Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-10 06:24 UTC
Certificate-log entries · 24 h
406.6M
from 84 distinct feeds
Unique certificates · 24 h
37.3M
each reviewed
Names resolved · 24 h
23.0M
17.1M with an address
Findings · 24 h
6,971
248 of 1,061 brands targeted

5,725 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. amhkkh.infoVisa
    ListedListed by JPCERT/CC as imitating VISAMX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    amhkkh.info
    First seen
    2026-11-10 06:21 UTC
    Listing
    JPCERT/CC confirmed it 2026-09-04 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 02:13 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-10 05:17 UTC to 2027-02-08 05:17 UTC
    Logged 2026-11-10 06:16 UTC in Google ParcelYard2027h1, entry 712,525,349
    SHA-256 53ab2e1c00c8cc456835e721f46a2f7d670e1d21bad89475316fece9684ff999
    Public key SHA-256 f2dda6930bbaab0d137aa8a3c5086f9c53e1e55da3ad87db60b0eefb0a0de544
    Brand
    Visa
    Domain
    amhkkh.info
    Registered
    2025-11-18 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Receives mail at route2.mx.cloudflare.net, route3.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  2. api-testnet.flipt.fun US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder flipt.fun, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    api-testnet.flipt.fun
    First seen
    2026-11-10 06:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing flipt.fun and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:20 UTC to 2027-02-08 06:19 UTC
    Logged 2026-11-10 06:20 UTC in Google PlumbersArms2027h1, entry 712,837,337
    SHA-256 4baee4f6aa0a7af3c6e27ba2d099fb1a49ad9b890a721cb5152ab66037122203
    Public key SHA-256 07ebd7a0e1625bd68a377a6543476ba85ac0af85b05ae89ecdd94c1737898ce0
    PhishDestroy
    Addresses
    104.21.82.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.82.94, 172.67.199.224): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    flipt.fun
    Registered
    2026-08-25 · Cloudflare, Inc.
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 08:14 UTC

    Suggest a correction

  3. desktop-ledgeer-io.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    desktop-ledgeer-io.pages.dev
    First seen
    2026-11-10 06:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:16 UTC to 2027-02-08 06:14 UTC
    Logged 2026-11-10 06:16 UTC in Google PlumbersArms2027h1, entry 712,781,668
    SHA-256 59efba91cb549689058589280799f63502d11f7dd386fc7d47151b17c388b1a2
    Public key SHA-256 7e716e44aa72ba0ad91c73ea2fc37bd0481694b3143d78ac99774dfa1c9bb58f
    Addresses
    172.66.44.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.43 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.213, 172.66.47.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  4. egress-mikey.ostrovsky.sk FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ostrovsky.sk, listed by MetaMaskMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    egress-mikey.ostrovsky.sk
    First seen
    2026-11-10 06:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing ostrovsky.sk and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-10 05:16 UTC to 2027-02-08 05:16 UTC
    Logged 2026-11-10 06:15 UTC in Google PlumbersArms2027h1, entry 712,772,556
    SHA-256 610ea25789e49842416224917dac4c95af126cd3fe64086b7f27142eb5d716a1
    Public key SHA-256 8a5646152214daf3032a0533767101541d85bc8729db0fc58aab80c02175725d
    Addresses
    54.37.46.74 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (54.37.46.74): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ostrovsky.sk
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 03:42 UTC

    Suggest a correction

  5. ghufran.ezgateway.net TR · AS9215 · vmind Vmind Bilgi Teknoloji…
    ListedUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    ghufran.ezgateway.net
    First seen
    2026-11-10 06:21 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-10 05:20 UTC to 2027-02-08 05:20 UTC
    Logged 2026-11-10 06:19 UTC in Google ParcelYard2027h1, entry 712,564,984
    SHA-256 04ab0e348aca60c04408bf3202d4399de7b2b343651023d0a8f477fb17932e66
    Public key SHA-256 5df3ded0794d456d62fb87974a0e2ffac4a09582d8c885011a8f78adf074f75b
    Addresses
    43.229.92.234 · Türkiye · AS9215 vmind Vmind Bilgi Teknolojileri Anonim Sirketi
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  6. grapehardwarejourney.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    grapehardwarejourney.com
    First seen
    2026-11-10 06:21 UTC
    Listing
    USOM listed it 2026-06-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-10 05:18 UTC to 2027-02-08 05:18 UTC
    Logged 2026-11-10 06:16 UTC in Let's Encrypt Willow2027h1, entry 1,067,956,055
    SHA-256 14d2a124fbceb211b93c37ad47efce283f50acc8491e9db35422753e46e0337b
    Public key SHA-256 51be7c09de06431edf75f8252d8b51869aa3c1f24cd2aa02c3d7bac3852c8f76
    Addresses
    104.21.67.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.67.248, 172.67.183.49): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    grapehardwarejourney.com
    Registered
    2026-06-04 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  7. happymod.net.co US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    happymod.net.co
    First seen
    2026-11-10 06:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:17 UTC to 2027-02-08 06:16 UTC
    Logged 2026-11-10 06:17 UTC in Google ParcelYard2027h1, entry 712,542,908
    SHA-256 988975a73ed2c7b95e67c46f34311dda37a8ae5595577596bc6855f57c2294be
    Public key SHA-256 f71f534137838321e91d201f2cd007db7be9af9b121d39b402327c149c9f0ade
    PhishDestroy
    Addresses
    104.21.73.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.189.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.73.91, 172.67.189.86): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    happymod.net.co
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  8. ledgr-strt-eab.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledgr-strt-eab.pages.dev
    First seen
    2026-11-10 06:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:19 UTC to 2027-02-08 06:15 UTC
    Logged 2026-11-10 06:19 UTC in Geomys Tuscolo2027h1, entry 557,118,405
    SHA-256 d5517ad974656308a1434e5bedc0c9323f169f573ee6e9d6e0b40627e89ae359
    Public key SHA-256 f92ed5907b6ff7f75f271c4b58a384a64a1bead010659c4a104ff096d76d107c
    Addresses
    172.66.44.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.138, 172.66.47.118): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  9. ledgrrlive.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledgrrlive.pages.dev
    First seen
    2026-11-10 06:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-10 06:10 UTC to 2027-02-08 06:18 UTC
    Logged 2026-11-10 06:20 UTC in DigiCert Sphinx2027h1, entry 424,494,957
    SHA-256 8ad2978f128e1602dcd3a6bdb25ec5399e6787fb06a4c5fcc3bbacd99bf13a0b
    Public key SHA-256 00f123197eb867e59da55fe19394719ed4deafeb3d3366a94f0e7d6ac4cb5889
    Addresses
    172.66.45.36 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.220 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.45.36, 172.66.46.220): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  10. rainbets.ca AU · AS133618 · Trellian Pty. Limited
    ListedParking page · Trellian / Above.comListed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    rainbets.ca
    First seen
    2026-11-10 06:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-10 05:17 UTC to 2027-02-08 05:17 UTC
    Logged 2026-11-10 06:16 UTC in Google ParcelYard2027h1, entry 712,524,598
    SHA-256 a21e0c8949de1ab094a1a58b987046dc07dd6ef7775ee3c9c8af6bded626bae3
    Public key SHA-256 aa5fea6df5501eaef1f016acb02147673a020e9d52b666b271b214982e6a215a
    Addresses
    103.224.212.142 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Trellian / Above.com
    Trellian / Above.com (103.224.212.142): a parking service. It answers for names that are typically for sale or unused.
    Domain
    rainbets.ca
    Registered
    2025-11-09 · 8648255 CANADA LTD. O/A Dynadot LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  11. skinamy.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    skinamy.net
    First seen
    2026-11-10 06:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:15 UTC to 2027-02-08 06:14 UTC
    Logged 2026-11-10 06:15 UTC in Geomys Tuscolo2027h1, entry 557,075,682
    SHA-256 3f1f0c94864bf7377230d09eafd37cf064b1719b8db494c336b77528c638acb4
    Public key SHA-256 a521117897a254dfad402972eb35eaa23b705559f78ff939f31926d5fa6b29dd
    PhishDestroy
    Addresses
    104.21.10.65 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.65, 172.67.144.184): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    skinamy.net
    Registered
    2025-11-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  12. telegramkfc.com HK · AS138995 · Antbox Networks Limited
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    telegramkfc.com
    First seen
    2026-11-10 06:21 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-08 (14 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-09 13:33 UTC to 2027-01-07 13:33 UTC
    Logged 2026-11-10 06:16 UTC in DigiCert Wyvern2027h1, entry 479,111,690
    SHA-256 a68f4e03cd5783c7db5059ce161698ed29e3cf1049972aa01068810d3beb8c19
    Public key SHA-256 b30d23b1def463db6575168c774f8e4878e45c592cdace03653fcf9d43caa8df
    PhishDestroy
    Addresses
    45.192.226.25 · Hong Kong · AS138995 ANTBOX1-AS-AP - Antbox Networks Limited
    Domain
    telegramkfc.com
    Registered
    2025-07-17 · P.A. Viet Nam Company Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  13. tererswjzk.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    tererswjzk.shop
    First seen
    2026-11-10 06:21 UTC
    Listing
    CERT Polska listed it 2026-06-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 03:41 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:17 UTC to 2027-02-08 06:15 UTC
    Logged 2026-11-10 06:17 UTC in Geomys Tuscolo2027h1, entry 557,099,803
    SHA-256 c4cc3f040d612427c1dee58fa601162307100d29aa41682494db5060e21bd35a
    Public key SHA-256 d67236ee75fcb2310addf093643733c27d249f0ba9ad6db132454711354823bb
    Addresses
    104.21.35.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.231 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.49, 172.67.213.231): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tererswjzk.shop
    Registered
    2026-04-11 · Chengdu West Dimension Digital Technology Co., LTD
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  14. www.telegramkfc.com HK · AS138995 · Antbox Networks Limited
    ReportedUnder telegramkfc.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    www.telegramkfc.com
    First seen
    2026-11-10 06:21 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-08 (14 days)
    Reported
    PhishDestroy, listing telegramkfc.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-09 13:33 UTC to 2027-01-07 13:33 UTC
    Logged 2026-11-10 06:16 UTC in DigiCert Wyvern2027h1, entry 479,111,690
    SHA-256 a68f4e03cd5783c7db5059ce161698ed29e3cf1049972aa01068810d3beb8c19
    Public key SHA-256 b30d23b1def463db6575168c774f8e4878e45c592cdace03653fcf9d43caa8df
    PhishDestroy
    Addresses
    45.192.226.25 · Hong Kong · AS138995 ANTBOX1-AS-AP - Antbox Networks Limited
    Domain
    telegramkfc.com
    Registered
    2025-07-17 · P.A. Viet Nam Company Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  15. zelawow.eu.cc CN · AS132203 · Tencent Building, Kejizhong…
    ListedTencent CloudListed by NPA 165 (finance and insurance)
    DetailsHide
    Hostname
    zelawow.eu.cc
    First seen
    2026-11-10 06:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-10 05:18 UTC to 2027-02-08 05:18 UTC
    Logged 2026-11-10 06:16 UTC in Let's Encrypt Willow2027h1, entry 1,067,953,187
    SHA-256 57f828292e177f4c0cae11022cfef7822f6bcfb74001deb6d834b756f8e5fb04
    Public key SHA-256 060c54bb4e49c9765d1a14a21b668e4f732f322094fd700b4880dc200663da44
    Addresses
    43.162.216.222 · China · AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue · Tencent Cloud (cloud provider)
    Tencent Cloud
    Tencent Cloud (43.162.216.222): a cloud provider. It rents servers and addresses to its customers.

    Suggest a correction

  16. 365desire.com US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    365desire.com
    First seen
    2026-11-10 06:15 UTC
    Listing
    CERT Polska listed it 2026-07-28 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 03:41 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-10 06:10 UTC to 2027-05-27 06:10 UTC
    Logged 2026-11-10 06:10 UTC in Google Argon2027h1, entry 960,062,944
    SHA-256 2ac34c672cb328e331e119206669f0c32386c4e20b546af790cacad1b5c11ca7
    Public key SHA-256 6dfaf1edb9d3f77a715072e7732c7334c6e6d516fe80db48b5c371a927c1e6fa
    Addresses
    52.223.13.41 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (52.223.13.41): a cloud provider. It rents servers and addresses to its customers.
    Domain
    365desire.com
    Registered
    2025-11-06 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 05:47 UTC

    Suggest a correction

  17. api.ebcidn.com US · AS13335 · Cloudflare, Inc.3 addresses
    ReportedCloudflareUnder ebcidn.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    api.ebcidn.com
    First seen
    2026-11-10 06:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing ebcidn.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-10 06:03 UTC to 2027-02-08 06:12 UTC
    Logged 2026-11-10 06:13 UTC in DigiCert Sphinx2027h1, entry 424,425,715
    SHA-256 1625e851fc4a38b1cb34f637de70b44d41eb21fd9122ce3d38c362c9d6eaa8de
    Public key SHA-256 ee6dadaac27d467dba0c1ce93a673ee9b0c00b5a8dd7641076049c23cba83b8d
    PhishDestroy
    Addresses
    104.26.2.45 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.26.3.45 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.75.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.26.2.45, 104.26.3.45, 172.67.75.48): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ebcidn.com
    Registered
    2025-10-31 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:19 UTC

    Suggest a correction

  18. autodiscover.flashblock.trade US · AS965 · Webhosting Holdings LLC
    ReportedUnder flashblock.trade, reported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 19 mo ago
    DetailsHide
    Hostname
    autodiscover.flashblock.trade
    First seen
    2026-11-10 06:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing flashblock.trade and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-10 05:13 UTC to 2027-02-08 05:13 UTC
    Logged 2026-11-10 06:12 UTC in DigiCert Sphinx2027h1, entry 424,413,943
    SHA-256 72d2e9ac64c6a0d112ac1a980e61949de65d62233c75a157daeb3de2447ecc2a
    Public key SHA-256 b10aa077b7e290d3f9d4e449ee08c6b7fb241a90e47c47ef80defcf0b70eb904
    PhishDestroy
    Addresses
    193.108.130.81 · United States · AS965 WEBHOSTINGHOLDINGS - Webhosting Holdings LLC
    Domain
    flashblock.trade
    Registered
    2025-04-16 · Spaceship, Inc.
    MX
    Receives mail at eu1.workspace.org
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  19. betspin.pro AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    betspin.pro
    First seen
    2026-11-10 06:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-10 05:14 UTC to 2027-02-08 05:14 UTC
    Logged 2026-11-10 06:12 UTC in Google PlumbersArms2027h1, entry 712,730,493
    SHA-256 72620d3f995686c76838a66a30e6b74bf332948e550eb18289e9849ec39afc1f
    Public key SHA-256 0f3d4ba98afc15196073f7bfb2c2f3850cca76c6982de2703edff646e80a38e9
    PhishDestroy
    Addresses
    103.224.182.213 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates betspin.pro to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.213): a parking service. It answers for names that are typically for sale or unused.
    Domain
    betspin.pro
    Registered
    2026-08-28 · CommuniGal Communication Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  20. coomnena.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    coomnena.shop
    First seen
    2026-11-10 06:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-12 03:50 UTC to 2026-12-11 04:49 UTC
    Logged 2026-11-10 06:13 UTC in DigiCert Wyvern2026h2, entry 2,215,902,285
    SHA-256 2e1f0e3c9d3fa0bbda54011ceb6aa94504aa3be1ef1c3cad08e4c91c858c191d
    Public key SHA-256 5fa70c1b10aa16676c12cb6ce76ba59b176b07ead0d781f2fff72514ae06c4fc
    Addresses
    104.21.60.185 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.240 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.60.185, 172.67.199.240): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    coomnena.shop
    Registered
    2026-07-15 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  21. film2movie.us NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    film2movie.us
    First seen
    2026-11-10 06:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-10 05:11 UTC to 2027-02-08 05:11 UTC
    Logged 2026-11-10 06:10 UTC in Let's Encrypt Willow2027h1, entry 1,067,769,725
    SHA-256 b95882c1437ef642626f78be31f8d7bff03c22d13ee485ff1df395870273ef44
    Public key SHA-256 d81b42f43676b3801b60f120ddb33be931adf0077b10243648f81af2817f71ae
    PhishDestroy
    Addresses
    5.79.75.212 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    film2movie.us
    Registered
    2020-07-12 · Dynadot5 LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  22. firelightprose.app
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    firelightprose.app
    First seen
    2026-11-10 06:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:15 UTC to 2027-02-08 06:12 UTC
    Logged 2026-11-10 06:15 UTC in DigiCert Sphinx2027h1, entry 424,447,415
    SHA-256 528d3e7b0c192346d7ceb33ccaff04d7e90b9a438d1e00efefeb173e9a0ea927
    Public key SHA-256 73ba54e60a76e50eeafffb7d955c3b637b5e5f40f016c390d0371b134a668b7d
    Domain
    firelightprose.app
    Registered
    2026-07-15 · CloudFlare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  23. mail.flashblock.trade US · AS965 · Webhosting Holdings LLC
    ReportedUnder flashblock.trade, reported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 19 mo ago
    DetailsHide
    Hostname
    mail.flashblock.trade
    First seen
    2026-11-10 06:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing flashblock.trade and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-10 05:13 UTC to 2027-02-08 05:13 UTC
    Logged 2026-11-10 06:12 UTC in DigiCert Wyvern2027h1, entry 479,060,211
    SHA-256 2731cc9cb3422d1cfba09ae2ecaf0ea685264819b87e4b11e265241e4afe912c
    Public key SHA-256 bb324280a4704c12cb3c438f1a3241a46219a5285ac9d2a32a3f8ad563fc22d4
    PhishDestroy
    Addresses
    193.108.130.81 · United States · AS965 WEBHOSTINGHOLDINGS - Webhosting Holdings LLC
    Domain
    flashblock.trade
    Registered
    2025-04-16 · Spaceship, Inc.
    MX
    Receives mail at eu1.workspace.org
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  24. onlyfancoin.ascsonoway.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder ascsonoway.com, listed by MetaMaskMX presentSPF -allDMARC quarantineRegistered 17 mo ago
    DetailsHide
    Hostname
    onlyfancoin.ascsonoway.com
    First seen
    2026-11-10 06:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing ascsonoway.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-10 05:15 UTC to 2027-02-08 05:15 UTC
    Logged 2026-11-10 06:13 UTC in Let's Encrypt Sycamore2027h1, entry 1,112,770,786
    SHA-256 70257369073b91f53db051f380aedd7e260227226fe3bfe961f15df70946b9bb
    Public key SHA-256 6b9f05b1caa480e670fbc5ec2c3adc2a31b9609a0434d2bed5024b5939301663
    Addresses
    104.21.47.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.253 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.88, 172.67.145.253): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ascsonoway.com
    Registered
    2025-06-15 · Cloudflare, Inc.
    MX
    Receives mail at route1.mx.cloudflare.net, route3.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-09 06:52 UTC

    Suggest a correction

  25. parys.affenzahn.help US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder affenzahn.help, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    parys.affenzahn.help
    First seen
    2026-11-10 06:15 UTC
    Listing
    CERT Polska listed it 2026-09-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 03:41 UTC
    Listed
    CERT Polska, listing affenzahn.help and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:14 UTC to 2027-02-08 06:14 UTC
    Logged 2026-11-10 06:14 UTC in Let's Encrypt Willow2027h1, entry 1,067,898,240
    SHA-256 4194876a7bcbe3f73122d8b26dd8f1eb2408eb582f8a8c638b094e9437ec29ca
    Public key SHA-256 3f627f9d08d5f25974bc61da97757dee48b77f2bd6c4787f8b832b5ec039783e
    Addresses
    104.21.2.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.129.240 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.2.249, 172.67.129.240): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    affenzahn.help
    Registered
    2025-12-25 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 03:27 UTC

    Suggest a correction

  26. steakhousefi.events US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    steakhousefi.events
    First seen
    2026-11-10 06:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-12 03:55 UTC to 2026-12-11 04:55 UTC
    Logged 2026-11-10 06:11 UTC in DigiCert Wyvern2026h2, entry 2,215,898,120
    SHA-256 702142a4b7fa3b7721c1beee308089b07948271113c4ef4ed6ba3d84497d8c9b
    Public key SHA-256 4fce62300651148c4165b9250264ad747b941de077a75b33c2731e9f79ed27bf
    Addresses
    104.21.77.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.77.66, 172.67.205.35): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    steakhousefi.events
    Registered
    2026-07-15 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  27. tobemon.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    tobemon.shop
    First seen
    2026-11-10 06:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:12 UTC to 2027-02-08 06:10 UTC
    Logged 2026-11-10 06:12 UTC in IPng Networks Halloumi2027h1, entry 437,440,784
    SHA-256 35f86dff8b55e27c8d836a611a858f7f682c86b74525f74ffd9a869592253c6c
    Public key SHA-256 8833d29c22259ab93e7562257a979b623bf21d989327d6e19fd612afbb2f3aa3
    Addresses
    104.21.8.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.109 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.8.107, 172.67.188.109): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    tobemon.shop
    Registered
    2026-07-15 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  28. tracking.highstreetpharma.net FR · AS16276 · OVH OVH SAS
    ReportedOVHUnder highstreetpharma.net, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 24 mo ago
    DetailsHide
    Hostname
    tracking.highstreetpharma.net
    First seen
    2026-11-10 06:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing highstreetpharma.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-10 05:15 UTC to 2027-02-08 05:15 UTC
    Logged 2026-11-10 06:13 UTC in Google PlumbersArms2027h1, entry 712,747,376
    SHA-256 3216f446c0f523471ad40fa6994216d715343eba83436cec81892d4ab350996a
    Public key SHA-256 3e218232d1943101afec337db7e0d2b4c7ba7306f9b19873e13e127f4e6085b8
    PhishDestroy
    Addresses
    51.254.13.185 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.254.13.185): a cloud provider. It rents servers and addresses to its customers.
    Domain
    highstreetpharma.net
    Registered
    2024-11-20 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Receives mail at _dc-mx.52a7e6ab1435.highstreetpharma.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-09 08:29 UTC

    Suggest a correction

  29. unreafrei.cyou
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    unreafrei.cyou
    First seen
    2026-11-10 06:15 UTC
    Listing
    CERT Polska listed it 2026-05-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 03:41 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-10 05:16 UTC to 2027-02-08 05:16 UTC
    Logged 2026-11-10 06:15 UTC in Google ParcelYard2027h1, entry 712,506,764
    SHA-256 4d8570011d18bb0f631e3b1ea763314d295f02351fb4a959b63a3a956c744a8d
    Public key SHA-256 45b3deddad6c76612b1e1d404b5386c949070e0c20754a8493a7ca80014b027b
    Domain
    unreafrei.cyou
    Registered
    2026-05-17 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  30. weemounb.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    weemounb.shop
    First seen
    2026-11-10 06:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:12 UTC to 2027-02-08 06:11 UTC
    Logged 2026-11-10 06:12 UTC in IPng Networks Halloumi2027h1, entry 437,441,191
    SHA-256 22aeb4d77c029ad073561cba94cc5d366b9c14ce52f2f219e213e3a09f38e72e
    Public key SHA-256 ac5244c4eebefddb969147351e299160f3b274295584d8c9f71386a0b5fdbd58
    Addresses
    104.21.61.241 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.36 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.61.241, 172.67.217.36): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    weemounb.shop
    Registered
    2026-07-15 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  31. www.arbitrium.legal US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder arbitrium.legal, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    www.arbitrium.legal
    First seen
    2026-11-10 06:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing arbitrium.legal and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-10 05:16 UTC to 2027-02-08 05:16 UTC
    Logged 2026-11-10 06:14 UTC in Google PlumbersArms2027h1, entry 712,764,118
    SHA-256 2ccabfb171c22056a69f513edc080685c3f86069fc40d24440854815d8dd74ac
    Public key SHA-256 fbed0dd4a67e6e599d38546014f5283686ca77f6aa02b0ca08ffe51c87d6f888
    PhishDestroy
    Addresses
    216.150.1.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.193, 216.150.16.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    arbitrium.legal
    Registered
    2026-09-07 · INWX GmbH
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-10 06:19 UTC

    Suggest a correction

  32. www.coin-strike-demo.co US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder coin-strike-demo.co, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.coin-strike-demo.co
    First seen
    2026-11-10 06:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Listed
    MetaMask, listing coin-strike-demo.co and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:13 UTC to 2027-02-08 06:13 UTC
    Logged 2026-11-10 06:13 UTC in Geomys Tuscolo2027h1, entry 557,051,510
    SHA-256 54c0418ca0dd6b1ca964fff8eed66ec3a73bc95aa1939b8b92df811df146a236
    Public key SHA-256 a5de108e247e7c4d63f2e3b64eff3ded9bad3c7b9919dd120a7599864c6408ef
    Addresses
    104.21.17.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.222.252 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.17.62, 172.67.222.252): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    coin-strike-demo.co
    Registered
    2026-05-16 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:12 UTC

    Suggest a correction

  33. www.discord.locketheart.org GB · AS14670 · WHG-USE1 WHG Hosting Servic…
    ReportedUnder locketheart.org, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 19 y ago
    DetailsHide
    Hostname
    www.discord.locketheart.org
    First seen
    2026-11-10 06:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing locketheart.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-10 05:16 UTC to 2027-02-08 05:16 UTC
    Logged 2026-11-10 06:15 UTC in Google ParcelYard2027h1, entry 712,506,240
    SHA-256 4c7b68f17c68d0eb14c15dc502452d8228ee8c0a1e0feac33211a9d20e46cd45
    Public key SHA-256 afccd05d2a65d3f5ff26e191a9730722ae1cc7c0504cd2d50abc8f31ef473c76
    PhishDestroy
    Addresses
    192.243.110.19 · United Kingdom · AS14670 WHG-USE1 WHG Hosting Services Ltd
    Domain
    locketheart.org
    Registered
    2008-01-05 · NameCheap, Inc.
    MX
    Receives mail at locketheart.org
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 21:34 UTC

    Suggest a correction

  34. zfejhqw.monster US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    zfejhqw.monster
    First seen
    2026-11-10 06:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-10 05:10 UTC to 2027-02-08 06:09 UTC
    Logged 2026-11-10 06:10 UTC in Let's Encrypt Sycamore2027h1, entry 1,112,684,409
    SHA-256 0bb79a948cd0454591b923c7cb463cdf539138d29d845f21173dc23aa59bb4da
    Public key SHA-256 785e55f1b83d93300cd2e0399766372b9edf9eb28420474b21b9eb9b27fca986
    Addresses
    104.21.76.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.196.28 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.76.143, 172.67.196.28): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zfejhqw.monster
    Registered
    2026-09-10 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  35. 1l58174rl6p52f6r.elqsmaiy.qikgwrfz.csarxeio.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    1l58174rl6p52f6r.elqsmaiy.qikgwrfz.csarxeio.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:06 UTC in Let's Encrypt Sycamore2027h1, entry 1,112,551,338
    SHA-256 7256fe1430ed152082a4f3cdc0613b53bcc580bfa30f904cb6672d2d7c66eb75
    Public key SHA-256 8e12e9264119382c22a87532e6afc3052ea35707095260a823a21e6889755f2d
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  36. admin.meet-invaite.xyz CY · AS47583 · AS-HOSTINGER Hostinger Inte…2 addresses
    ListedHostinger CDNUnder meet-invaite.xyz, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    admin.meet-invaite.xyz
    First seen
    2026-11-10 06:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Listed
    MetaMask, listing meet-invaite.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-10 05:10 UTC to 2027-02-08 05:10 UTC
    Logged 2026-11-10 06:09 UTC in Google ParcelYard2027h1, entry 712,428,644
    SHA-256 545c318f284f76515b28d2d8bc889c1718d6df782caaf99fe03da03da24cbcd9
    Public key SHA-256 ea6524101fb97ed26f53a2d430967b967be7b7b2e7973c7d0ac3f3f2895b2a6a
    Addresses
    88.223.87.105 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger CDN (cdn)
    147.79.72.102 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger CDN (cdn)
    Hostinger CDN
    Hostinger CDN (88.223.87.105, 147.79.72.102): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    meet-invaite.xyz
    Registered
    2026-05-24 · TuringSign Inc. d/b/a Cosmotown
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  37. agpsdhom.fxmincjt.sfnwmtue.iuowfbke.wxeilrho.warhqnuy.ijdyvoge.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    agpsdhom.fxmincjt.sfnwmtue.iuowfbke.wxeilrho.warhqnuy.ijdyvoge.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in IPng Networks Gouda2027h1, entry 371,044,548
    SHA-256 b5dd0d67a9031d91c6bc5672150e4bf54be287951a9e93bf44e071c6167b67d3
    Public key SHA-256 68ed5c12e716a6959527be10cf29dddfa67adaf8f1418392798be5a1333186f4
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  38. app.cryptidsgame.io DE · AS8560 · IONOS-AS IONOS SE
    ReportedIONOSUnder cryptidsgame.io, reported by PhishDestroyMX presentSPF ~allDMARC quarantineRegistered 2 y ago
    DetailsHide
    Hostname
    app.cryptidsgame.io
    First seen
    2026-11-10 06:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing cryptidsgame.io and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-10 05:08 UTC to 2027-02-08 05:08 UTC
    Logged 2026-11-10 06:07 UTC in Google PlumbersArms2027h1, entry 712,662,784
    SHA-256 847176bae4a6dbb8f94533667052731355bbc4995af2e5e6e0b517ab27f399ee
    Public key SHA-256 03138b130e0d8038c7ba88397edf72e0afd05b78b3a9df250575839d05ca7917
    PhishDestroy
    Addresses
    77.68.81.169 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (77.68.81.169): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    cryptidsgame.io
    Registered
    2024-07-22 · NameCheap, Inc.
    MX
    Receives mail at mail.cryptidsgame.io
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  39. awhkpnib.shlyevmgt.clzvxqsn.tvykojwc.ipktmalu.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    awhkpnib.shlyevmgt.clzvxqsn.tvykojwc.ipktmalu.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in TrustAsia Luoshu2027, entry 601,058,914
    SHA-256 073ac270a54fdfad728cb5504186c917c26c2ca2ad2b1ed63d69327f70c395c4
    Public key SHA-256 8df709078fc9b277bf6df07133e2e69700903e706d475cd60b132f65f00bd949
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  40. crofttradstead-digital.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    crofttradstead-digital.pages.dev
    First seen
    2026-11-10 06:10 UTC
    Listing
    CERT Polska listed it 2026-09-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 03:41 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-10 05:10 UTC to 2027-02-08 05:10 UTC
    Logged 2026-11-10 06:08 UTC in Let's Encrypt Willow2027h1, entry 1,067,720,307
    SHA-256 3e9089283ce69ebdf9074da87b3bac203b40becf0ea3f9f7c2fbf572c6a86887
    Public key SHA-256 be171c588482639a9a95cd71d30084582633b34f83b7c168d46bd87296aac81c
    Addresses
    172.66.44.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.83, 172.66.47.173): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  41. cuxnouend.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    cuxnouend.shop
    First seen
    2026-11-10 06:10 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-10 05:11 UTC to 2027-02-08 05:11 UTC
    Logged 2026-11-10 06:10 UTC in IPng Networks Halloumi2027h1, entry 437,417,620
    SHA-256 46ca54abeba3fe39c78c01582b9b571e9180a78ebd1af843fa54d3a4a7495dce
    Public key SHA-256 4a2ff0401240c7f593fe04d6793348eef8666af100741cd0b219104a0bb947c2
    Addresses
    104.21.31.239 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.204 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.31.239, 172.67.180.204): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cuxnouend.shop
    Registered
    2026-09-12 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  42. fwnhabtl.akpjabzxt.eklvdour.kqiovdce.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    fwnhabtl.akpjabzxt.eklvdour.kqiovdce.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in Let's Encrypt Sycamore2027h1, entry 1,112,548,159
    SHA-256 354afadc7a15091eaf391e09fa4d2fc67c56d60880dd597394b7d5f33fafffdb
    Public key SHA-256 5c91a7effc49c0a08bbb02dcefa86fdace0ea6a13262fe77737fca387b4be3a1
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  43. golntqrk.vddzuuzg.dglooolb.abyivmzxo.hbrcidmq.zkmbyjrs.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    golntqrk.vddzuuzg.dglooolb.abyivmzxo.hbrcidmq.zkmbyjrs.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in IPng Networks Gouda2027h1, entry 371,044,529
    SHA-256 52ed2ecc2d4e96a5ad1cb4a47254ed588d505ac43059c675164f21d043367b79
    Public key SHA-256 f775b9b9b14034b48fd5e9a94cf3e24c9454b4ea4316a66c9de27ab7788c067b
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  44. i0k.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishTankMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    i0k.cc
    First seen
    2026-11-10 06:10 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 05:49 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-12 02:01 UTC to 2026-12-11 03:01 UTC
    Logged 2026-11-10 06:10 UTC in Let's Encrypt Willow2026h2, entry 1,043,211,991
    SHA-256 bd82853683115171aa0edf8e2a1fde9450f91000dba4c4b76941dcd1f1c038a4
    Public key SHA-256 fdf735ffcc59616f3d044f9974a1f43c2bc449d6697d2335fa9cc2d0e93f755c
    PhishTank
    PhishTank report #8886255
    Addresses
    104.21.9.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.159.52 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.9.67, 172.67.159.52): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    i0k.cc
    Registered
    2024-04-09 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  45. igplxcyr.hogjrxbu.sgdhepiy.ixyhmceu.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    igplxcyr.hogjrxbu.sgdhepiy.ixyhmceu.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in TrustAsia Luoshu2027, entry 601,058,845
    SHA-256 37556889d56abecb78194adb86b6c6af859f7c6acd29bd0b455f8335846f0089
    Public key SHA-256 4fd2f732cc615211a1942f55b0e506e558ca5b255a8fa1f9f92c3540ac40614a
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  46. jtvbuoicn.dbwmhtjo.xugoiypn.tqyexrci.smnqphzo.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    jtvbuoicn.dbwmhtjo.xugoiypn.tqyexrci.smnqphzo.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in IPng Networks Halloumi2027h1, entry 437,376,549
    SHA-256 78573eb2491e215f73c9c897c82a12f428656046eb9480ef2d137728a0b3e205
    Public key SHA-256 1faff51e96650161b48761371011a658ad64d5d0657d2e40ea8bb3845c5ee844
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  47. kwdt19n25pmsv6i7.rbl2jkv1f4qkmyqq.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    kwdt19n25pmsv6i7.rbl2jkv1f4qkmyqq.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in Google ParcelYard2027h1, entry 712,389,679
    SHA-256 5e3af9a10d8045e07f36b31fa18c02e70a08b52fdf4aed918c649b19fa0f9cff
    Public key SHA-256 f5771ba990f2f89fc13a835b30aa3cba85ca4ada89789882bab1a722b6750c76
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  48. patombis.smqwfivz.dolaghsc.cqjiypuv.kvjsbyeg.emnbzdvj.uatmfwcq.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    patombis.smqwfivz.dolaghsc.cqjiypuv.kvjsbyeg.emnbzdvj.uatmfwcq.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in Let's Encrypt Willow2027h1, entry 1,067,636,583
    SHA-256 9198d410d54ed4a2ac15a1d3d903f804a46dd634468c2fda885e14200a622c39
    Public key SHA-256 32c5449e30b3358be6db3ea34733518edbd027ef7ef86591658239385cdd92cb
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  49. www.azais.de-preville.fr FR · AS16276 · OVH OVH SAS2 addresses
    ReportedOVHUnder azais.de-preville.fr, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 20 y ago
    DetailsHide
    Hostname
    www.azais.de-preville.fr
    First seen
    2026-11-10 06:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy, listing azais.de-preville.fr and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in Geomys Tuscolo2027h1, entry 556,970,923
    SHA-256 2d7463437288646f82dc3598065fdc9e77422c65fcaf2f3591cac0048694095c
    Public key SHA-256 13824041666976437ba9dd4267aafd2d40e033b26473c345c81046f4a92b56d9
    PhishDestroy
    Addresses
    5.135.23.164 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    2001:41d0:301::100
    OVH
    OVH (5.135.23.164): a cloud provider. It rents servers and addresses to its customers.
    Domain
    de-preville.fr
    Registered
    2007-05-07 · GANDI
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  50. xtjfzpqg.jigcvzysl.vzchbewo.yidmvuao.tkmxdgnv.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    xtjfzpqg.jigcvzysl.vzchbewo.yidmvuao.tkmxdgnv.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-10 06:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 05:46 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-10 05:07 UTC to 2027-02-08 05:07 UTC
    Logged 2026-11-10 06:05 UTC in DigiCert Wyvern2027h1, entry 478,991,632
    SHA-256 78dbd87db56866073271ac110d0d591763b5f5c8c2b7bba145d3ff3aafb453cc
    Public key SHA-256 c6f3705e19188335f64eb0c29b4f2d5658d57a0905e630f97e4db97e1821a55c
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  51. bot.686863.xyz US · AS31898 · Oracle Corporation
    ListedOracle CloudUnder 686863.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    bot.686863.xyz
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing 686863.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-10 05:01 UTC to 2027-02-08 05:01 UTC
    Logged 2026-11-10 06:00 UTC in Let's Encrypt Willow2027h1, entry 1,067,470,765
    SHA-256 6b363f49532f96194b4885e47e2b310f0e3eab0150e8970460d243dffb35aaad
    Public key SHA-256 30bd2907cdbab9b12a32671d616f2409fd88772d97993247b95a3b9f035eddea
    Addresses
    129.146.181.229 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (129.146.181.229): a cloud provider. It rents servers and addresses to its customers.
    Domain
    686863.xyz
    Registered
    2025-11-14 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:51 UTC

    Suggest a correction

  52. brightvaultmere.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    brightvaultmere.pro
    First seen
    2026-11-10 06:05 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 03:41 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-10 05:00 UTC to 2027-02-08 05:59 UTC
    Logged 2026-11-10 06:00 UTC in Google ParcelYard2027h1, entry 712,332,015
    SHA-256 84cc431672a9a202ff13f62d68c5b2f3f136d69b71130e661d82eb4c3850a240
    Public key SHA-256 c36485d5e67c4e51139026b15561584cd0d4e6d58ffd1847725428ea78ca687c
    Addresses
    104.21.64.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.176.8 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.64.44, 172.67.176.8): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    brightvaultmere.pro
    Registered
    2026-03-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  53. businessmanagers-helpcenters.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishTank
    DetailsHide
    Hostname
    businessmanagers-helpcenters.pages.dev
    First seen
    2026-11-10 06:05 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 05:49 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:03 UTC to 2027-02-08 06:01 UTC
    Logged 2026-11-10 06:03 UTC in Google PlumbersArms2027h1, entry 712,620,195
    SHA-256 b31473e0fbb0d061f1d1bf2944b05c2c7b77cf32b598a0dafb687f014e76b43c
    Public key SHA-256 f0e894e5077f832d17a67a71aa056c0aad8f29b237b62038e4fe83de5c1f4caf
    PhishTank
    PhishTank report #8879353
    Addresses
    172.66.44.233 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.23 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.233, 172.66.47.23): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  54. cli.686863.xyz US · AS31898 · Oracle Corporation
    ListedOracle CloudUnder 686863.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    cli.686863.xyz
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing 686863.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-10 05:01 UTC to 2027-02-08 05:01 UTC
    Logged 2026-11-10 06:00 UTC in Google PlumbersArms2027h1, entry 712,586,551
    SHA-256 94a498089e5f4d0392ecd3848f7a853d708bedb6e7edd9ac82ef15ffabef033e
    Public key SHA-256 6837b27cf033793925587fdb1d5ea0ab62b05977fbfb28b1508c886053cc8971
    Addresses
    129.146.181.229 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (129.146.181.229): a cloud provider. It rents servers and addresses to its customers.
    Domain
    686863.xyz
    Registered
    2025-11-14 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:51 UTC

    Suggest a correction

  55. dockhand.staymeow.com US · AS31898 · Oracle Corporation
    ListedOracle CloudUnder staymeow.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    dockhand.staymeow.com
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing staymeow.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-10 05:04 UTC to 2027-02-08 05:04 UTC
    Logged 2026-11-10 06:02 UTC in DigiCert Wyvern2027h1, entry 478,958,003
    SHA-256 8b84d5d9b2de8f8037c415c84e415124c5f4b667f6f0ee3eb1c4652342156ef7
    Public key SHA-256 19f3adf341d8b72c1f9bf1135e0c06f82ba342e54fba1f1a0c64003d210a8980
    Addresses
    79.72.94.214 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (79.72.94.214): a cloud provider. It rents servers and addresses to its customers.
    Domain
    staymeow.com
    Registered
    2026-02-17 · Cloudflare, Inc.
    MX
    Receives mail at route3.mx.cloudflare.net, route2.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 22:04 UTC

    Suggest a correction

  56. hfiweqs.monster US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    hfiweqs.monster
    First seen
    2026-11-10 06:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-10 05:03 UTC to 2027-02-08 05:03 UTC
    Logged 2026-11-10 06:02 UTC in Let's Encrypt Sycamore2027h1, entry 1,112,451,573
    SHA-256 3e018758f311b11a7da03d1ca9f8d86c2228a3718ab15303baae52115f01d254
    Public key SHA-256 c764ca7c733636fa89106b40750a2a6e671f660ec52795e28da459a9d7400ba8
    Addresses
    104.21.5.151 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.5.151, 172.67.154.186): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hfiweqs.monster
    Registered
    2026-09-10 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  57. itxfjyk.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    itxfjyk.xyz
    First seen
    2026-11-10 06:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-10 05:05 UTC to 2027-02-08 05:05 UTC
    Logged 2026-11-10 06:04 UTC in Google ParcelYard2027h1, entry 712,370,366
    SHA-256 4105bdc87dba0742bb54f04f225679bd7d1eba12987c1d11c05606450910ba2e
    Public key SHA-256 5b5359f66cd94f9f22393bd982df64bdd99a8ba594d79a4434e87564765603b7
    Addresses
    104.21.94.85 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.94.85, 172.67.221.74): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    itxfjyk.xyz
    Registered
    2026-03-18 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  58. js.microsoftdynamicsexpert.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under microsoftdynamicsexpert.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    js.microsoftdynamicsexpert.com
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing microsoftdynamicsexpert.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-10 05:05 UTC to 2027-02-08 05:05 UTC
    Logged 2026-11-10 06:03 UTC in IPng Networks Halloumi2027h1, entry 437,356,236
    SHA-256 3de0a25a2b535ef7301fd6c3ed32a648c6b913591696002871e6ac5d4dd8c054
    Public key SHA-256 f2c241fc258570aeb71ddf8ab3fa9956caa6aa1bf5b410284b0d176df49e24c6
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    microsoftdynamicsexpert.com
    Registered
    2023-11-14 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:44 UTC

    Suggest a correction

  59. kraken48.ru US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    kraken48.ru
    First seen
    2026-11-10 06:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:02 UTC to 2027-02-08 05:59 UTC
    Logged 2026-11-10 06:02 UTC in Google PlumbersArms2027h1, entry 712,606,924
    SHA-256 13ccfb3ccd1fcfd38748d05e4069ae4fe077ce0bcccd268d8956622d7e2de303
    Public key SHA-256 805de9dcad54ac185aaf7fe257d18d43e62b780ebe29a9b6e75bbc30910bfb57
    PhishDestroy
    Addresses
    104.21.6.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.86, 172.67.154.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kraken48.ru
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:08 UTC

    Suggest a correction

  60. onion.observer US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    onion.observer
    First seen
    2026-11-10 06:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 05:02 UTC to 2027-02-08 06:01 UTC
    Logged 2026-11-10 06:02 UTC in Geomys Tuscolo2027h1, entry 556,945,261
    SHA-256 b48600bcf8b73d5ffe386789220235ffbe98f34454f185f4c5d05477f799a3a8
    Public key SHA-256 02f5567c8b372400971a33e7094122a757ebb56746444c20154123667bae6f80
    PhishDestroy
    Addresses
    104.21.16.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.21.32.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.1, 104.21.32.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    onion.observer
    Registered
    2025-04-12 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  61. phantomculture.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    phantomculture.pages.dev
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-10 05:05 UTC to 2027-02-08 05:05 UTC
    Logged 2026-11-10 06:03 UTC in Google PlumbersArms2027h1, entry 712,626,095
    SHA-256 1a007a065bc3a046c6a54b8b4edb8f53ad6aa8db1d71c730c2c1710c98f60326
    Public key SHA-256 51cb461fdea3aa16c421e1c70f5a17a1ad12cc5df0213b362e0302c725c39683
    Addresses
    172.66.44.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.149 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.107, 172.66.47.149): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  62. tuliprox.staymeow.com US · AS31898 · Oracle Corporation
    ListedOracle CloudUnder staymeow.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    tuliprox.staymeow.com
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing staymeow.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-10 05:04 UTC to 2027-02-08 05:04 UTC
    Logged 2026-11-10 06:03 UTC in IPng Networks Gouda2027h1, entry 371,025,649
    SHA-256 496d11f2aaa9bfd795b7c9c8a2738e86b613646380607ce0b6cf45f9fa173ef4
    Public key SHA-256 c19c2220f41de011ca8181748075fa0ae25c9bf86e05ecb47c65b12b92c2dc50
    Addresses
    79.72.94.214 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (79.72.94.214): a cloud provider. It rents servers and addresses to its customers.
    Domain
    staymeow.com
    Registered
    2026-02-17 · Cloudflare, Inc.
    MX
    Receives mail at route3.mx.cloudflare.net, route2.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 22:04 UTC

    Suggest a correction

  63. turn.686863.xyz US · AS31898 · Oracle Corporation
    ListedOracle CloudUnder 686863.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    turn.686863.xyz
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing 686863.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-10 05:01 UTC to 2027-02-08 05:01 UTC
    Logged 2026-11-10 06:00 UTC in Google PlumbersArms2027h1, entry 712,587,556
    SHA-256 9fc9d5b6a938f5a78eab18879788904eb59f68a7305c570b981596d608725da4
    Public key SHA-256 b5988440d155d8496f5582784120700ec61c7c466387ddd905df954a91c766cd
    Addresses
    129.146.181.229 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (129.146.181.229): a cloud provider. It rents servers and addresses to its customers.
    Domain
    686863.xyz
    Registered
    2025-11-14 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:51 UTC

    Suggest a correction

  64. wrhp.store US · AS16509 · Amazon.com, Inc.4 addresses
    ListedAmazon Web ServicesListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    wrhp.store
    First seen
    2026-11-10 06:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 01:36 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 S20 · precertificate
    Valid 2026-11-10 05:03 UTC to 2027-05-27 06:03 UTC
    Logged 2026-11-10 06:03 UTC in Geomys Tuscolo2027h1, entry 556,953,082
    SHA-256 3acbb9b81c7fed96fb3807d958807fb1f02d67b4034ac94aead137338d63af3f
    Public key SHA-256 52080562b6c244042d76f97a9b0e2c3b550317e92a982f518462338cabb74314
    Addresses
    54.192.138.44 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    54.192.138.69 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    54.192.138.112 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    54.192.138.122 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (54.192.138.44, 54.192.138.69, 54.192.138.112, 54.192.138.122): a cloud provider. It rents servers and addresses to its customers.
    Domain
    wrhp.store
    Registered
    2025-12-08 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  65. xhqd4k.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    xhqd4k.hdiv8jy.com
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-10 05:02 UTC to 2027-02-08 05:02 UTC
    Logged 2026-11-10 06:01 UTC in Let's Encrypt Sycamore2027h1, entry 1,112,416,258
    SHA-256 bb3006f90452f06d5baf50058a1f5ed6c8480419f7552960616d0aab11872288
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  66. xy34f1.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    xy34f1.hdiv8jy.com
    First seen
    2026-11-10 06:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-10 05:02 UTC to 2027-02-08 05:02 UTC
    Logged 2026-11-10 06:01 UTC in Let's Encrypt Willow2027h1, entry 1,067,497,760
    SHA-256 0bccc6a07c6ce25aa7c16242b31a3327fed9491ea1c4776432d8271505f58e96
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 17:22 UTC

    Suggest a correction

  67. 3124-proposal.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    3124-proposal.pages.dev
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-10 01:46 UTC to 2027-02-08 01:46 UTC
    Logged 2026-11-10 02:44 UTC in Google ParcelYard2027h1, entry 709,910,891
    SHA-256 36119493ddd3c6abd83058b2d8c0ea6eb28192890d52194d3d61bd6bfd456a0d
    Public key SHA-256 204206ed72d034d1939e6e3f16a2444f99c1eb57c752c127fff1ac2e77b1c53b
    Addresses
    172.66.44.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c94
    2606:4700:310c::ac42:2f6c
    Cloudflare
    Cloudflare (172.66.44.148, 172.66.47.108): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  68. alpentradingltd.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    alpentradingltd.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-30 (5 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-09 00:00 UTC to 2027-02-07 12:57 UTC
    Logged 2026-11-09 13:00 UTC in DigiCert Wyvern2027h1, entry 468,474,024
    SHA-256 1f6130c941f8d396f19c893c0c4998c1127bcead8a56bfd7a968a54eef7769af
    Public key SHA-256 58f0df2f4f23cbfd87e772160c1826d5b83538e73b2ae8145e4a4e4a15e574a6
    PhishDestroy
    Addresses
    104.21.84.22 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:b906
    2606:4700:3035::6815:5416
    Cloudflare
    Cloudflare (104.21.84.22, 172.67.185.6): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    alpentradingltd.com
    Registered
    2025-09-12 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  69. app-kinetiq.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    app-kinetiq.pages.dev
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 05:09 UTC to 2027-02-07 05:09 UTC
    Logged 2026-11-09 06:08 UTC in Google ParcelYard2027h1, entry 692,021,264
    SHA-256 06e2fa7787e352052238a6acbfbe62c3cba06bec6c72a0a3299f5cb29928cc4c
    Public key SHA-256 46a81b3cbbffb1540ad18b7c5fa212fbea604109ed9a0ea744779749f3371924
    Addresses
    172.66.44.93 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.163 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c5d
    2606:4700:310c::ac42:2fa3
    Cloudflare
    Cloudflare (172.66.44.93, 172.66.47.163): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  70. ayoo.club US · AS398101 · GoDaddy.com, LLC
    ReportedGoDaddyReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ayoo.club
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 20:10 UTC to 2027-02-07 20:10 UTC
    Logged 2026-11-09 21:08 UTC in Google ParcelYard2027h1, entry 705,542,434
    SHA-256 99bfd0ad909da5da87242fa27cc2bb9a4b2673a3d73bcb8ae2bbdb13e404b4f7
    Public key SHA-256 880d213aa9baf47e7a3406594771df4a12655546bccab605b62790a2976f59ef
    PhishDestroy
    Addresses
    160.153.172.43 · United States · AS398101 GO-DADDY-COM-LLC - GoDaddy.com, LLC · GoDaddy (shared hosting)
    GoDaddy
    GoDaddy (160.153.172.43): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    ayoo.club
    Registered
    2026-07-15 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  71. bitrefill.com-ds01-esim-gift.com GB · AS214351 · FEMOIT FEMO IT SOLUTIONS LI…Bitrefill
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    bitrefill.com-ds01-esim-gift.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-08 23:57 UTC to 2027-02-06 23:57 UTC
    Logged 2026-11-09 00:55 UTC in Let's Encrypt Sycamore2027h1, entry 1,065,747,626
    SHA-256 1938cf66998dff4b7ca8b5a345dd62714c21f78a8480e1bb5d44f5ca221f7198
    Public key SHA-256 356bfaad7227416527debae68e331e687bf8b92f8affb5f9cd983f90022be56e
    Brand
    Bitrefill
    Addresses
    62.60.226.39 · United Kingdom · AS214351 FEMOIT FEMO IT SOLUTIONS LIMITED
    Domain
    com-ds01-esim-gift.com
    Registered
    2026-11-09 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 01:00 UTC

    Suggest a correction

  72. calurazektor.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    calurazektor.com
    First seen
    2026-11-10 06:03 UTC
    First published
    2026-11-02 09:27 UTC
    Listing
    CERT Polska listed it 2026-09-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 03:41 UTC
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    DNS
    Resolves · checked 2026-11-09 09:34 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Latest DNS check
    3. Observed in the PhishDestroy feed
    4. We matched the new listing
    Certificate
    Issued by YE1
    Valid 2026-11-09 20:40 UTC to 2027-02-07 20:40 UTC
    Logged 2026-11-09 21:38 UTC in Google ParcelYard2027h1, entry 705,941,628
    SHA-256 5e00c4a8e86f29f3f6e19f63ea584fc48af45c788c811fd361ce09294cc1776a
    Public key SHA-256 3eb6637d24306b3f6b15c345c35829274f8053f039cebc11c1acc07822d94a6f
    PhishDestroy
    Addresses
    104.21.39.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.170.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.39.148, 172.67.170.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    calurazektor.com
    Registered
    2026-09-04 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 08:46 UTC

    Suggest a correction

  73. casino-rainbet.de US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    casino-rainbet.de
    First seen
    2026-11-10 06:03 UTC
    First published
    2026-11-10 03:28 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-04 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    DNS
    Resolves · checked 2026-11-10 03:33 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Latest DNS check
    3. Observed in the PhishDestroy feed
    4. We matched the new listing
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-10 01:40 UTC to 2027-02-08 02:38 UTC
    Logged 2026-11-10 02:40 UTC in DigiCert Sphinx2027h1, entry 422,468,559
    SHA-256 9b04cea74de57e314accfae31cb754a59cf65686a1290a8d8861190b9f2eead0
    Public key SHA-256 10bbac506a66728886dbb25450bb4a0e47136cf91400c4674ea0a1ffa4c15d15
    PhishDestroy
    Addresses
    104.21.28.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.179 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.28.147, 172.67.146.179): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    casino-rainbet.de
    MX
    Receives mail at route1.mx.cloudflare.net, route2.mx.cloudflare.net, route3.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 02:42 UTC

    Suggest a correction

  74. console.managexr.com US · AS54113 · Fastly, Inc.2 addresses
    ReportedFastlyReported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 6 y ago
    DetailsHide
    Hostname
    console.managexr.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-07 (13 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-09 03:37 UTC to 2027-02-07 04:35 UTC
    Logged 2026-11-09 04:37 UTC in Geomys Tuscolo2027h1, entry 538,782,708
    SHA-256 5fbc122843568d944cadb667a937ffc1950d0e9167d2750142f39bab2b5eb6d2
    Public key SHA-256 6b81681f2127b0585ab88c74c3f801ef2c2c943ead58693cdc9d85e8fbf5a610
    PhishDestroy
    Addresses
    151.101.1.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    151.101.65.195 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (151.101.1.195, 151.101.65.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    managexr.com
    Registered
    2020-12-30 · Squarespace Domains II LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  75. dyornetwork.com US · AS16509 · Amazon.com, Inc.
    ReportedParking page · Dynadot parkingReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    dyornetwork.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-08 (14 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-10 01:50 UTC to 2027-02-08 01:50 UTC
    Logged 2026-11-10 02:48 UTC in Let's Encrypt Sycamore2027h1, entry 1,107,256,530
    SHA-256 08470e59cafe2ba4dd2430fa2feb4f766d5100ee1114d7214b0bdda248457bb4
    Public key SHA-256 44422671df34694e0d23c6fe9863cb81ecd85dfbfb84123c6a0aaf74e3f5b48a
    PhishDestroy
    Addresses
    54.215.31.113 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Dynadot parking (parking page)
    Parking page · Dynadot parking
    Dynadot parking (54.215.31.113): a parking service. It answers for names that are typically for sale or unused.
    Domain
    dyornetwork.com
    Registered
    2023-11-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  76. elysium-voting.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    elysium-voting.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 19:37 UTC to 2027-02-07 20:35 UTC
    Logged 2026-11-09 20:37 UTC in Geomys Tuscolo2027h1, entry 550,123,725
    SHA-256 20176dfe18098a568cec75c977e6b0f540361770518defeb73b1ca52eb3b4a1c
    Public key SHA-256 3362820f7c795ff76b5bd8d169585f54eb1ce6126568ae287f582e91f767a638
    Addresses
    104.21.13.131 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.132.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:d83
    2606:4700:3032::ac43:84d5
    Cloudflare
    Cloudflare (104.21.13.131, 172.67.132.213): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    elysium-voting.com
    Registered
    2026-11-09 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  77. exodusdk.cc US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    exodusdk.cc
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-09 01:15 UTC to 2027-02-07 02:15 UTC
    Logged 2026-11-09 02:15 UTC in Google PlumbersArms2027h1, entry 689,060,588
    SHA-256 260051317198ac4c34433fbf7306c3f643fdf31633610ef395ab61d86d1c7194
    Public key SHA-256 b8f3a0f6f2d7595f5711a810913489e5bcc4409c03131df59f71c10ca4f30b54
    Addresses
    104.21.0.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:d6
    2606:4700:3036::ac43:804e
    Cloudflare
    Cloudflare (104.21.0.214, 172.67.128.78): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exodusdk.cc
    Registered
    2026-11-09 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  78. exodusdk.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    exodusdk.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 01:15 UTC to 2027-02-07 02:10 UTC
    Logged 2026-11-09 02:15 UTC in DigiCert Sphinx2027h1, entry 408,915,311
    SHA-256 2856984ba0d6fb0962aaf3fda80c70b8cbdadf183f09f9d128e83a844341a7f3
    Public key SHA-256 b9fdd086d1efbcaf109ac7e548f326721f5c43a233dc7628dc0e5e0763938db0
    Addresses
    104.21.51.145 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.181.106 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:3391
    2606:4700:3035::ac43:b56a
    Cloudflare
    Cloudflare (104.21.51.145, 172.67.181.106): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exodusdk.com
    Registered
    2026-11-09 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  79. exodusdk.ink US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    exodusdk.ink
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-09 01:24 UTC to 2027-02-07 02:23 UTC
    Logged 2026-11-09 02:24 UTC in Let's Encrypt Willow2027h1, entry 1,023,923,012
    SHA-256 0d09b6ad06cd856b876e3976a6866feae1a4a3c6cf2e11c2383304c29dc1a046
    Public key SHA-256 4adcd87ffb55a8a33dd8599cbcf6bfe5b6e088f6656483d94a8897e79a26411c
    Addresses
    104.21.3.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.2 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:3b6
    2606:4700:3033::ac43:8302
    Cloudflare
    Cloudflare (104.21.3.182, 172.67.131.2): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exodusdk.ink
    Registered
    2026-11-09 · NameMart Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  80. exodusia.click US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    exodusia.click
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 01:18 UTC to 2027-02-07 02:09 UTC
    Logged 2026-11-09 02:19 UTC in Let's Encrypt Sycamore2027h1, entry 1,067,809,551
    SHA-256 341ba54804ff4034061d542d14520fbb7655f2eead8d4c6841d0e4eb727f5200
    Public key SHA-256 57a8c8e7adae1243bb624e013ba0fdf61b5394f8f4d65008c7c7fd2348b104f5
    Addresses
    104.21.27.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.142.34 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:8e22
    2606:4700:3036::6815:1b5e
    Cloudflare
    Cloudflare (104.21.27.94, 172.67.142.34): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exodusia.click
    Registered
    2026-11-09 · NameMart Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  81. exodusia.org US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    exodusia.org
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-09 01:20 UTC to 2027-02-07 02:08 UTC
    Logged 2026-11-09 02:20 UTC in DigiCert Wyvern2027h1, entry 461,920,951
    SHA-256 1be1f6184d893b7f4f6091d9a10fb7432f50a0545ca2a37db5db8d14ac8b55a8
    Public key SHA-256 be298f200cbd31b24b78210cb4e74d0af50640016a331ba605111bd99898d1ab
    Addresses
    104.21.61.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.61 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:3df7
    2606:4700:3037::ac43:d93d
    Cloudflare
    Cloudflare (104.21.61.247, 172.67.217.61): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    exodusia.org
    Registered
    2026-11-09 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  82. forteza.cc GB · AS214351 · FEMOIT FEMO IT SOLUTIONS LI…
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    forteza.cc
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 11:02 UTC to 2027-02-07 11:02 UTC
    Logged 2026-11-09 12:00 UTC in IPng Networks Gouda2027h1, entry 363,556,674
    SHA-256 6881ece8a9baca8e7125af732a4cd36b47d87c1713f6f0e5fb122b05f5029c22
    Public key SHA-256 f85fcd097136e50b0c9ef883d8d5ad649b7c81ab4ddd39fee930945b9edbb549
    PhishDestroy
    Addresses
    62.60.226.132 · United Kingdom · AS214351 FEMOIT FEMO IT SOLUTIONS LIMITED
    Domain
    forteza.cc
    Registered
    2026-07-31 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  83. fortnitecheat.cc BD · AS153947 · FAST ZONE IT
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    fortnitecheat.cc
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-08 23:25 UTC to 2027-02-06 23:25 UTC
    Logged 2026-11-09 00:23 UTC in Google ParcelYard2027h1, entry 687,189,031
    SHA-256 34bb6647846fafb3463f7df3bc78e3de8c49958ae03c4b717d9ffc84f05243cc
    Public key SHA-256 18fb40f42c2400195b04530e9a7f9db9a3fa245fff33105956b45035085f14b2
    PhishDestroy
    Addresses
    193.187.110.18 · Bangladesh · AS153947 FASTZONEIT-AS-AP - FAST ZONE IT
    Domain
    fortnitecheat.cc
    Registered
    2026-09-07 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  84. gneura.pro AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    gneura.pro
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 01:30 UTC to 2027-02-07 01:30 UTC
    Logged 2026-11-09 02:29 UTC in Google ParcelYard2027h1, entry 688,993,101
    SHA-256 d5ec55efd5a790c62c9bd06b64d6a2c08089af6a93d6121c5eddc58c1e8d45e8
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates gneura.pro to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    gneura.pro
    Registered
    2025-11-08 · NameSilo, LLC
    MX
    Receives mail at mail.eye-mail.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  85. grandmarketstsignals.live US · AS53667 · FranTech Solutions
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    grandmarketstsignals.live
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-07 (13 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 12:49 UTC to 2027-02-07 12:49 UTC
    Logged 2026-11-09 13:47 UTC in Google PlumbersArms2027h1, entry 699,108,676
    SHA-256 82ab3278625c27f5a747658e058b995a161931204daf879eaaedd9a0ccd4a588
    Public key SHA-256 a4acda3f79787891dbcbc6c3817d9c36a9f6863f8dcec08daef778c2652b5662
    PhishDestroy
    Addresses
    198.251.81.14 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    grandmarketstsignals.live
    Registered
    2026-08-03 · Atak Domain Bilgi Teknolojileri A.Ş.
    MX
    Receives mail at mail.grandmarketstsignals.live
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  86. heatseeker.xyz RO · AS215659 · MOEMOEKYUN Aokigahara SRL
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    heatseeker.xyz
    First seen
    2026-11-10 06:03 UTC
    First published
    2026-11-04 04:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    DNS
    Resolves · checked 2026-11-10 04:31 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Latest DNS check
    3. Observed in the PhishDestroy feed
    4. We matched the new listing
    Certificate
    Issued by YE2
    Valid 2026-11-09 08:57 UTC to 2027-02-07 08:57 UTC
    Logged 2026-11-09 09:55 UTC in Google ParcelYard2027h1, entry 695,336,680
    SHA-256 7d480c7bad35caf5eb08194dcf1f0cd715deb7132146db77ed6a3d6d3767e0f3
    Public key SHA-256 9549d283b3cf6d5bce94c53ee2674c848bdf7b8ae7b74658c3c0c0f085d6c0a8
    PhishDestroy
    Addresses
    45.38.20.65 · Romania · AS215659 MOEMOEKYUN Aokigahara SRL
    Domain
    heatseeker.xyz
    Registered
    2026-07-21 · Unstoppable Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 03:52 UTC

    Suggest a correction

  87. horizon-wealth-group.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    horizon-wealth-group.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 11:36 UTC to 2027-02-07 11:45 UTC
    Logged 2026-11-09 11:46 UTC in DigiCert Wyvern2027h1, entry 467,730,680
    SHA-256 9c2b5703edd2b4db32f18272b09ec5e61cbfe718249a8264580c65c07ff57c22
    Public key SHA-256 50ff6a5308388b0157db5611afe59e6831c172b3310695df09699222dde7c930
    PhishDestroy
    Addresses
    104.21.55.205 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.200 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:acc8
    2606:4700:3033::6815:37cd
    Cloudflare
    Cloudflare (104.21.55.205, 172.67.172.200): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    horizon-wealth-group.com
    Registered
    2025-09-10 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  88. ig-crypto-dapp.us AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    ig-crypto-dapp.us
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 04:37 UTC to 2027-02-07 04:37 UTC
    Logged 2026-11-09 05:35 UTC in Let's Encrypt Sycamore2027h1, entry 1,073,150,724
    SHA-256 35e5262c94a4f432fbf649c5a5e6bb22db91af0edb383a6835abd684238a55f9
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.248 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates ig-crypto-dapp.us to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.248): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ig-crypto-dapp.us
    Registered
    2025-11-08 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  89. imap.lombard4u.ru 129.101.104.39
    ReportedReported by PhishDestroyMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    imap.lombard4u.ru
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-02 (8 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 12:15 UTC to 2027-02-07 12:15 UTC
    Logged 2026-11-09 13:14 UTC in Google ParcelYard2027h1, entry 698,337,126
    SHA-256 283a93c5840402d1f62c28b6d9ffb93faa621a3b6b2c723e14ef69745820fd55
    Public key SHA-256 1228e634919d13f9b30f920f015ccd2ff9179534683cba927376480f73db9639
    PhishDestroy
    Addresses
    129.101.104.39
    Domain
    lombard4u.ru
    MX
    Receives mail at email.lombard4u.ru, mail.lombard4u.ru
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-10 06:08 UTC

    Suggest a correction

  90. investswithelon.com US · AS19318 · Interserver, Inc
    ReportedInterserverReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    investswithelon.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-08 (14 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 13:43 UTC to 2027-02-07 13:43 UTC
    Logged 2026-11-09 14:41 UTC in DigiCert Sphinx2027h1, entry 415,805,123
    SHA-256 415c05bc8589a98192d7394e32c7abedbae5ea595b0d3ff7e85aad7c7503b8fd
    Public key SHA-256 3d5f4f6aef777993ce9120466fe00f09a9430c1c05a7d3c38381e2f96d0ef510
    PhishDestroy
    Addresses
    66.45.230.82 · United States · AS19318 IS-AS-1 - Interserver, Inc · Interserver (shared hosting)
    Interserver
    Interserver (66.45.230.82): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    investswithelon.com
    Registered
    2025-09-26 · NameSilo, LLC
    MX
    Receives mail at mail.investswithelon.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  91. kazyno-10zl-paypal.net.pl US · AS13335 · Cloudflare, Inc.4 addressesPayPal
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 19 d ago
    DetailsHide
    Hostname
    kazyno-10zl-paypal.net.pl
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-11-09 11:27 UTC to 2027-02-07 11:35 UTC
    Logged 2026-11-09 11:37 UTC in DigiCert Wyvern2027h1, entry 467,680,032
    SHA-256 b2e65a99f75f7b7640739d556d026459d21c499f3e0689fd2bdd3630eac86c8c
    Public key SHA-256 79f85f978cf1ddc5e144b676b2dfc1e23f4a8c6264cbd7b420d23d50420d5987
    PhishDestroy
    Brand
    PayPal
    Addresses
    104.21.14.170 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.21 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:eaa
    2606:4700:3034::ac43:a015
    Cloudflare
    Cloudflare (104.21.14.170, 172.67.160.21): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kazyno-10zl-paypal.net.pl
    Registered
    2026-10-22 · Aftermarket.pl Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  92. kraken24.life US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    kraken24.life
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-27 (2 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 12:29 UTC to 2027-02-07 12:29 UTC
    Logged 2026-11-09 13:28 UTC in IPng Networks Gouda2027h1, entry 364,158,894
    SHA-256 1045af10d2b39b77d2003113c9de420674017596764213d191602d68426074e3
    Public key SHA-256 6c0cd9314ace0d80fc70ca3f2dcdef6b650dbfcd959b91bf5b2d5532f94c02c8
    PhishDestroy
    Addresses
    104.21.83.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:b479
    2606:4700:3035::6815:53b2
    Cloudflare
    Cloudflare (104.21.83.178, 172.67.180.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    kraken24.life
    Registered
    2025-09-07 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  93. mail.lombard4u.ru 129.101.104.39
    ReportedReported by PhishDestroyMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    mail.lombard4u.ru
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-02 (8 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 12:15 UTC to 2027-02-07 12:15 UTC
    Logged 2026-11-09 13:14 UTC in Google ParcelYard2027h1, entry 698,337,126
    SHA-256 283a93c5840402d1f62c28b6d9ffb93faa621a3b6b2c723e14ef69745820fd55
    Public key SHA-256 1228e634919d13f9b30f920f015ccd2ff9179534683cba927376480f73db9639
    PhishDestroy
    Addresses
    129.101.104.39
    Domain
    lombard4u.ru
    MX
    Receives mail at email.lombard4u.ru, mail.lombard4u.ru
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-10 06:08 UTC

    Suggest a correction

  94. meets-room.live US · AS14956 · RouterHosting LLC
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    meets-room.live
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-09 17:05 UTC to 2027-02-07 17:05 UTC
    Logged 2026-11-09 18:03 UTC in Geomys Tuscolo2027h1, entry 548,394,701
    SHA-256 0b149bdf2242179f7da831424cc3137496f43ce0fd2ce6213e14ed4f2f3e99a2
    Public key SHA-256 545ef3ec56dc4608dcd200711545c01384530910e6854803defacc97bbc5923a
    Addresses
    153.75.86.243 · United States · AS14956 ROUTERHOSTING - RouterHosting LLC
    Domain
    meets-room.live
    Registered
    2026-11-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  95. minecrypto.pro US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    minecrypto.pro
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    DNS
    Not resolving since 2026-10-28 · checked 2026-11-09 09:09 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Latest DNS check
    3. Observed in the PhishDestroy feed
    4. We matched the new listing
    Certificate
    Issued by YE1
    Valid 2026-11-09 11:50 UTC to 2027-02-07 11:50 UTC
    Logged 2026-11-09 12:49 UTC in Google PlumbersArms2027h1, entry 698,211,283
    SHA-256 6b6c9239e9afaa65bd41f7e9e9b4bdce1eb8d6313e8505ab337a278aace5e276
    Public key SHA-256 dc9d0fc5d7cb0fcadda4aa351f353b1b064584ae779e859fc586d34676c81fb4
    PhishDestroy
    Addresses
    104.21.21.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.198.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.21.116, 172.67.198.78): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    minecrypto.pro
    Registered
    2026-03-04 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-09 07:32 UTC

    Suggest a correction

  96. msliveupdate.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ListedHostingerListed by MetaMaskMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    msliveupdate.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-09 21:46 UTC to 2027-02-07 21:46 UTC
    Logged 2026-11-09 22:45 UTC in Let's Encrypt Willow2027h1, entry 1,056,123,767
    SHA-256 e0570ba20e174663dd6d068864c984bdd8eacde83e06ee56940939f2ceae082d
    Public key SHA-256 c3d1c7bfd4f514b49f0c2ed509b2060f1123b4c255cba64c820294203a43fb90
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    msliveupdate.com
    Registered
    2026-11-09 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  97. mymeet.cc NL · AS204601 · PODAON NovoServe B.V.
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 d ago
    DetailsHide
    Hostname
    mymeet.cc
    First seen
    2026-11-10 06:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:03 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-09 15:10 UTC to 2027-02-07 15:10 UTC
    Logged 2026-11-09 16:09 UTC in Google PlumbersArms2027h1, entry 701,330,257
    SHA-256 54e3dc7a5eaba16ae4aa0f43525914f95ed5449cc51beff3c1a7f2d10cf694b3
    Public key SHA-256 45d09eb5e18c498556e2fd52d99325bddb8da788648b18259da5e44ece1d5096
    Addresses
    45.88.106.123 · Netherlands · AS204601 PODAON NovoServe B.V.
    Domain
    mymeet.cc
    Registered
    2026-11-06 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  98. nexotrading-dapp.live AU · AS154653 · ParkLogic Pty Ltd
    ReportedParking page · ParkLogicReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    nexotrading-dapp.live
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-09 20:28 UTC to 2027-02-07 20:28 UTC
    Logged 2026-11-09 21:27 UTC in DigiCert Wyvern2027h1, entry 473,769,441
    SHA-256 d6dfc95dedc6c3d739981761dbeff5366bac1d04c68a4892a1c61d3b901db3fd
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    PhishDestroy
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates nexotrading-dapp.live to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    nexotrading-dapp.live
    Registered
    2025-11-08 · NameSilo, LLC
    MX
    Receives mail at mail.eye-mail.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  99. nguyengiabusline.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 27 d ago
    DetailsHide
    Hostname
    nguyengiabusline.com
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC
    Reported
    PhishDestroy
    1. Certificate logged in CT
    2. Observed in the PhishDestroy feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-09 11:26 UTC to 2027-02-07 11:26 UTC
    Logged 2026-11-09 12:24 UTC in Google ParcelYard2027h1, entry 697,595,044
    SHA-256 4329079f01beae5be9810132a59e339e41f5dff85b257cae6ad5e8410456e6bb
    Public key SHA-256 11c80f27dc2c65ef0a0ff82fb1e9f8dde3751ce4031e33cbabcff127d6000d86
    PhishDestroy
    Addresses
    104.21.33.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.190.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3036::6815:218a
    2606:4700:3037::ac43:be1f
    Cloudflare
    Cloudflare (104.21.33.138, 172.67.190.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nguyengiabusline.com
    Registered
    2026-10-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-10 06:33 UTC

    Suggest a correction

  100. parik24-review.co.ua US · AS13335 · Cloudflare, Inc.5 addresses
    ReportedCloudflareReported by PhishDestroy
    DetailsHide
    Hostname
    parik24-review.co.ua
    First seen
    2026-11-10 06:03 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-10 06:01 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-11-07 (13 days)
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-09 06:52 UTC to 2027-02-07 06:52 UTC
    Logged 2026-11-09 07:50 UTC in Let's Encrypt Sycamore2027h1, entry 1,076,843,420
    SHA-256 3c1c5f615f01914358c7cf1a9f02eeb379c40097c85490c64ac886dfbd1584f1
    Public key SHA-256 e65a975b42a37be2dd318310dc1a8bf9d1ae6035b696fe9cfb914cff485a6ed9
    PhishDestroy
    Addresses
    104.21.20.156 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.193.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    176.123.0.199 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    2606:4700:3035::6815:149c
    2606:4700:3037::ac43:c12c
    Cloudflare
    Cloudflare (104.21.20.156, 172.67.193.44): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

Showing 1–100 of 5,725 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources