-11-09 22:57 UTC in Geomys Tuscolo2027h1, entry 551,647,109
    SHA-256 111ad9583c8f8ed14829680a9dbe45118e54ef50274337b3297b996467066793
    Public key SHA-256 9dacb8c02e539f39fcbcff4255ff71b16dd4508d78292e85b323ae5c26198b3e
    Addresses
    216.198.79.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.198.79.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    chilloutvr.org
    Registered
    2026-07-06 · Turkticaret.net Yazılım Hizmetleri Sanayi ve Ticaret A.Ş.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  67. coinbaselogins.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    coinbaselogins.pages.dev
    First seen
    2026-11-09 23:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 21:59 UTC to 2027-02-07 22:57 UTC
    Logged 2026-11-09 22:59 UTC in DigiCert Wyvern2027h1, entry 474,639,706
    SHA-256 5dbbfc5bad2bed707fc6106fcd07671e119dd0126f6cb7095778c72e90140b6e
    Public key SHA-256 e14800940d3a83b9e8ebcb8f8b9d7228bad48897555e6e55253b0e30650ac465
    Addresses
    172.66.45.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.217 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d27
    2606:4700:310c::ac42:2ed9
    Cloudflare
    Cloudflare (172.66.45.39, 172.66.46.217): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  68. phan-event.app US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    phan-event.app
    First seen
    2026-11-09 23:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-11 21:06 UTC to 2026-12-10 22:04 UTC
    Logged 2026-11-09 22:56 UTC in DigiCert Wyvern2026h2, entry 2,215,179,237
    SHA-256 a243aa6ecd29e795c03ab68e77863c45c8679f9990e54d202fb25fc6085abca5
    Public key SHA-256 fc2ec6cccfc9b568948dee18dcfa6a850c06c26ab809d00acc0747b71850886f
    PhishDestroy
    Addresses
    104.21.62.57 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.220.109 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.57, 172.67.220.109): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    phan-event.app
    Registered
    2026-01-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  69. svipgods.com
    ListedListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    svipgods.com
    First seen
    2026-11-09 23:00 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 13:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 21:56 UTC to 2027-02-07 22:53 UTC
    Logged 2026-11-09 22:56 UTC in Google ParcelYard2027h1, entry 706,960,850
    SHA-256 58b55828821a29f40c5f9c2121a421741fe43fcea19579a5551dc593e2c88964
    Public key SHA-256 ce03af6be56f777746c8a954f0c81a631232ce566d7acaaf713ae3420d31b1f7
    Domain
    svipgods.com
    Registered
    2025-11-19 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  70. tevelabex.click US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tevelabex.click
    First seen
    2026-11-09 23:00 UTC
    Listing
    CERT Polska listed it 2026-06-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 22:01 UTC to 2027-02-07 22:01 UTC
    Logged 2026-11-09 22:59 UTC in Let's Encrypt Sycamore2027h1, entry 1,101,219,874
    SHA-256 3315b0881f026e0453ce0423c20e2e0148b11ab582ece67add1a7e7817c0ef4f
    Public key SHA-256 979e261026d9efb4553d4fb815dabea75f95401f86defb0b1a7e598f3db901b4
    Addresses
    104.21.83.237 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.115 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.83.237, 172.67.183.115): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tevelabex.click
    Registered
    2026-05-16 · Chengdu West Dimension Digital Technology Co., LTD
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  71. primevideo.com.cn US · AS46844 · Sharktech6 addressesAmazon
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    primevideo.com.cn
    First seen
    2026-11-09 23:00 UTC
    First published
    2026-10-31 22:45 UTC
    DNS
    Resolves · checked 2026-11-09 23:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 208.98.43.31.
    1. Phishing-host list fetched with the address
    2. Resolved to 208.98.43.31
    Brand
    Amazon
    Addresses
    208.98.43.31 · United States · AS46844 SHARKTECH - Sharktech
    208.98.40.31 · United States · AS46844 SHARKTECH - Sharktech
    208.98.40.36 · United States · AS46844 SHARKTECH - Sharktech
    208.98.40.227 · United States · AS46844 SHARKTECH - Sharktech
    208.98.40.229 · United States · AS46844 SHARKTECH - Sharktech
    208.98.43.92 · United States · AS46844 SHARKTECH - Sharktech
    Domain
    primevideo.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 23:42 UTC

    Suggest a correction

  72. www.navyfederal-en.org GB · AS198550 · nodehost-as NODE HOST LIMIT…2 addressesNavy Federal Credit Union
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    www.navyfederal-en.org
    First seen
    2026-11-09 22:59 UTC
    First published
    2026-11-01 22:48 UTC
    DNS
    Resolves · checked 2026-11-09 22:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 191.44.114.31.
    1. Phishing-host list fetched with the address
    2. Resolved to 191.44.114.31
    Brand
    Navy Federal Credit Union
    Addresses
    191.44.114.31 · United Kingdom · AS198550 nodehost-as NODE HOST LIMITED
    154.86.119.115 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    Domain
    navyfederal-en.org
    Registered
    2026-11-01 · Key-Systems GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 23:42 UTC

    Suggest a correction

  73. navyfederal-en.org GB · AS198550 · nodehost-as NODE HOST LIMIT…2 addressesNavy Federal Credit Union
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    navyfederal-en.org
    First seen
    2026-11-09 22:59 UTC
    First published
    2026-11-01 22:48 UTC
    DNS
    Resolves · checked 2026-11-09 22:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 191.44.114.31.
    1. Phishing-host list fetched with the address
    2. Resolved to 191.44.114.31
    Brand
    Navy Federal Credit Union
    Addresses
    191.44.114.31 · United Kingdom · AS198550 nodehost-as NODE HOST LIMITED
    154.86.119.115 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    Domain
    navyfederal-en.org
    Registered
    2026-11-01 · Key-Systems GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-08 23:42 UTC

    Suggest a correction

  74. app.prismhash.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder prismhash.com, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    app.prismhash.com
    First seen
    2026-11-09 22:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing prismhash.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 21:53 UTC to 2027-02-07 22:52 UTC
    Logged 2026-11-09 22:53 UTC in Google PlumbersArms2027h1, entry 707,202,357
    SHA-256 59c40a0fd509fa6ce6a6da88356bda35ab04ff9cdaee508fa096f1826aeb7340
    Public key SHA-256 db0e90f5ec90d5d7a1f2b33e48bc97e69bd074f49386fd3fc40ddaaaa4dfc348
    PhishDestroy
    Addresses
    104.21.73.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.119 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.73.243, 172.67.193.119): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    prismhash.com
    Registered
    2026-07-14 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Receives mail at route1.mx.cloudflare.net, route3.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 17:50 UTC

    Suggest a correction

  75. baby.doodlecat.app US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder doodlecat.app, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    baby.doodlecat.app
    First seen
    2026-11-09 22:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing doodlecat.app and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 21:54 UTC to 2027-02-07 22:52 UTC
    Logged 2026-11-09 22:54 UTC in DigiCert Sphinx2027h1, entry 420,401,291
    SHA-256 08b89140e434c46e1785808a8f88fc31de7bc696e370ba8bcc90741d0751fffb
    Public key SHA-256 ac5b29f9bbdf96cac149b86535ff81365b5866df502e338a15cf414e79edd046
    PhishDestroy
    Addresses
    104.21.1.34 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.120 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.1.34, 172.67.186.120): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    doodlecat.app
    Registered
    2026-02-05 · CloudFlare, Inc.
    MX
    Receives mail at route3.mx.cloudflare.net, route1.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 22:57 UTC

    Suggest a correction

  76. polyexcel.app US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    polyexcel.app
    First seen
    2026-11-09 22:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 21:54 UTC to 2027-02-07 22:53 UTC
    Logged 2026-11-09 22:54 UTC in DigiCert Wyvern2027h1, entry 474,607,533
    SHA-256 94cfab91e750d358cef0fbc3d5d11007652d283127da6d0a433be3a9830adbd8
    Public key SHA-256 3c48fb0452166810bca05706acb0a6832b99b506888d124bea614bd9cfe9e07f
    PhishDestroy
    Addresses
    104.21.22.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.30 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.22.214, 172.67.207.30): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    polyexcel.app
    Registered
    2026-01-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  77. tokenwizard.garden US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    tokenwizard.garden
    First seen
    2026-11-09 22:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 21:56 UTC to 2027-02-07 21:56 UTC
    Logged 2026-11-09 22:55 UTC in Google PlumbersArms2027h1, entry 707,223,355
    SHA-256 426f34c4835229adc81c6720834709ea497201e0530f4e41ed3aa9537341eaa4
    Public key SHA-256 b95b5d31f5d8acc6f87cf6e563a6eb4f4c7be5bdbeb3f11af04c16c42e832199
    PhishDestroy
    Addresses
    35.157.26.135 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    63.176.8.218 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (35.157.26.135, 63.176.8.218): a cloud provider. It rents servers and addresses to its customers.
    Domain
    tokenwizard.garden
    Registered
    2026-05-12 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  78. transithub.online BD · AS153568 · NEW DHAKA HARDWARE
    ReportedReported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    transithub.online
    First seen
    2026-11-09 22:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 21:52 UTC to 2027-02-07 21:52 UTC
    Logged 2026-11-09 22:51 UTC in Google ParcelYard2027h1, entry 706,892,521
    SHA-256 d79ee70ffb82d58bbbff2f478ec3dcec17c01e071303270689aa0f1ec82b3974
    Public key SHA-256 365df974e8feb19848a84cf6fc29e3c827021ff3bf4f399f9c697d7e5da46329
    PhishDestroy
    Addresses
    163.61.188.5 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    transithub.online
    Registered
    2026-09-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at transithub.online
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server transithub.online at 163.61.188.5 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.5 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  79. www.uniqa-klement-huber.at SG · AS63949 · Akamai Connected Cloud3 addressesUNIQA
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.uniqa-klement-huber.at
    First seen
    2026-11-09 22:52 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 21:48 UTC to 2027-02-07 21:48 UTC
    Logged 2026-11-09 22:46 UTC in Geomys Tuscolo2027h1, entry 551,531,575
    SHA-256 218290faae7fd7da760da9359f5dda7831f483180e9b5c586e194a2790659aec
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    UNIQA
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    uniqa-klement-huber.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 22:57 UTC

    Suggest a correction

  80. mediaflow-proxy.ethereum.vc US · AS31898 · Oracle CorporationEthereum
    Phishing hostOracle CloudAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    mediaflow-proxy.ethereum.vc
    First seen
    2026-11-09 22:52 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 129.213.114.242.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 129.213.114.242
    Certificate
    Issued by YR2
    Valid 2026-11-09 21:51 UTC to 2027-02-07 21:51 UTC
    Logged 2026-11-09 22:50 UTC in Google ParcelYard2027h1, entry 706,882,289
    SHA-256 652dafe48de1daac44ac53417255014557942503d85f3e57db99fe7df3c731e0
    Public key SHA-256 a57fee2b140a70d4706378ad044cdbe32cd79ca3fc6428b62cb3172e422a0616
    Brand
    Ethereum
    Addresses
    129.213.114.242 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (129.213.114.242): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ethereum.vc
    Registered
    2014-05-07 · Name.com, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  81. admin1.fdomc.com MY · AS154321 · CORENET CLOUD SDN. BHD.
    ListedUnder fdomc.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    admin1.fdomc.com
    First seen
    2026-11-09 22:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask, listing fdomc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 21:49 UTC to 2027-02-07 21:49 UTC
    Logged 2026-11-09 22:48 UTC in IPng Networks Halloumi2027h1, entry 432,546,494
    SHA-256 0b5d8aa9b7ab05b3f1c7a7c8d4a9c4cd27f180a89f783eb78f0b58d0c08a7d87
    Public key SHA-256 fdcc176fec48870601454b2b78e4935e100893eec8344b84b30e768444150b62
    Addresses
    156.239.14.5 · Malaysia · AS154321 CCSB-AS-AP - CORENET CLOUD SDN. BHD.
    Domain
    fdomc.com
    Registered
    2026-05-28 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 07:58 UTC

    Suggest a correction

  82. auth.ethereum.vc US · AS31898 · Oracle CorporationEthereum
    ReportedPhishing hostOracle CloudReported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    auth.ethereum.vc
    First seen
    2026-11-09 22:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 129.213.114.242.
    1. Phishing-host list fetched with the address
    2. Resolved to 129.213.114.242
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 21:51 UTC to 2027-02-07 21:51 UTC
    Logged 2026-11-09 22:50 UTC in Let's Encrypt Willow2027h1, entry 1,056,267,285
    SHA-256 4273ca2c08e7a58c3e415178752018e82a7fd3dd6f24938b110f83f52cacbabf
    Public key SHA-256 78d1bce906963ff13f2b407755ae4883e11d83a938365ddc4008925f52336b56
    PhishDestroy
    Brand
    Ethereum
    Addresses
    129.213.114.242 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (129.213.114.242): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ethereum.vc
    Registered
    2014-05-07 · Name.com, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  83. domowypellet.com 192.0.2.1
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    domowypellet.com
    First seen
    2026-11-09 22:51 UTC
    Listing
    CERT Polska listed it 2026-05-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 21:48 UTC to 2027-02-07 21:48 UTC
    Logged 2026-11-09 22:47 UTC in IPng Networks Halloumi2027h1, entry 432,535,166
    SHA-256 4cee77f4d5892ff3eae4fdbe2a5f595c9c3e7ea1b2d1ba25fc1085f15100443e
    Public key SHA-256 30a6376dea355b81d33127a09acf8c723217be559d85a6978d03b715b5f89446
    Addresses
    192.0.2.1
    Domain
    domowypellet.com
    Registered
    2026-05-16 · Realtime Register B.V.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  84. h3.fdomc.com MY · AS154321 · CORENET CLOUD SDN. BHD.
    ListedUnder fdomc.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    h3.fdomc.com
    First seen
    2026-11-09 22:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask, listing fdomc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-09 21:49 UTC to 2027-02-07 21:49 UTC
    Logged 2026-11-09 22:48 UTC in Geomys Tuscolo2027h1, entry 551,547,127
    SHA-256 08cdc54bc3b447710450f2f9da070db716f03a657c2ecf532a643d8ec36f5cce
    Public key SHA-256 ae0f49145da03c83876862c1ebce67e9be57a4d1ad67074a3a63d4bfac077fa0
    Addresses
    156.239.14.5 · Malaysia · AS154321 CCSB-AS-AP - CORENET CLOUD SDN. BHD.
    Domain
    fdomc.com
    Registered
    2026-05-28 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 07:58 UTC

    Suggest a correction

  85. h8.fdomc.com MY · AS154321 · CORENET CLOUD SDN. BHD.
    ListedUnder fdomc.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    h8.fdomc.com
    First seen
    2026-11-09 22:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask, listing fdomc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 21:49 UTC to 2027-02-07 21:49 UTC
    Logged 2026-11-09 22:47 UTC in Let's Encrypt Sycamore2027h1, entry 1,100,905,261
    SHA-256 4ba8643b4df410ebbbc135e0528e9d1a6f2428bd33512565022fe16a262e3fc6
    Public key SHA-256 e1c16b3d95394f22e3c2d50f7d42cd52777914a6a2c7f668b39297a2dc7a3e3b
    Addresses
    156.239.14.5 · Malaysia · AS154321 CCSB-AS-AP - CORENET CLOUD SDN. BHD.
    Domain
    fdomc.com
    Registered
    2026-05-28 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 07:58 UTC

    Suggest a correction

  86. randnvdtv.space US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    randnvdtv.space
    First seen
    2026-11-09 22:51 UTC
    Listing
    USOM listed it 2026-05-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 22:14 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 21:50 UTC to 2027-02-07 21:50 UTC
    Logged 2026-11-09 22:48 UTC in Google PlumbersArms2027h1, entry 707,136,432
    SHA-256 6790a2dbd7ee22a1dfdfb1decb0c347fd45bcfc402cea22a8f1ecac6e994d48d
    Public key SHA-256 69def7d322efa0621fb3d8e8a09fd96cb7fb2181954a9188de5a2951fc90cd3f
    Addresses
    104.21.90.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.90.250, 172.67.163.90): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    randnvdtv.space
    Registered
    2026-05-16 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  87. traefik.ethereum.vc US · AS31898 · Oracle CorporationEthereum
    ReportedPhishing hostOracle CloudReported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    traefik.ethereum.vc
    First seen
    2026-11-09 22:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 129.213.114.242.
    1. Phishing-host list fetched with the address
    2. Resolved to 129.213.114.242
    Certificate
    Issued by YR1
    Valid 2026-11-09 21:51 UTC to 2027-02-07 21:51 UTC
    Logged 2026-11-09 22:50 UTC in Google ParcelYard2027h1, entry 706,878,311
    SHA-256 88b88a82ebdd02a84645aa503f60c088bf6aadb41a72d3a14ee63316495482bd
    Public key SHA-256 fb0c61f0c1dc2455d42375cdec088a2460df6a6a58b9e6a0661b3c5e4a8e9fad
    PhishDestroy
    Brand
    Ethereum
    Addresses
    129.213.114.242 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (129.213.114.242): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ethereum.vc
    Registered
    2014-05-07 · Name.com, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 11:18 UTC

    Suggest a correction

  88. uae-dubai-chamber-payment.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    uae-dubai-chamber-payment.com
    First seen
    2026-11-09 22:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-11 18:20 UTC to 2026-12-10 19:19 UTC
    Logged 2026-11-09 22:49 UTC in DigiCert Wyvern2026h2, entry 2,215,166,158
    SHA-256 b784a6c0ab28212cf41ac398eb5f966257b7325c00e8b8b92863b963eac0e515
    Public key SHA-256 769b2a1eb85deaa1934679ab8543655df41acdd018da55aad96ae0049a288784
    PhishDestroy
    Addresses
    104.21.87.33 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.24 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.87.33, 172.67.140.24): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    uae-dubai-chamber-payment.com
    Registered
    2026-07-14 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  89. gg-drop.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    gg-drop.org
    First seen
    2026-11-09 22:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 21:42 UTC to 2027-02-07 21:42 UTC
    Logged 2026-11-09 22:40 UTC in Let's Encrypt Willow2027h1, entry 1,056,015,973
    SHA-256 3eb14e2db3510b32b5e7ab8c5ccd39cd8cff60f2b56317988dc83eb848f42b83
    Public key SHA-256 83051e428b21562d905101ea605ffd495e25f873a2d87d50c163b03df9c87e06
    PhishDestroy
    Addresses
    104.21.89.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.157.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.89.90, 172.67.157.101): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gg-drop.org
    Registered
    2026-03-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  90. ortusfintrade.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ortusfintrade.com
    First seen
    2026-11-09 22:46 UTC
    Listing
    CERT Polska listed it 2026-09-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 21:40 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 21:45 UTC to 2027-02-07 21:45 UTC
    Logged 2026-11-09 22:43 UTC in Let's Encrypt Sycamore2027h1, entry 1,100,797,422
    SHA-256 1c83b219f5706587fcfc0513cf593ec8fca8eb6da07d8f58906075bae3ef1eca
    Public key SHA-256 5a9229dec4d04aa99c40b7a74050a3e599b3566e915be0e8427b5358e62ccc54
    Addresses
    104.21.63.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.150.98 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.63.214, 172.67.150.98): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ortusfintrade.com
    Registered
    2026-07-16 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  91. radiorsj.be DK · AS51468 · ONECOM One.com A/S2 addresses
    ReportedReported by PhishTankMX presentSPF missingDMARC policy none
    DetailsHide
    Hostname
    radiorsj.be
    First seen
    2026-11-09 22:46 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 22:17 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 21:45 UTC to 2027-02-07 21:45 UTC
    Logged 2026-11-09 22:43 UTC in Let's Encrypt Sycamore2027h1, entry 1,100,790,389
    SHA-256 460af63c459365d747ba40ffee9f547fad9307959a861ff2d6dbdf70a251f3ce
    Public key SHA-256 fa0a4644b803cb654c2feafa7dc524195d63ab263e5bc019e21a287174b5508e
    PhishTank
    PhishTank report #9458674
    Addresses
    77.111.240.141 · Denmark · AS51468 ONECOM One.com A/S
    2a02:2350:5:102:6d:f698:b865:90cb
    Domain
    radiorsj.be
    MX
    Receives mail at mx1.pub.mailpod11-cph3.one.com, mx2.pub.mailpod11-cph3.one.com, mx3.pub.mailpod11-cph3.one.com
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 22:47 UTC

    Suggest a correction

  92. rainbet-eu-de.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    rainbet-eu-de.pages.dev
    First seen
    2026-11-09 22:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 21:44 UTC to 2027-02-07 22:42 UTC
    Logged 2026-11-09 22:44 UTC in DigiCert Wyvern2027h1, entry 474,490,200
    SHA-256 feb1fd3ecd813f5497f053580f654a9deac72711b70a2658683460541a912238
    Public key SHA-256 c3dd237e560b4251a0c372d8619a6b6040bb5e80ddf5f0888b3bbe85da6c3116
    Addresses
    172.66.44.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.171 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.85, 172.66.47.171): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  93. testdomain9292.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    testdomain9292.com
    First seen
    2026-11-09 22:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 21:45 UTC to 2027-02-07 21:45 UTC
    Logged 2026-11-09 22:44 UTC in DigiCert Sphinx2027h1, entry 420,300,066
    SHA-256 a287eb689fddd02a40ccd6f913d2a6bc6e50aad63219ebf97cbef25d6810e5a3
    Public key SHA-256 de1f14692dfbe70451d02ac10238b377b20e46eee986c814f38ea004b72e1493
    Addresses
    104.21.52.227 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.55 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.52.227, 172.67.205.55): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    testdomain9292.com
    Registered
    2026-05-16 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 22:47 UTC

    Suggest a correction

  94. www.xtb.cresterbridge.com US · AS32561 · Aquiryn LLC
    ReportedUnder cresterbridge.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 8 mo ago
    DetailsHide
    Hostname
    www.xtb.cresterbridge.com
    First seen
    2026-11-09 22:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy, listing cresterbridge.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-09 21:46 UTC to 2027-02-07 21:46 UTC
    Logged 2026-11-09 22:44 UTC in Google ParcelYard2027h1, entry 706,815,184
    SHA-256 7feea62d0dcf868ae08e6c6ea6a876802ee31774f1ebeac4b69d0828a532b0be
    Public key SHA-256 3aa252ddcab53e5f11aa6cd1e909b7327ef0543df17502f96e30ed731ffdeafe
    PhishDestroy
    Addresses
    23.153.104.17 · United States · AS32561 AQUIRYN-LLC - Aquiryn LLC
    Domain
    cresterbridge.com
    Registered
    2026-03-21 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Receives mail at cresterbridge.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  95. 4823848-coinbase.com US · AS13335 · Cloudflare, Inc.4 addressesCoinbase
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    4823848-coinbase.com
    First seen
    2026-11-09 22:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 21:39 UTC to 2027-02-07 22:37 UTC
    Logged 2026-11-09 22:39 UTC in DigiCert Wyvern2027h1, entry 474,422,441
    SHA-256 489d196a57366c0b7ffad9c77c23d08330f32476139fcec6ffa50ca324986917
    Public key SHA-256 6101f81827c665880a5be9448e45b135b4726cd5bbb1263e3bee4b8c9915b954
    PhishDestroy
    Brand
    Coinbase
    Addresses
    104.21.48.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:b70a
    2606:4700:3035::6815:3059
    Cloudflare
    Cloudflare (104.21.48.89, 172.67.183.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    4823848-coinbase.com
    Registered
    2025-11-20 · Hello Internet Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 22:42 UTC

    Suggest a correction

  96. cdn.choicely.com US · AS396982 · Google LLC2 addressesIRS
    ReportedGoogle CloudReported by PhishTank as imitating Internal Revenue ServiceMX presentSPF ~allDMARC quarantineRegistered 21 y ago
    DetailsHide
    Hostname
    cdn.choicely.com
    First seen
    2026-11-09 22:41 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 22:17 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-09 21:37 UTC to 2027-02-07 22:31 UTC
    Logged 2026-11-09 22:37 UTC in Geomys Tuscolo2027h1, entry 551,440,581
    SHA-256 1fb60e1eef76654b13a8571691bbc59f8fa5914131929eddabfa229ea506ba10
    Public key SHA-256 fde45243b01f3be5b9fdf7f2d5b7f52a1250117053b7a58c5d7d8a756e22913e
    PhishTank
    PhishTank report #9138873
    Brand
    IRS
    Addresses
    34.120.45.128 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    35.190.81.147 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.120.45.128, 35.190.81.147): a cloud provider. It rents servers and addresses to its customers.
    Domain
    choicely.com
    Registered
    2005-10-15 · eNom, LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  97. curaenatura.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishTankMX presentSPF ~allDMARC policy noneRegistered 12 y ago
    DetailsHide
    Hostname
    curaenatura.com
    First seen
    2026-11-09 22:41 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 22:17 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 21:39 UTC to 2027-02-07 21:39 UTC
    Logged 2026-11-09 22:37 UTC in Let's Encrypt Sycamore2027h1, entry 1,100,607,648
    SHA-256 7ca1210d5cd965f94075b127c98f1da1375e16a55e8e13dd05d94ef004a92d7f
    Public key SHA-256 5998071384fdf19a83fe1396b2b65f240c332ec85e4a4e780ed2e8665dfc45f8
    PhishTank
    PhishTank report #7987743
    Addresses
    104.21.96.37 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.96.37, 172.67.172.67): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    curaenatura.com
    Registered
    2015-03-20 · eNom, LLC
    MX
    Receives mail at mail.curaenatura.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  98. maritsabeauty.co.uk
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    maritsabeauty.co.uk
    First seen
    2026-11-09 22:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-09 18:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 21:38 UTC to 2027-02-07 21:38 UTC
    Logged 2026-11-09 22:37 UTC in Let's Encrypt Willow2027h1, entry 1,055,911,200
    SHA-256 351d4440f02ddcd3fe45daa4c728c9cb06f50a0ae9a9c40a84633aba091da254
    Public key SHA-256 8cc98bc7c7315767709b253bc9194b6258efe2f40b256857cf918d03f5fd983b
    PhishDestroy
    Domain
    maritsabeauty.co.uk
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 22:42 UTC

    Suggest a correction

  99. net-hook.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    net-hook.com
    First seen
    2026-11-09 22:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 21:38 UTC to 2027-02-07 22:36 UTC
    Logged 2026-11-09 22:38 UTC in Geomys Tuscolo2027h1, entry 551,446,728
    SHA-256 cdbd5e281685a4f96d7a6f23ee68923f82ad60d7ff6325a1efc65e3139b2eea9
    Public key SHA-256 aea8bf22932c52f9f119f0221351952a44d503c54cf8ff24a483640f1c9c7557
    Addresses
    104.21.38.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.38.38, 172.67.218.193): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    net-hook.com
    Registered
    2026-09-09 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

  100. rarefriends.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    rarefriends.xyz
    First seen
    2026-11-09 22:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-09 18:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 21:40 UTC to 2027-02-07 21:40 UTC
    Logged 2026-11-09 22:39 UTC in Let's Encrypt Willow2027h1, entry 1,055,973,679
    SHA-256 412ebef4661fb3d44cf74585b884c01d6fb9897971157bd45d9edefe9c0fa978
    Public key SHA-256 880bf9eff5d3d2d34389fefd4bbc2deda658db0f1085fb8ea744906f169c20b7
    Addresses
    104.21.4.21 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.4.21, 172.67.131.142): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rarefriends.xyz
    Registered
    2026-09-11 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 23:37 UTC

    Suggest a correction

Showing 1–100 of 6,694 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources