Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-12 05:48 UTC
Certificate-log entries · 24 h
343.8M
from 84 distinct feeds
Unique certificates · 24 h
35.3M
each reviewed
Names resolved · 24 h
22.7M
16.7M with an address
Findings · 24 h
6,848
254 of 1,061 brands targeted

5,866 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. bronze-espadrilles.shop US · AS396982 · Google LLC
    ListedGoogle CloudListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    bronze-espadrilles.shop
    First seen
    2026-11-12 05:46 UTC
    Listing
    CERT Polska listed it 2026-10-31 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3
    Valid 2026-09-18 03:13 UTC to 2026-12-17 04:08 UTC
    Logged 2026-11-12 05:42 UTC in DigiCert Wyvern2026h2, entry 2,220,229,803
    SHA-256 5a35be18b2044bcf93fe5f52d29afc209670cb5c284a0b7a45cc95ee6f3e2b0c
    Public key SHA-256 1275a04bb4fdbf74de0484a196526566e3c1d30c1d62dfcc8a4d1227c0d5f2e5
    Addresses
    34.8.77.192 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.8.77.192): a cloud provider. It rents servers and addresses to its customers.
    Domain
    bronze-espadrilles.shop
    Registered
    2026-09-04 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  2. credionshieldbnk.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    credionshieldbnk.com
    First seen
    2026-11-12 05:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-14 03:21 UTC to 2026-12-13 04:20 UTC
    Logged 2026-11-12 05:45 UTC in IPng Networks Halloumi2026h2a, entry 1,300,210,240
    SHA-256 a27eab35ff6256e490f53135de97c6c4036ddf586e88ac4ee499681c5819297d
    Public key SHA-256 9034b9748a9d6d277637ac7ead5d562f6a93d5650514414576dcb4aa27263063
    PhishDestroy
    Addresses
    104.21.25.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.134.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.25.132, 172.67.134.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    credionshieldbnk.com
    Registered
    2026-07-16 · Spaceship, Inc.
    MX
    Receives mail at _dc-mx.53d584b11ac8.credionshieldbnk.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  3. mareaphortencia.com NL · AS62370 · Snel Snel.com B.V.
    ListedListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    mareaphortencia.com
    First seen
    2026-11-12 05:46 UTC
    Listing
    CERT Polska listed it 2026-07-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    PhishDestroy: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:43 UTC to 2027-02-10 05:40 UTC
    Logged 2026-11-12 05:43 UTC in Google PlumbersArms2027h1, entry 750,082,811
    SHA-256 0c5a8dece6c60158a57c7ce67cbb608f40a8045927992f686fed0e9cca52cf6c
    Public key SHA-256 0176135d80ea7533439b3284e58737214306b0380e6a7bedf605a1ae51331e1a
    Addresses
    185.62.58.179 · Netherlands · AS62370 Snel Snel.com B.V.
    Domain
    mareaphortencia.com
    Registered
    2026-07-16 · MainReg Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  4. mariashopping.online US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC quarantineRegistered 6 mo ago
    DetailsHide
    Hostname
    mariashopping.online
    First seen
    2026-11-12 05:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:44 UTC to 2027-02-10 04:44 UTC
    Logged 2026-11-12 05:43 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,891,141
    SHA-256 8630aac06c40e487a42ea55a88ece7ebc8e408fc4c5dd99bb96949f300f228e3
    Public key SHA-256 0296a7a2c49f81e2ca863d3d83c057cb07d7ac1f40451c0bf2e888a8d87915df
    Addresses
    104.21.86.235 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.156 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.86.235, 172.67.137.156): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    mariashopping.online
    Registered
    2026-05-19 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  5. nirusfin-ai.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    nirusfin-ai.com
    First seen
    2026-11-12 05:46 UTC
    Listing
    CERT Polska listed it 2026-07-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:43 UTC to 2027-02-10 05:41 UTC
    Logged 2026-11-12 05:43 UTC in IPng Networks Halloumi2027h1, entry 466,220,787
    SHA-256 6c8fa4091978a5276c075414b33aef59795a20d5760534fdab207e099d6b2a77
    Public key SHA-256 d78c184c27426df8b81ca0fa3b2f95004fe9ff91c91a34b930d419bf2f425170
    Addresses
    104.21.36.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.14 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.36.13, 172.67.183.14): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nirusfin-ai.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  6. publiclumen.sbs US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    publiclumen.sbs
    First seen
    2026-11-12 05:46 UTC
    Listing
    USOM listed it 2026-05-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 04:30 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:44 UTC to 2027-02-10 04:44 UTC
    Logged 2026-11-12 05:42 UTC in Geomys Tuscolo2027h1, entry 586,556,888
    SHA-256 2fc7883753eaaf2deae04f9dd455078b8e98f9d69def667743e15bcb14a9573b
    Public key SHA-256 32153c648f0720840f1431bcfe6bc4b78f8753a7bff01e3700de65cf1a62ff09
    Addresses
    104.21.91.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.215.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.104, 172.67.215.157): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    publiclumen.sbs
    Registered
    2026-05-19 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  7. shimano-se.deal-vera.com US · AS13335 · Cloudflare, Inc.
    ListedCloudflareUnder deal-vera.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    shimano-se.deal-vera.com
    First seen
    2026-11-12 05:46 UTC
    Listing
    CERT Polska listed it 2026-10-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska, listing deal-vera.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 04:42 UTC to 2027-02-10 05:41 UTC
    Logged 2026-11-12 05:42 UTC in Geomys Tuscolo2027h1, entry 586,550,447
    SHA-256 d92dd84a9e62224729cb5b062abe7023e1b16a58bf3e2e06e46d492268b55b3b
    Public key SHA-256 534e0a86743c81fa24e882f7f78b2e81f951d91f2c856e0d0b86c69c522756e5
    Addresses
    104.18.13.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.13.234): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    deal-vera.com
    Registered
    2026-08-18 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:09 UTC

    Suggest a correction

  8. simsoft.app.br US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 23 mo ago
    DetailsHide
    Hostname
    simsoft.app.br
    First seen
    2026-11-12 05:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:44 UTC to 2027-02-10 05:42 UTC
    Logged 2026-11-12 05:44 UTC in DigiCert Wyvern2027h1, entry 508,376,032
    SHA-256 8afc5bd55b6b165bf6847df0597422948c6d7ca9e6845ebcfbd3a2b78b1b3c5c
    Public key SHA-256 56a0d98f1dfb4f889e5ac348031e28ecd3b2edd138df912bd55db522c8dec50a
    PhishDestroy
    Addresses
    104.21.81.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.100 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.81.224, 172.67.165.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    simsoft.app.br
    Registered
    2025-01-04
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 03:37 UTC

    Suggest a correction

  9. www.aiconnectors.io US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder aiconnectors.io, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.aiconnectors.io
    First seen
    2026-11-12 05:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing aiconnectors.io and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 04:43 UTC to 2027-02-10 05:41 UTC
    Logged 2026-11-12 05:43 UTC in Google PlumbersArms2027h1, entry 750,086,088
    SHA-256 66883493f8f7c8cc2eb4b7320754687e5b34c8c705604ab1dd3fcdcf57e99bd9
    Public key SHA-256 49b619b8d2ac91fed477d364fbb6d7abba05a7fb07078b780c7cfe6e115a93bc
    PhishDestroy
    Addresses
    104.18.22.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.18.23.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.22.186, 104.18.23.186): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    aiconnectors.io
    Registered
    2026-07-17 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 04:45 UTC

    Suggest a correction

  10. www.dannys-auto.sale US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder dannys-auto.sale, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    www.dannys-auto.sale
    First seen
    2026-11-12 05:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing dannys-auto.sale and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-12 04:46 UTC to 2027-02-10 04:46 UTC
    Logged 2026-11-12 05:44 UTC in DigiCert Wyvern2027h1, entry 508,382,253
    SHA-256 1351d5ab644ae3dec598c0c5e820e729008930128c2ae16db31b93e6c9b295d3
    Public key SHA-256 b686c646c340815296be8fe02c9a772e24c5aaa967af5f990f13ec31d24b4500
    PhishDestroy
    Addresses
    104.21.51.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.21 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.152, 172.67.182.21): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    dannys-auto.sale
    Registered
    2026-05-08 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Receives mail at route2.mx.cloudflare.net, route1.mx.cloudflare.net, route3.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-11 09:10 UTC

    Suggest a correction

  11. agnmktxplus.com
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    agnmktxplus.com
    First seen
    2026-11-12 05:41 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:36 UTC to 2027-02-10 05:35 UTC
    Logged 2026-11-12 05:36 UTC in DigiCert Sphinx2027h1, entry 451,182,578
    SHA-256 c3bb3d8094515308dfb83d49792c9b272dfc61d79b6bf381371de76aa8caa521
    Public key SHA-256 ad90ce1855d6af5fb7ec96b856188164c6ec4fdc802486d9471226725f94a45e
    Domain
    agnmktxplus.com
    Registered
    2026-01-20 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  12. checkout-tw.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    checkout-tw.com
    First seen
    2026-11-12 05:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:40 UTC to 2027-02-10 04:40 UTC
    Logged 2026-11-12 05:38 UTC in IPng Networks Gouda2027h1, entry 391,568,594
    SHA-256 1690c31fd446d14ef2abffa3ed17ae7410b535632aa7479ac10b854c50981b9c
    Public key SHA-256 aa7dee36cf95d9d92b3b1d590af7e628e80cd6ac8335444b2a73009e3076ed04
    Domain
    checkout-tw.com
    Registered
    2026-05-18 · Realtime Register B.V.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  13. demo.krakenauthtool.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder krakenauthtool.org, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    demo.krakenauthtool.org
    First seen
    2026-11-12 05:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing krakenauthtool.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-12 04:37 UTC to 2027-02-10 04:37 UTC
    Logged 2026-11-12 05:36 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,811,442
    SHA-256 0c834f9fcb16cf27cb8a44487d5281b7fc62b98a0fef4429cf2e011e4e27a2dd
    Public key SHA-256 6bbc6bcab5f63885ee2217ff5278a78d40b2d415970f63b87047c45fb39322c4
    PhishDestroy
    Addresses
    104.21.25.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.134.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.25.225, 172.67.134.207): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    krakenauthtool.org
    Registered
    2026-01-22 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 08:57 UTC

    Suggest a correction

  14. enanthem.de AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    enanthem.de
    First seen
    2026-11-12 05:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:38 UTC to 2027-02-10 04:38 UTC
    Logged 2026-11-12 05:37 UTC in Let's Encrypt Willow2027h1, entry 1,112,744,762
    SHA-256 216b239e048e755f9dedc98060046c4c14e8ae76341b160dc1e8ff9c78282373
    Public key SHA-256 3dc4a28a5d0e09eef72f709cfede82e0f4b82ab3194f7bff982b404ea450cff0
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates enanthem.de to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    enanthem.de
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:46 UTC

    Suggest a correction

  15. equifaxsettlementbreach.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    equifaxsettlementbreach.com
    First seen
    2026-11-12 05:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:38 UTC to 2027-02-10 04:38 UTC
    Logged 2026-11-12 05:36 UTC in Let's Encrypt Willow2027h1, entry 1,112,741,832
    SHA-256 9157cfcea071a36ee2c55345583f092b19911ed736916da37bf8dc8f74cd7473
    Public key SHA-256 ccc354e1a468a99989bf007e8be47b3dba4b5fc5ee44ba30855e55d1f37bebaf
    PhishDestroy
    Addresses
    103.224.182.253 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates equifaxsettlementbreach.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.253): a parking service. It answers for names that are typically for sale or unused.
    Domain
    equifaxsettlementbreach.com
    Registered
    2020-09-27 · GoDaddy.com, LLC
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  16. ext.shit.vc AE · AS216071 · VDSINA SERVERS TECH FZCO
    ListedUnder shit.vc, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 13 y ago
    DetailsHide
    Hostname
    ext.shit.vc
    First seen
    2026-11-12 05:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing shit.vc and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:42 UTC to 2027-02-10 04:42 UTC
    Logged 2026-11-12 05:40 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,862,473
    SHA-256 6d28834bf1139f08bee986e17e9b495d572acd0d70655e3ea4097c499e645efc
    Public key SHA-256 cde265f20d4eaff6e6b398cd29537ae938e69884b4df07955d3d8648822a46e6
    Addresses
    89.110.118.145 · United Arab Emirates · AS216071 VDSINA SERVERS TECH FZCO
    Domain
    shit.vc
    Registered
    2014-01-09 · Network Solutions, LLC
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-11 14:49 UTC

    Suggest a correction

  17. pandemicrecords2020.com US · AS13335 · Cloudflare, Inc.
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 2 y ago
    DetailsHide
    Hostname
    pandemicrecords2020.com
    First seen
    2026-11-12 05:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 04:39 UTC to 2027-02-10 05:38 UTC
    Logged 2026-11-12 05:39 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,849,004
    SHA-256 6909c5500a6bf6f428630aece83e15f989359a993e0a24ec4e779ca2a14d3f95
    Public key SHA-256 8e091eaf03360bbc95189d5d6e124b203875ee3faca675dae81ae255b6ea8019
    PhishDestroy
    Addresses
    23.227.38.73 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (23.227.38.73): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pandemicrecords2020.com
    Registered
    2024-10-05 · Tucows Domains Inc.
    MX
    Receives mail at mx.pandemicrecords2020.com.cust.b.hostedemail.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  18. staging.ledger-and-trust.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder ledger-and-trust.com, listed by MetaMaskMX absentSPF -allDMARC quarantineRegistered 12 d ago
    DetailsHide
    Hostname
    staging.ledger-and-trust.com
    First seen
    2026-11-12 05:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing ledger-and-trust.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 04:38 UTC to 2027-02-10 05:38 UTC
    Logged 2026-11-12 05:38 UTC in Google PlumbersArms2027h1, entry 750,033,112
    SHA-256 069dc86b265afad94cf1a1485c2352951e8f4da0f3c85bbb38ff22bcc6ed6f21
    Public key SHA-256 9b523d4bc50c4d0fe6fd41c09768246d5770eda931268a4c0bc0d56265dedd26
    Addresses
    162.159.140.98 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.0.96 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (162.159.140.98, 172.66.0.96): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ledger-and-trust.com
    Registered
    2026-10-31 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  19. tornedocash-eth.cfd AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX absentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    tornedocash-eth.cfd
    First seen
    2026-11-12 05:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:42 UTC to 2027-02-10 04:42 UTC
    Logged 2026-11-12 05:40 UTC in DigiCert Sphinx2027h1, entry 451,220,241
    SHA-256 60e2b80740e07eff35b0a16d603beb8d6a1300f3b365e5e67f03f353ec3c49a7
    Public key SHA-256 5157549b49f543be4342ecbc40a460d0c07b63545082be488c2ec5ea4f770dfe
    PhishDestroy
    Addresses
    103.224.182.250 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates tornedocash-eth.cfd to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.250): a parking service. It answers for names that are typically for sale or unused.
    Domain
    tornedocash-eth.cfd
    Registered
    2025-11-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  20. vitakruid-nl.buy-vera.com US · AS13335 · Cloudflare, Inc.
    ListedCloudflareUnder buy-vera.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    vitakruid-nl.buy-vera.com
    First seen
    2026-11-12 05:41 UTC
    Listing
    CERT Polska listed it 2026-09-09 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska, listing buy-vera.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 04:40 UTC to 2027-02-10 05:38 UTC
    Logged 2026-11-12 05:40 UTC in Google ParcelYard2027h1, entry 749,856,778
    SHA-256 18647896d117c35ca1eff88ccb58c7663546c29b31e48f9a17f8f2872dbb7547
    Public key SHA-256 027eb9970e7d2962449939ca3946a5269ede4f7a797f639aa765d05fca94757e
    Addresses
    104.18.13.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.13.234): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    buy-vera.com
    Registered
    2026-08-21 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 10:21 UTC

    Suggest a correction

  21. jxkljpff.shop US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    jxkljpff.shop
    First seen
    2026-11-12 05:36 UTC
    Listing
    CERT Polska listed it 2026-09-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:33 UTC to 2027-02-10 04:33 UTC
    Logged 2026-11-12 05:32 UTC in Google ParcelYard2027h1, entry 749,763,577
    SHA-256 1756be0ce9afae7df2e39e1b87b6b2ab604041cc57b4c63b3114eb630cdae1d5
    Public key SHA-256 30fd77cf2fc8cd5e0b2b20784f0f2c1a1b5160be5c8963b406c725276cce0627
    Addresses
    104.17.231.54 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.17.231.54): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jxkljpff.shop
    Registered
    2026-09-14 · Web Commerce Communication Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  22. kraksite-cc.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    kraksite-cc.pages.dev
    First seen
    2026-11-12 05:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:34 UTC to 2027-02-10 05:32 UTC
    Logged 2026-11-12 05:34 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,795,842
    SHA-256 742e51e2811eefc23c5bc62ca862bf1fdb95ad8aa3351e53d60a3c79c1f373b5
    Public key SHA-256 6dd58fa824bc6ab6d8fab55dd306c2bbbd009640d0c5083e0653c0acde7d3c41
    Addresses
    172.66.44.210 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.46 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.210, 172.66.47.46): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  23. marea-fortencia-ai.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    marea-fortencia-ai.com
    First seen
    2026-11-12 05:36 UTC
    Listing
    CERT Polska listed it 2026-07-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-14 02:43 UTC to 2026-12-13 03:43 UTC
    Logged 2026-11-12 05:31 UTC in DigiCert Wyvern2026h2, entry 2,220,208,996
    SHA-256 01dc4b8c88d9af94db2c26ece243907fc6d6d7faf3c8917be4ac0f94d6151170
    Public key SHA-256 71d0f7faf87e39b3cfe3c5310cdbabeac749727d8ca46e2bcbf7347e6a5bc407
    Addresses
    104.21.88.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.88.62, 172.67.173.82): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    marea-fortencia-ai.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  24. oferty-moje-3022.casa US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    oferty-moje-3022.casa
    First seen
    2026-11-12 05:36 UTC
    Listing
    CERT Polska listed it 2026-09-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:37 UTC to 2027-02-10 04:37 UTC
    Logged 2026-11-12 05:35 UTC in Google ParcelYard2027h1, entry 749,806,070
    SHA-256 74b544f0a42d737eb6327d71bf87c442a1daab6b5a13dc04ce17842428d4dead
    Public key SHA-256 34ff787da2d7800541ffa423ac01070d39d048297bd0a7a36609a08d458ca457
    Addresses
    104.21.71.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.247, 172.67.172.153): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    oferty-moje-3022.casa
    Registered
    2026-09-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  25. ventofinance-app.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ventofinance-app.com
    First seen
    2026-11-12 05:36 UTC
    Listing
    CERT Polska listed it 2026-07-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-13 23:33 UTC to 2026-12-13 00:31 UTC
    Logged 2026-11-12 05:34 UTC in DigiCert Wyvern2026h2, entry 2,220,215,349
    SHA-256 95c7e36be90cb50c6567cc9a76c59004c06fc8e72636749d7c8db7e75ed17df2
    Public key SHA-256 20fb2d5293626842163335c4cce943ac01fdaedbbf73984e86dbc2eda8a1571f
    Addresses
    104.21.18.65 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.18.65, 172.67.180.182): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ventofinance-app.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  26. zdshtkio.nlfvqray.wdfthlgv.vxpkobdl.wxeilrho.warhqnuy.ijdyvoge.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    zdshtkio.nlfvqray.wdfthlgv.vxpkobdl.wxeilrho.warhqnuy.ijdyvoge.gatewaylearning.ezgateway.net
    First seen
    2026-11-12 05:36 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 04:30 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:34 UTC to 2027-02-10 04:34 UTC
    Logged 2026-11-12 05:32 UTC in Google PlumbersArms2027h1, entry 749,967,284
    SHA-256 576fcd60877f1504c8b889a75d15ce1f48b19877a581ecdfb9400269c5f242eb
    Public key SHA-256 bfab1a4abd70bd5795993f7123eb648f88e3c968b5ef2a03f062934d99b5372d
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  27. chiarofondovio-app.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    chiarofondovio-app.com
    First seen
    2026-11-12 05:31 UTC
    Listing
    CERT Polska listed it 2026-07-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:29 UTC to 2027-02-10 05:28 UTC
    Logged 2026-11-12 05:29 UTC in Let's Encrypt Willow2027h1, entry 1,112,642,565
    SHA-256 6bad169ecf43e3d91d643dc1db59032bc84c69588c708303373f2c34d4c9da7a
    Public key SHA-256 b3e255d6ff3d7a0aabbcd910be384a757594d961adb446955895b6382849d6ab
    Addresses
    104.21.55.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.55.249, 172.67.174.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    chiarofondovio-app.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  28. depoplafonmurah.com US · AS15169 · Google LLC4 addresses
    ListedGoogleListed by MetaMaskMX absentSPF missingDMARC missingRegistered 54 d ago
    DetailsHide
    Hostname
    depoplafonmurah.com
    First seen
    2026-11-12 05:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-11-12 04:27 UTC to 2026-12-27 05:17 UTC
    Logged 2026-11-12 05:27 UTC in Geomys Tuscolo2026h2, entry 1,053,692,910
    SHA-256 4881755f9de538f7b665a7bf98a433e5d69387901a80074e99dd2724af0f33fd
    Public key SHA-256 27d77859a931762a62c87852373fc914c88a33ab6ae55af108a9aa09b832dbcb
    Addresses
    216.239.32.21 · United States · AS15169 GOOGLE - Google LLC · Google (cloud provider)
    216.239.34.21 · United States · AS15169 GOOGLE - Google LLC · Google (cloud provider)
    216.239.36.21 · United States · AS15169 GOOGLE - Google LLC · Google (cloud provider)
    216.239.38.21 · United States · AS15169 GOOGLE - Google LLC · Google (cloud provider)
    Google
    Google (216.239.32.21, 216.239.34.21, 216.239.36.21, 216.239.38.21): a cloud provider. It rents servers and addresses to its customers.
    Domain
    depoplafonmurah.com
    Registered
    2026-09-19 · PT Senyum Diskon Indonesia
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  29. dl001.etherbank.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder etherbank.net, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    dl001.etherbank.net
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing etherbank.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:25 UTC to 2027-02-10 05:25 UTC
    Logged 2026-11-12 05:25 UTC in Google ParcelYard2027h1, entry 749,687,746
    SHA-256 172dd02ef95ff3d06f41108d3306b2143b7bf7609bd600a77ec70fb95722e994
    Public key SHA-256 04f9dfbede180232e7384058176a4363678b5a3e7e40e7d7d0d4651c9c9b019c
    PhishDestroy
    Addresses
    104.21.93.125 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.226 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.93.125, 172.67.209.226): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    etherbank.net
    Registered
    2026-01-18 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 23:12 UTC

    Suggest a correction

  30. equip.au AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    equip.au
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:27 UTC in Google PlumbersArms2027h1, entry 749,894,090
    SHA-256 39c13664eb94d4ccd3f21318e2a709bacbf162438deb71b239e5d19ba55894ca
    Public key SHA-256 a506610ee57e593a9868c7ba8f1ba8255b25cc020caa09af644d913ab1e0c1b6
    PhishDestroy
    Addresses
    103.224.182.247 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates equip.au to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    equip.au
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  31. extrahelp.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 31 y ago
    DetailsHide
    Hostname
    extrahelp.com
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:26 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,686,573
    SHA-256 991fc31a302fc6cadb9cd04a9b332f73fbcd91275c4ff6b0be722015c17e7506
    Public key SHA-256 ed9496b60c6b05fc9db9c40c8f453e61fb36ac7800ca742c4536dcc1ef1d17ae
    PhishDestroy
    Addresses
    103.224.182.241 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates extrahelp.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.241): a parking service. It answers for names that are typically for sale or unused.
    Domain
    extrahelp.com
    Registered
    1996-03-23 · Above.com Pty Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  32. fernsehkameras.de AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    fernsehkameras.de
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:27 UTC in Google PlumbersArms2027h1, entry 749,894,090
    SHA-256 39c13664eb94d4ccd3f21318e2a709bacbf162438deb71b239e5d19ba55894ca
    Public key SHA-256 a506610ee57e593a9868c7ba8f1ba8255b25cc020caa09af644d913ab1e0c1b6
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates fernsehkameras.de to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fernsehkameras.de
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:35 UTC

    Suggest a correction

  33. freedomactionconference.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Trellian / Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    freedomactionconference.com
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:27 UTC in Google PlumbersArms2027h1, entry 749,894,925
    SHA-256 7453b2bce3433f022594ad0dcc84196f511fddb59d26a7d9404cf1d0da9991d5
    Public key SHA-256 d77def56585f8766e34fe1d3e3fdbafda336d182bc6c567e78b3ff4a5037c889
    PhishDestroy
    Addresses
    103.224.182.253 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Trellian / Above.com
    Trellian / Above.com (103.224.182.253): a parking service. It answers for names that are typically for sale or unused.
    Domain
    freedomactionconference.com
    Registered
    2023-11-14 · DropCatch.com 624 LLC
    MX
    Receives mail at alltheemails.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  34. gov.extrahelp.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder extrahelp.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 31 y ago
    DetailsHide
    Hostname
    gov.extrahelp.com
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing extrahelp.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:26 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,686,573
    SHA-256 991fc31a302fc6cadb9cd04a9b332f73fbcd91275c4ff6b0be722015c17e7506
    Public key SHA-256 ed9496b60c6b05fc9db9c40c8f453e61fb36ac7800ca742c4536dcc1ef1d17ae
    PhishDestroy
    Addresses
    103.224.182.241 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates extrahelp.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.241): a parking service. It answers for names that are typically for sale or unused.
    Domain
    extrahelp.com
    Registered
    1996-03-23 · Above.com Pty Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  35. instalac.equip.au AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder equip.au, reported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    instalac.equip.au
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing equip.au and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:27 UTC in Google PlumbersArms2027h1, entry 749,894,090
    SHA-256 39c13664eb94d4ccd3f21318e2a709bacbf162438deb71b239e5d19ba55894ca
    Public key SHA-256 a506610ee57e593a9868c7ba8f1ba8255b25cc020caa09af644d913ab1e0c1b6
    PhishDestroy
    Addresses
    103.224.182.247 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates equip.au to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    equip.au
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  36. outmail.extrahelp.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder extrahelp.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 31 y ago
    DetailsHide
    Hostname
    outmail.extrahelp.com
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing extrahelp.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:26 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,686,573
    SHA-256 991fc31a302fc6cadb9cd04a9b332f73fbcd91275c4ff6b0be722015c17e7506
    Public key SHA-256 ed9496b60c6b05fc9db9c40c8f453e61fb36ac7800ca742c4536dcc1ef1d17ae
    PhishDestroy
    Addresses
    103.224.182.241 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates extrahelp.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.241): a parking service. It answers for names that are typically for sale or unused.
    Domain
    extrahelp.com
    Registered
    1996-03-23 · Above.com Pty Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  37. set.equip.au AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder equip.au, reported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    set.equip.au
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing equip.au and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:27 UTC in Google PlumbersArms2027h1, entry 749,894,090
    SHA-256 39c13664eb94d4ccd3f21318e2a709bacbf162438deb71b239e5d19ba55894ca
    Public key SHA-256 a506610ee57e593a9868c7ba8f1ba8255b25cc020caa09af644d913ab1e0c1b6
    PhishDestroy
    Addresses
    103.224.182.247 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates equip.au to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.247): a parking service. It answers for names that are typically for sale or unused.
    Domain
    equip.au
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  38. ssa.extrahelp.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder extrahelp.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 31 y ago
    DetailsHide
    Hostname
    ssa.extrahelp.com
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing extrahelp.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:26 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,686,573
    SHA-256 991fc31a302fc6cadb9cd04a9b332f73fbcd91275c4ff6b0be722015c17e7506
    Public key SHA-256 ed9496b60c6b05fc9db9c40c8f453e61fb36ac7800ca742c4536dcc1ef1d17ae
    PhishDestroy
    Addresses
    103.224.182.241 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates extrahelp.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.241): a parking service. It answers for names that are typically for sale or unused.
    Domain
    extrahelp.com
    Registered
    1996-03-23 · Above.com Pty Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  39. ww25.freedomactionconference.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Trellian / Above.comUnder freedomactionconference.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    ww25.freedomactionconference.com
    First seen
    2026-11-12 05:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing freedomactionconference.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:28 UTC to 2027-02-10 04:28 UTC
    Logged 2026-11-12 05:27 UTC in Google PlumbersArms2027h1, entry 749,894,925
    SHA-256 7453b2bce3433f022594ad0dcc84196f511fddb59d26a7d9404cf1d0da9991d5
    Public key SHA-256 d77def56585f8766e34fe1d3e3fdbafda336d182bc6c567e78b3ff4a5037c889
    PhishDestroy
    Addresses
    103.224.182.253 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Trellian / Above.com
    Trellian / Above.com (103.224.182.253): a parking service. It answers for names that are typically for sale or unused.
    Domain
    freedomactionconference.com
    Registered
    2023-11-14 · DropCatch.com 624 LLC
    MX
    Receives mail at alltheemails.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  40. axeovixai-app.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    axeovixai-app.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    CERT Polska listed it 2026-07-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:23 UTC to 2027-02-10 05:22 UTC
    Logged 2026-11-12 05:23 UTC in Google ParcelYard2027h1, entry 749,661,586
    SHA-256 60088d283163d07efbdaf7b669c90cc6a01c88edbf2ad225fc609c1dce3aa3bb
    Public key SHA-256 31ba5d3033fd08d2ea06764f03a155860a7e9703ebb8bb890dcc62f03c1b0ce7
    Addresses
    104.21.7.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.130.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.7.122, 172.67.130.77): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    axeovixai-app.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  41. developer.fresh-focus.pro AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder fresh-focus.pro, reported by PhishDestroyMX absentSPF ~allDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    developer.fresh-focus.pro
    First seen
    2026-11-12 05:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing fresh-focus.pro and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-12 04:26 UTC to 2027-02-10 04:26 UTC
    Logged 2026-11-12 05:24 UTC in DigiCert Sphinx2027h1, entry 451,081,793
    SHA-256 95199a3a611f8e109846057306a91b3d5303dd5db517a32212eb7b3fb92a6256
    Public key SHA-256 0d8bd2fe97cad35efa8d6292415964783f3114821ae5a6a4846a8c0494eaf681
    PhishDestroy
    Addresses
    190.115.18.13 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    fresh-focus.pro
    Registered
    2026-02-18 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-11 14:49 UTC

    Suggest a correction

  42. freefireid2023.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    freefireid2023.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:22 UTC to 2027-02-10 04:22 UTC
    Logged 2026-11-12 05:20 UTC in Google Argon2027h1, entry 995,789,901
    SHA-256 4e570d1bc3ea4472d86afe36c48473e3da12eac82812e7a81c55aad9747d2d2f
    Public key SHA-256 f85f16c730e18d299f064e4f9ac41e22ba7c8339c85ae296372da56f2c4b6751
    PhishDestroy
    Addresses
    103.224.212.211 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates freefireid2023.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.211): a parking service. It answers for names that are typically for sale or unused.
    Domain
    freefireid2023.com
    Registered
    2024-06-26 · TurnCommerce, Inc. DBA NameBright.com
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  43. ledger-com-us-app-start.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    ledger-com-us-app-start.pages.dev
    First seen
    2026-11-12 05:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:23 UTC to 2027-02-10 05:21 UTC
    Logged 2026-11-12 05:23 UTC in DigiCert Wyvern2027h1, entry 508,168,340
    SHA-256 b29702d26ea46ac8d3b9381729c42a17da8877838630172e83bcace384797c10
    Public key SHA-256 5bf90f5822b3fc7ca04483e8803fa87838067b500df12bf3c40bed3ae10c8cb5
    Addresses
    172.66.44.155 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.155, 172.66.47.101): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  44. random.freefireid2023.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder freefireid2023.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    random.freefireid2023.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing freefireid2023.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:22 UTC to 2027-02-10 04:22 UTC
    Logged 2026-11-12 05:20 UTC in Google Argon2027h1, entry 995,789,901
    SHA-256 4e570d1bc3ea4472d86afe36c48473e3da12eac82812e7a81c55aad9747d2d2f
    Public key SHA-256 f85f16c730e18d299f064e4f9ac41e22ba7c8339c85ae296372da56f2c4b6751
    PhishDestroy
    Addresses
    103.224.212.211 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates freefireid2023.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.211): a parking service. It answers for names that are typically for sale or unused.
    Domain
    freefireid2023.com
    Registered
    2024-06-26 · TurnCommerce, Inc. DBA NameBright.com
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  45. revgrox-ai.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    revgrox-ai.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    CERT Polska listed it 2026-07-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:23 UTC to 2027-02-10 05:22 UTC
    Logged 2026-11-12 05:23 UTC in Google ParcelYard2027h1, entry 749,658,846
    SHA-256 50f92929863d103f300032a15f2d2bd25168bb13f57ac7db5d164b8a3ffc4752
    Public key SHA-256 db91daad0cf4a65d2f4de2dce146421bf4f88d1dc9ee89edf57c7f6d8a7c1c5a
    Addresses
    104.21.92.142 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.92.142, 172.67.195.48): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    revgrox-ai.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  46. webdisk.freefireid2023.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder freefireid2023.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    webdisk.freefireid2023.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing freefireid2023.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:22 UTC to 2027-02-10 04:22 UTC
    Logged 2026-11-12 05:20 UTC in Google Argon2027h1, entry 995,789,901
    SHA-256 4e570d1bc3ea4472d86afe36c48473e3da12eac82812e7a81c55aad9747d2d2f
    Public key SHA-256 f85f16c730e18d299f064e4f9ac41e22ba7c8339c85ae296372da56f2c4b6751
    PhishDestroy
    Addresses
    103.224.212.211 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates freefireid2023.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.211): a parking service. It answers for names that are typically for sale or unused.
    Domain
    freefireid2023.com
    Registered
    2024-06-26 · TurnCommerce, Inc. DBA NameBright.com
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  47. ww25.freefireid2023.com AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comUnder freefireid2023.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    ww25.freefireid2023.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing freefireid2023.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:22 UTC to 2027-02-10 04:22 UTC
    Logged 2026-11-12 05:20 UTC in Google Argon2027h1, entry 995,789,901
    SHA-256 4e570d1bc3ea4472d86afe36c48473e3da12eac82812e7a81c55aad9747d2d2f
    Public key SHA-256 f85f16c730e18d299f064e4f9ac41e22ba7c8339c85ae296372da56f2c4b6751
    PhishDestroy
    Addresses
    103.224.212.211 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates freefireid2023.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.211): a parking service. It answers for names that are typically for sale or unused.
    Domain
    freefireid2023.com
    Registered
    2024-06-26 · TurnCommerce, Inc. DBA NameBright.com
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  48. ww38.freefireid2023.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · Above.comUnder freefireid2023.com, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 2 y ago
    DetailsHide
    Hostname
    ww38.freefireid2023.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing freefireid2023.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:22 UTC to 2027-02-10 04:22 UTC
    Logged 2026-11-12 05:20 UTC in Google Argon2027h1, entry 995,789,901
    SHA-256 4e570d1bc3ea4472d86afe36c48473e3da12eac82812e7a81c55aad9747d2d2f
    Public key SHA-256 f85f16c730e18d299f064e4f9ac41e22ba7c8339c85ae296372da56f2c4b6751
    PhishDestroy
    Addresses
    185.53.179.200 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · Above.com
    The registry delegates freefireid2023.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. ParkingCrew (Team Internet) (185.53.179.200): a parking service. It answers for names that are typically for sale or unused.
    Domain
    freefireid2023.com
    Registered
    2024-06-26 · TurnCommerce, Inc. DBA NameBright.com
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  49. www.dmsfinland.com.drnsglobal.org US · AS26042 · FiberState, LLC
    ReportedUnder drnsglobal.org, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 12 mo ago
    DetailsHide
    Hostname
    www.dmsfinland.com.drnsglobal.org
    First seen
    2026-11-12 05:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing drnsglobal.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 04:26 UTC to 2027-02-10 04:26 UTC
    Logged 2026-11-12 05:25 UTC in Google ParcelYard2027h1, entry 749,678,843
    SHA-256 155bb0c2c089559b901e1f169d4da45b8c52bfdda429f9e6af1d510662ddcbc0
    Public key SHA-256 cfe65de1451b3d37a854d94bac24bd93dae0e64f118ae4f8c5f2c42052778c4c
    PhishDestroy
    Addresses
    206.168.149.10 · United States · AS26042 FIBERSTATE - FiberState, LLC
    Domain
    drnsglobal.org
    Registered
    2025-11-26 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Receives mail at drnsglobal.org
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-11 19:42 UTC

    Suggest a correction

  50. xaicore-fxempire.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    xaicore-fxempire.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-14 05:30 UTC to 2026-12-13 06:30 UTC
    Logged 2026-11-12 05:24 UTC in Let's Encrypt Sycamore2026h2, entry 1,102,999,531
    SHA-256 4b80a7d02f275381b38d1e6e422264f41fb5cc94044f7fd2351290eb00499c1f
    Public key SHA-256 cbaf32818c0a21ccdfcc3406409a65337c743a83bdf68c26c11ad01471ff1e42
    PhishDestroy
    Addresses
    104.21.39.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.170.209 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.39.148, 172.67.170.209): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xaicore-fxempire.com
    Registered
    2025-11-23 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:30 UTC

    Suggest a correction

  51. yeldunravu-belgium.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    yeldunravu-belgium.com
    First seen
    2026-11-12 05:26 UTC
    Listing
    CERT Polska listed it 2026-09-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-12 04:23 UTC to 2027-02-10 05:21 UTC
    Logged 2026-11-12 05:25 UTC in Sectigo Monument2027h1, entry 139,483,781
    SHA-256 a4859dffd3648844aa062815ff3e24a6ceece41b52de16a8c7fc646698632218
    Public key SHA-256 a024e4e310f8bae3d525f108d40449543d5e574a1709fe55f299af7ef757eda9
    Addresses
    104.21.83.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.53 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.83.6, 172.67.210.53): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    yeldunravu-belgium.com
    Registered
    2026-07-17 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  52. 108192.xyz.can.clouudflare.net RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ListedDDoS-GuardUnder clouudflare.net, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    108192.xyz.can.clouudflare.net
    First seen
    2026-11-12 05:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Listed
    MetaMask, listing clouudflare.net and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-12 04:19 UTC to 2027-02-10 04:19 UTC
    Logged 2026-11-12 05:18 UTC in DigiCert Sphinx2027h1, entry 451,014,839
    SHA-256 73d75963cfd0bcc04eb3a9b15a9823e810d6bd010f5a69943149bef6b89cab17
    Public key SHA-256 6d8b1a9f1f12b27a15eb92f7de592c5a154fb909b4a4608a2a72aced70328746
    Addresses
    45.10.243.43 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (45.10.243.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    clouudflare.net
    Registered
    2026-05-24 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 13:39 UTC

    Suggest a correction

  53. 80365365.com US · AS8075 · Microsoft Corporation2 addresses
    ReportedMicrosoft AzureReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    80365365.com
    First seen
    2026-11-12 05:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:17 UTC to 2027-02-10 04:17 UTC
    Logged 2026-11-12 05:16 UTC in Google PlumbersArms2027h1, entry 749,763,441
    SHA-256 03e555e55e1c3fceabd1472f5b589b0915702ab0715bcb813a538907089e5d37
    Public key SHA-256 8e90a5ab4dac06bdbc238b84e7d23bf43500b9cb1366788131eca8a9df1cd9d8
    PhishDestroy
    Addresses
    20.2.172.139 · United States · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation · Microsoft Azure (cloud provider)
    52.175.17.154 · United States · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation · Microsoft Azure (cloud provider)
    Microsoft Azure
    Microsoft Azure (20.2.172.139, 52.175.17.154): a cloud provider. It rents servers and addresses to its customers.
    Domain
    80365365.com
    Registered
    2013-12-03 · Internet Domain Service BS Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  54. buytrx.fi NL · AS209626 · Enflow Enflow B.V.3 addresses
    ReportedRedirect service · redirect.pizzaReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    buytrx.fi
    First seen
    2026-11-12 05:21 UTC
    First published
    2026-11-05 00:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-04 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    DNS
    Resolves · checked 2026-11-12 00:52 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:20 UTC to 2026-12-27 04:20 UTC
    Logged 2026-11-12 05:18 UTC in Google PlumbersArms2026h2, entry 1,651,613,848
    SHA-256 a2292d59e12796e9b732180763cb066d5d59a45fbaeb4380655673ea00ceda6e
    Public key SHA-256 8bcdfc170a82c5e13125d58ffffaff5d6d03ba44eb4f43533ca30cb8f2861ce3
    PhishDestroy
    Addresses
    89.106.200.1 · Netherlands · AS209626 Enflow Enflow B.V. · redirect.pizza (redirect service)
    2606:4700:3031::6815:2a1d
    2606:4700:3032::ac43:c794
    Redirect service · redirect.pizza
    redirect.pizza (89.106.200.1): a redirect service. The address forwards visitors to wherever the name’s owner points it.
    Domain
    buytrx.fi
    Registered
    2026-11-04
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 01:14 UTC

    Suggest a correction

  55. crescivoltaai-app.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    crescivoltaai-app.com
    First seen
    2026-11-12 05:21 UTC
    Listing
    CERT Polska listed it 2026-07-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:16 UTC to 2027-02-10 05:14 UTC
    Logged 2026-11-12 05:16 UTC in Google ParcelYard2027h1, entry 749,577,126
    SHA-256 ba0af2795bd9c21ac8e77c6bf5b94530320749460e8e37ecc4438a3f4f7ef677
    Public key SHA-256 b8ec33e98c2c7afa8b53e62b7533c12eb5c804dd3911978e5bf5b633de8a7256
    Addresses
    104.21.80.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.181.11 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.80.121, 172.67.181.11): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    crescivoltaai-app.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  56. gvvacademy.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    gvvacademy.com
    First seen
    2026-11-12 05:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:15 UTC to 2027-02-10 05:12 UTC
    Logged 2026-11-12 05:15 UTC in Google ParcelYard2027h1, entry 749,564,497
    SHA-256 864fa36fcf4c6db8d5b9b857286887902915899fcfd57ecaff696eab347696e9
    Public key SHA-256 4dacdacb15b953f3a8a75567ecc99a4990fed0a2bd8bde520bdafec84c84c336
    PhishDestroy
    Addresses
    104.21.23.128 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.211.71 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.23.128, 172.67.211.71): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gvvacademy.com
    Registered
    2023-05-31 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  57. jysk-depend.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    jysk-depend.shop
    First seen
    2026-11-12 05:21 UTC
    Listing
    CERT Polska listed it 2026-09-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    PhishDestroy: first observed in the feed 2026-10-31 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:16 UTC to 2027-02-10 05:16 UTC
    Logged 2026-11-12 05:16 UTC in Geomys Tuscolo2027h1, entry 586,258,254
    SHA-256 37ca6db73d175f1a71334195ae7f4c332c938096dde875bc948539a43490b463
    Public key SHA-256 617ba05c3ed7365be821be4791f5d540e893cb3f7addf0c7cf1d7ff70561c69e
    Addresses
    104.21.20.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.192.241 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.20.138, 172.67.192.241): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jysk-depend.shop
    Registered
    2026-09-14 · Dynadot Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:25 UTC

    Suggest a correction

  58. ledger.com-protected.info RO · AS39287 · materialism Materialism s.r…Ledger
    ListedUnder com-protected.info, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    ledger.com-protected.info
    First seen
    2026-11-12 05:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-12 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing com-protected.info and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:18 UTC to 2027-02-10 04:18 UTC
    Logged 2026-11-12 05:16 UTC in Google PlumbersArms2027h1, entry 749,765,654
    SHA-256 cba829b9530d0953650c930f0a0382498d42d3aa3ccde88d5a7adbe7fb139cc3
    Public key SHA-256 cfa79ecd9cad9c1de5684cc79bf9d2ec2ecc31c4822a68a71f691951daeb46e5
    Brand
    Ledger
    Addresses
    80.78.19.70 · Romania · AS39287 materialism Materialism s.r.l.
    Domain
    com-protected.info
    Registered
    2026-10-26 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  59. metamask.team US · AS13335 · Cloudflare, Inc.4 addressesMetaMask
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    metamask.team
    First seen
    2026-11-12 05:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:21 UTC to 2027-02-10 04:21 UTC
    Logged 2026-11-12 05:19 UTC in Google ParcelYard2027h1, entry 749,611,534
    SHA-256 7b90eead5a136fbad6ac656d5593acee6bc30bf7f5afa0df8bc29993f13c32bc
    Public key SHA-256 eaf2d2192657a0bb77b864dcdf52dd4edaa2debf7e8847a6d19b29adb9a1d70d
    Brand
    MetaMask
    Addresses
    104.21.61.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.204.225 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:cce1
    2606:4700:3036::6815:3d11
    Cloudflare
    Cloudflare (104.21.61.17, 172.67.204.225): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask.team
    Registered
    2026-05-19 · Devexpanse Ltd d/b/a Regery.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:25 UTC

    Suggest a correction

  60. ripplesoc.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    ripplesoc.com
    First seen
    2026-11-12 05:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:21 UTC to 2027-02-10 04:21 UTC
    Logged 2026-11-12 05:19 UTC in IPng Networks Gouda2027h1, entry 391,412,085
    SHA-256 5cb5a7291d1deaf25532ab8af1aea78705982234e8e2db9139b868ce37cbfea0
    Public key SHA-256 d6dff57c708a4b1c09ce6634171834a3795243e8edc09cc244859bef8842ce6f
    PhishDestroy
    Addresses
    104.21.91.34 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.96 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.34, 172.67.165.96): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ripplesoc.com
    Registered
    2026-05-19 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  61. trezor.io-protected.info RO · AS39287 · materialism Materialism s.r…Trezor
    ListedUnder io-protected.info, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    trezor.io-protected.info
    First seen
    2026-11-12 05:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-12 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing io-protected.info and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:18 UTC to 2027-02-10 04:18 UTC
    Logged 2026-11-12 05:16 UTC in DigiCert Wyvern2027h1, entry 508,101,102
    SHA-256 476a39251b683081f330c3c2e35ce528bd14432e149f846362f319155fd9b809
    Public key SHA-256 ef573b4204b48de76b78b652157159dd08fc32fa574c3a699190e13331f8f059
    Brand
    Trezor
    Addresses
    80.78.19.70 · Romania · AS39287 materialism Materialism s.r.l.
    Domain
    io-protected.info
    Registered
    2026-10-26 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  62. www.buytrx.fi NL · AS209626 · Enflow Enflow B.V.3 addresses
    ListedRedirect service · redirect.pizzaUnder buytrx.fi, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    www.buytrx.fi
    First seen
    2026-11-12 05:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-04 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Listed
    MetaMask, listing buytrx.fi and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:20 UTC to 2026-12-27 04:20 UTC
    Logged 2026-11-12 05:18 UTC in Geomys Tuscolo2026h2, entry 1,053,681,202
    SHA-256 38020f03ac685c41c10755d6c91f7b59a39f2a3bcd19e38002d0237042964745
    Public key SHA-256 d03e4cb2b937321c9207f9099d5e90cd5234d8ac37231af9224c98558d1a414b
    Addresses
    89.106.200.1 · Netherlands · AS209626 Enflow Enflow B.V. · redirect.pizza (redirect service)
    2606:4700:3031::6815:2a1d
    2606:4700:3032::ac43:c794
    Redirect service · redirect.pizza
    redirect.pizza (89.106.200.1): a redirect service. The address forwards visitors to wherever the name’s owner points it.
    Domain
    buytrx.fi
    Registered
    2026-11-04
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 01:14 UTC

    Suggest a correction

  63. www.sol-recovery.xyz US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder sol-recovery.xyz, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 24 mo ago
    DetailsHide
    Hostname
    www.sol-recovery.xyz
    First seen
    2026-11-12 05:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing sol-recovery.xyz and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-12 04:17 UTC to 2027-02-10 04:17 UTC
    Logged 2026-11-12 05:15 UTC in IPng Networks Halloumi2027h1, entry 465,909,051
    SHA-256 87cad13d7ef851016fb8e2112deca9412d734461acb17c32bf30d24a1699694b
    Public key SHA-256 294ae01641e615acbe110823ce0f22682b4d62c9b336b3c248bf6e8bf47296a7
    PhishDestroy
    Addresses
    216.150.1.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.193, 216.150.16.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    sol-recovery.xyz
    Registered
    2024-11-27 · NameCheap, Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 08:21 UTC

    Suggest a correction

  64. www.testdisk.app US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder testdisk.app, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    www.testdisk.app
    First seen
    2026-11-12 05:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Listed
    MetaMask, listing testdisk.app and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 04:16 UTC to 2027-02-10 04:16 UTC
    Logged 2026-11-12 05:15 UTC in Google ParcelYard2027h1, entry 749,557,757
    SHA-256 b35c12e45b1898ad92dbd528c1bbf6461c4357f7d8c83a948ece354b6f01f034
    Public key SHA-256 a7e78a6a4a5be7e6f2fafc92d2235017f958757b2226a19677c8d79f037222da
    Addresses
    104.21.9.236 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.9.236, 172.67.131.17): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    testdisk.app
    Registered
    2026-03-03 · Namecheap Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 08:09 UTC

    Suggest a correction

  65. xhyofavp.setkbndgi.qulknbix.cpowzarh.wviyzmqf.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    xhyofavp.setkbndgi.qulknbix.cpowzarh.wviyzmqf.tomjzfci.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-12 05:21 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 04:30 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:19 UTC to 2027-02-10 04:19 UTC
    Logged 2026-11-12 05:18 UTC in IPng Networks Halloumi2027h1, entry 465,942,193
    SHA-256 345f00d1ad7f8adf35f6902163ba1466135b97f6fd3476ae3e8b6ee279049e51
    Public key SHA-256 ecb2183ccaa30a200b7870113e997d8989f0737b3956e9c0d369624628616d61
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  66. 19599993333.com US · AS13335 · Cloudflare, Inc.
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    19599993333.com
    First seen
    2026-11-12 05:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:14 UTC to 2027-02-10 05:13 UTC
    Logged 2026-11-12 05:14 UTC in Geomys Tuscolo2027h1, entry 586,242,697
    SHA-256 a21302601fdf20140f23e11a2bed8acfa2894244dc88054ca727e0ea24d7decb
    Public key SHA-256 160310f209325eca88f3ff113052df30b51fed5dc93fb9296d6a8681f89bf4d2
    PhishDestroy
    Addresses
    23.145.152.202 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (23.145.152.202): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    19599993333.com
    Registered
    2022-06-13 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:20 UTC

    Suggest a correction

  67. bornsevut-app.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    bornsevut-app.com
    First seen
    2026-11-12 05:15 UTC
    Listing
    CERT Polska listed it 2026-07-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-12 04:14 UTC to 2027-02-10 05:13 UTC
    Logged 2026-11-12 05:14 UTC in GoDaddy Aquamarine2027h1, entry 217,961,466
    SHA-256 54304261c06047a5c040f1e3775de111ea889c4fed46e99344e23ca1bc70f8e3
    Public key SHA-256 9feee267359aecbc70e93e4d13e456f654c5824fe246a7f777391a4508bb1a83
    Addresses
    104.21.49.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.162.120 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.117, 172.67.162.120): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bornsevut-app.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  68. ejxe.lucifergin.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under lucifergin.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    ejxe.lucifergin.com
    First seen
    2026-11-12 05:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing lucifergin.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:12 UTC to 2027-02-10 04:12 UTC
    Logged 2026-11-12 05:11 UTC in Google PlumbersArms2027h1, entry 749,703,193
    SHA-256 97557c5e6e41aabbdcade78c3b6296e7e58ffe2d70a415ae68d21afc9c4eb34f
    Public key SHA-256 1c5edbd55c7b5f134dd7ef9ff59bd0f45a4754bc67db8881ec180de121e422f4
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    lucifergin.com
    Registered
    2023-01-04 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  69. janetshopping.store
    ListedListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    janetshopping.store
    First seen
    2026-11-12 05:15 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:12 UTC to 2027-02-10 05:11 UTC
    Logged 2026-11-12 05:12 UTC in Google PlumbersArms2027h1, entry 749,720,312
    SHA-256 13be1e3f15c13590d1037139dfb892e0cbf25f2b54a734706fc11f356a7dac14
    Public key SHA-256 022f2b22c141c34d0210965e5494c2a5ba1c6e896a6e2d47096f630eb0fbe8c8
    Domain
    janetshopping.store
    Registered
    2026-01-20 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  70. jaxx-wallet.us US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    jaxx-wallet.us
    First seen
    2026-11-12 05:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:11 UTC to 2027-02-10 05:10 UTC
    Logged 2026-11-12 05:12 UTC in DigiCert Wyvern2027h1, entry 508,066,199
    SHA-256 02c559438c5bafa3a9d314c3122e4ad88a76d523fc23ffdffca1f976c6d205a3
    Public key SHA-256 b010a462230a7728b6c861bc0e2d5e4f110ae86d5aa486704ce60a32ea7c71cd
    PhishDestroy
    Addresses
    104.21.56.240 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.188.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.56.240, 172.67.188.48): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jaxx-wallet.us
    Registered
    2026-06-07 · Spaceship, Inc.
    MX
    Receives mail at mx.stackmail.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  71. prnro0.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    prnro0.hdiv8jy.com
    First seen
    2026-11-12 05:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:14 UTC to 2027-02-10 04:14 UTC
    Logged 2026-11-12 05:13 UTC in Geomys Tuscolo2027h1, entry 586,221,676
    SHA-256 767574d4e7067c5925bd0a77f049a988ed44c0f78386dea75fb281de85d54d07
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  72. ravelelia-ai.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ravelelia-ai.com
    First seen
    2026-11-12 05:15 UTC
    Listing
    CERT Polska listed it 2026-07-18 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:15 UTC to 2027-02-10 05:13 UTC
    Logged 2026-11-12 05:15 UTC in DigiCert Wyvern2027h1, entry 508,088,965
    SHA-256 6ab40c68e32127632251b10e12f3c19b774bff020438cae5f7477940e465741c
    Public key SHA-256 3362a1983c85c4f89238b7ba23310ecac366c1042d70693b6cd2f5ba648b8703
    Addresses
    104.21.30.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.30.74, 172.67.172.62): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ravelelia-ai.com
    Registered
    2026-07-16 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  73. ry4uen.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    ry4uen.hdiv8jy.com
    First seen
    2026-11-12 05:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:13 UTC to 2027-02-10 04:13 UTC
    Logged 2026-11-12 05:11 UTC in Let's Encrypt Willow2027h1, entry 1,112,427,834
    SHA-256 16ce6b9dbbcc38a594fbefde7f850def54e443ee028a17136bb629145f090c4c
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  74. u1w25w.hdiv8jy.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under hdiv8jy.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    u1w25w.hdiv8jy.com
    First seen
    2026-11-12 05:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing hdiv8jy.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:14 UTC to 2027-02-10 04:14 UTC
    Logged 2026-11-12 05:13 UTC in Google PlumbersArms2027h1, entry 749,722,901
    SHA-256 99d99f057b4baf42390a4d805dae5e73f258bb49d381ffe8cacbfe60b8ab65be
    Public key SHA-256 a89d885e2b8f4c5443bd17ff4a0453ebe7f939d5699c249beeab10aa7bb11c14
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hdiv8jy.com
    Registered
    2026-06-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  75. www.bep-check.info US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder bep-check.info, reported by PhishDestroyMX absentSPF missingDMARC quarantineRegistered 13 mo ago
    DetailsHide
    Hostname
    www.bep-check.info
    First seen
    2026-11-12 05:15 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing bep-check.info and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-12 05:13 UTC to 2027-05-29 05:13 UTC
    Logged 2026-11-12 05:13 UTC in GoDaddy Aquamarine2027h1, entry 217,957,861
    SHA-256 d67e52e93d22d2882b1bf232797f604477e0a26721cf88b047249c5066b32473
    Public key SHA-256 2f049e564325edf3565236a6765fd597bba019df06f17253fbe919bbb95f7b77
    PhishDestroy
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    bep-check.info
    Registered
    2025-10-28 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-12 03:16 UTC

    Suggest a correction

  76. 598437coinbase.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    598437coinbase.com
    First seen
    2026-11-12 05:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:11 UTC to 2027-02-10 04:11 UTC
    Logged 2026-11-12 05:10 UTC in DigiCert Sphinx2027h1, entry 450,948,280
    SHA-256 34a22ee5d5c42dff014468a7755756a17941c6f47197ff104bfa233c8dbdf243
    Public key SHA-256 43a369ccfcbb9240c56cf170f66afcaee5fe01dd7361d319a3bb8d79cdcff48d
    Addresses
    104.21.19.235 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.190.120 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:be78
    2606:4700:3035::6815:13eb
    Cloudflare
    Cloudflare (104.21.19.235, 172.67.190.120): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    598437coinbase.com
    Registered
    2026-05-19 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  77. apiadmin.ppay.ng BD · AS153568 · NEW DHAKA HARDWARE
    ReportedUnder ppay.ng, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    apiadmin.ppay.ng
    First seen
    2026-11-12 05:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing ppay.ng and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-12 04:07 UTC to 2027-02-10 04:07 UTC
    Logged 2026-11-12 05:06 UTC in Google ParcelYard2027h1, entry 749,451,695
    SHA-256 1a749a7d8deae99dd07ce2e252a823939aee176cc9fa0143042f69d79dcfe51e
    Public key SHA-256 3d2c4981c37033730a438b99abdf7c2ed0e35385265f82db00952074e8b5472b
    PhishDestroy
    Addresses
    163.61.188.7 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    ppay.ng
    Registered
    2026-01-24 · smartweb
    MX
    Receives mail at ppay.ng
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    MX listing
    Mail server ppay.ng at 163.61.188.7 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.2 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-11 08:15 UTC

    Suggest a correction

  78. bjniltde.oxirczje.jfpeoraqd.vurehdli.baytqfwi.asmjiuvo.ijdyvoge.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    bjniltde.oxirczje.jfpeoraqd.vurehdli.baytqfwi.asmjiuvo.ijdyvoge.gatewaylearning.ezgateway.net
    First seen
    2026-11-12 05:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 04:30 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:09 UTC to 2027-02-10 04:09 UTC
    Logged 2026-11-12 05:08 UTC in Google ParcelYard2027h1, entry 749,473,274
    SHA-256 8f6af841cb5b17ac35c5d155cfba0d2787656a79f690dbb4f27c21f47cfe0650
    Public key SHA-256 80595a8cf35703439b7077390f25842fc52e48a8aeb092efaaa5d95821921d6d
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  79. bluequbitai-pro.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT Polska
    DetailsHide
    Hostname
    bluequbitai-pro.pages.dev
    First seen
    2026-11-12 05:10 UTC
    Listing
    CERT Polska listed it 2026-10-25 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-09-30 18:40 UTC to 2026-12-29 18:40 UTC
    Logged 2026-11-12 05:09 UTC in DigiCert Wyvern2026h2, entry 2,220,177,810
    SHA-256 6420732e478927270b1cea1ff577a3f169df7244f08d65b25204bb4e030f4828
    Public key SHA-256 83fb6fb753eca6c3aa056df684d9eab5a0763beb82292af2ecd46d33a391acfe
    Addresses
    172.66.44.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.198 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.58, 172.66.47.198): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  80. connect-ledgre.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    connect-ledgre.pages.dev
    First seen
    2026-11-12 05:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-12 04:06 UTC to 2027-02-10 05:05 UTC
    Logged 2026-11-12 05:06 UTC in DigiCert Wyvern2027h1, entry 508,014,562
    SHA-256 cdc8dc21ef846474852e2673a517d3d477e9965c7d8d673307c428ff084fe16a
    Public key SHA-256 05e15026ecaeb3479b493769f7e335e99a05b976a05595cec9b02a9b522d8ddc
    Addresses
    172.66.44.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.12 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.244, 172.66.47.12): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  81. ejoxi.lucifergin.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under lucifergin.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    ejoxi.lucifergin.com
    First seen
    2026-11-12 05:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing lucifergin.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:11 UTC to 2027-02-10 04:11 UTC
    Logged 2026-11-12 05:09 UTC in Google ParcelYard2027h1, entry 749,488,188
    SHA-256 cb3ee1f9048727acf4622f5d0971d2dbf8e850dd2c35ac24e5bfe9b761081772
    Public key SHA-256 1c5edbd55c7b5f134dd7ef9ff59bd0f45a4754bc67db8881ec180de121e422f4
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    lucifergin.com
    Registered
    2023-01-04 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  82. enter-hyperfoundations.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    enter-hyperfoundations.com
    First seen
    2026-11-12 05:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 04:06 UTC to 2027-02-10 04:06 UTC
    Logged 2026-11-12 05:05 UTC in Google PlumbersArms2027h1, entry 749,626,753
    SHA-256 2ee01e3847e66166b010ea9622a82c1de98e08cab39b33cf621554d6d4e7477f
    Public key SHA-256 0215673bfcbdc14e41673de23668dc4e991713dc33ea52f2dee722ab38b0e5f3
    Addresses
    104.21.95.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.170.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.95.182, 172.67.170.249): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    enter-hyperfoundations.com
    Registered
    2026-05-18 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  83. hsven.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    hsven.shop
    First seen
    2026-11-12 05:10 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:08 UTC to 2027-02-10 04:08 UTC
    Logged 2026-11-12 05:06 UTC in IPng Networks Halloumi2027h1, entry 465,810,694
    SHA-256 a344fcd1c049a5a895a955ca64a9a77e861c9f386f93ecc5f0647cb0b4d4f96f
    Public key SHA-256 e56c0f5b47ff419dc8fce820341cc14c8ee42c9def6ad20fca3d74466369618c
    Addresses
    104.21.9.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.9.216, 172.67.131.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hsven.shop
    Registered
    2026-05-19 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  84. prajwalaindia.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ReportedHostingerReported by PhishDestroyMX presentSPF ~allDMARC quarantineRegistered 19 y ago
    DetailsHide
    Hostname
    prajwalaindia.com
    First seen
    2026-11-12 05:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:11 UTC to 2027-02-10 04:11 UTC
    Logged 2026-11-12 05:10 UTC in Geomys Tuscolo2027h1, entry 586,185,834
    SHA-256 2477b32db838ce399d16ae19760bded1fa1aa92b0c2c130c35f28dd43de162d9
    Public key SHA-256 d3f0cf8fda97d294a513d2f4ba9ca03bd598f663993db8809f7f0041fac7b141
    PhishDestroy
    Addresses
    187.127.135.113 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (187.127.135.113): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    prajwalaindia.com
    Registered
    2007-08-24 · GoDaddy.com, LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  85. rtbry.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    rtbry.com
    First seen
    2026-11-12 05:10 UTC
    Listing
    CERT Polska listed it 2026-05-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:07 UTC to 2027-02-10 04:07 UTC
    Logged 2026-11-12 05:06 UTC in IPng Networks Halloumi2027h1, entry 465,802,763
    SHA-256 37f04a26bc6888809a63b4e09b3ecc5c8a9c933407bd0a98c42083c3bb60c451
    Public key SHA-256 bcca59756f8cf64ab28445ae240b459c43493a0213da111c5e0d875e0b40cc80
    Addresses
    104.21.68.28 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.68.28, 172.67.185.122): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rtbry.com
    Registered
    2026-05-18 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  86. vip.polar-tensor.com DE · AS51167 · CONTABO Contabo GmbH4 addresses
    ListedContabo +1Under polar-tensor.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    vip.polar-tensor.com
    First seen
    2026-11-12 05:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing polar-tensor.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:07 UTC to 2027-02-10 04:07 UTC
    Logged 2026-11-12 05:06 UTC in Google ParcelYard2027h1, entry 749,447,994
    SHA-256 89d694ea99aa89d9b34a565b0b7a542f84154d92ff6d68edf5bef9c3be562c09
    Public key SHA-256 cf17445baec7ebbfb6d0e051a401ef7e91b46391ffbaf853be10da561de2ebb4
    Addresses
    5.189.134.86 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    57.128.187.75 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    57.129.49.179 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    193.242.211.59 · Germany · AS58329 SERVINGA-NL servinga GmbH
    Contabo +1
    Contabo (5.189.134.86): a cloud provider. It rents servers and addresses to its customers. OVH (57.128.187.75, 57.129.49.179): a cloud provider. It rents servers and addresses to its customers.
    Domain
    polar-tensor.com
    Registered
    2025-04-28 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 19:42 UTC

    Suggest a correction

  87. www.apiadmin.ppay.ng BD · AS153568 · NEW DHAKA HARDWARE
    ReportedUnder ppay.ng, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    www.apiadmin.ppay.ng
    First seen
    2026-11-12 05:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing ppay.ng and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-12 04:07 UTC to 2027-02-10 04:07 UTC
    Logged 2026-11-12 05:06 UTC in Google ParcelYard2027h1, entry 749,451,695
    SHA-256 1a749a7d8deae99dd07ce2e252a823939aee176cc9fa0143042f69d79dcfe51e
    Public key SHA-256 3d2c4981c37033730a438b99abdf7c2ed0e35385265f82db00952074e8b5472b
    PhishDestroy
    Addresses
    163.61.188.7 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    ppay.ng
    Registered
    2026-01-24 · smartweb
    MX
    Receives mail at ppay.ng
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    MX listing
    Mail server ppay.ng at 163.61.188.7 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.2 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-11 08:15 UTC

    Suggest a correction

  88. www.prajwalaindia.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    ReportedHostingerUnder prajwalaindia.com, reported by PhishDestroyMX presentSPF ~allDMARC quarantineRegistered 19 y ago
    DetailsHide
    Hostname
    www.prajwalaindia.com
    First seen
    2026-11-12 05:10 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy, listing prajwalaindia.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:11 UTC to 2027-02-10 04:11 UTC
    Logged 2026-11-12 05:10 UTC in Geomys Tuscolo2027h1, entry 586,185,834
    SHA-256 2477b32db838ce399d16ae19760bded1fa1aa92b0c2c130c35f28dd43de162d9
    Public key SHA-256 d3f0cf8fda97d294a513d2f4ba9ca03bd598f663993db8809f7f0041fac7b141
    PhishDestroy
    Addresses
    187.127.135.113 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (187.127.135.113): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    prajwalaindia.com
    Registered
    2007-08-24 · GoDaddy.com, LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  89. xksvnymr.vknylhwa.rjikfbyn.xekjotzr.gdsyrcwk.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net FR · AS16276 · OVH OVH SAS
    ListedOVHUnder ezgateway.net, listed by USOMMX absentSPF -allDMARC rejectRegistered 7 mo ago
    DetailsHide
    Hostname
    xksvnymr.vknylhwa.rjikfbyn.xekjotzr.gdsyrcwk.gecxorwd.tczglrpw.gatewaylearning.ezgateway.net
    First seen
    2026-11-12 05:10 UTC
    Listing
    USOM listed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 04:30 UTC
    Listed
    USOM, listing ezgateway.net and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:09 UTC to 2027-02-10 04:09 UTC
    Logged 2026-11-12 05:08 UTC in Let's Encrypt Willow2027h1, entry 1,112,380,654
    SHA-256 339c2ca93b44a695a4671f3fcbb72d6fcdb253c3997fbe854fc1c80c9c9b5711
    Public key SHA-256 6cb8bb07b377e6cb442b161ef007d3d7003925fdb2291a11a790ceaeb8d7a463
    Addresses
    15.204.116.29 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.204.116.29): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ezgateway.net
    Registered
    2026-04-07 · Dynu Systems Incorporated
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  90. 111pj8.cc US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    111pj8.cc
    First seen
    2026-11-12 05:06 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-11-12 04:01 UTC to 2027-02-10 04:59 UTC
    Logged 2026-11-12 05:01 UTC in DigiCert Wyvern2027h1, entry 507,949,907
    SHA-256 512880ef8f438b9ae69e0f5f923539eaf8e63242746f0261acaa0a4d863bec74
    Public key SHA-256 85c8c2640b2e8e78e9bb1492fcf25eb4cd2ce6d4f652441f25a18614c099ed01
    PhishDestroy
    Addresses
    104.21.35.167 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.177.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.167, 172.67.177.173): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    111pj8.cc
    Registered
    2025-11-21 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:09 UTC

    Suggest a correction

  91. 11ysb8.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    11ysb8.com
    First seen
    2026-11-12 05:06 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 04:05 UTC to 2027-02-10 04:05 UTC
    Logged 2026-11-12 05:04 UTC in DigiCert Sphinx2027h1, entry 450,892,734
    SHA-256 48ffa748389fe100003a68d468aa545951d1a3f90a6bc3becafb21e4e959b33e
    Public key SHA-256 2f6a2d9723381ae74346a932b5408535c50a8a066fd543bc3a76c46a0ee3a010
    PhishDestroy
    Addresses
    104.21.94.87 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.147 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.94.87, 172.67.221.147): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    11ysb8.com
    Registered
    2026-03-17 · Hello Internet Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  92. 482932-coinspot.com US · AS13335 · Cloudflare, Inc.4 addressesCoinSpot
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    482932-coinspot.com
    First seen
    2026-11-12 05:06 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:06 UTC to 2027-02-10 04:06 UTC
    Logged 2026-11-12 05:04 UTC in DigiCert Sphinx2027h1, entry 450,901,212
    SHA-256 98906de5590dd077e649bf1956b8d99aea9a151994ab3252bd973af00d607270
    Public key SHA-256 70e4a2a5a5f3eac355b37965999062c962c16719d4bc0ea13ef0097c8c8ed032
    Brand
    CoinSpot
    Addresses
    104.21.31.70 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.64 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:af40
    2606:4700:3037::6815:1f46
    Cloudflare
    Cloudflare (104.21.31.70, 172.67.175.64): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    482932-coinspot.com
    Registered
    2026-09-14 · CNOBIN INFORMATION TECHNOLOGY LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:15 UTC

    Suggest a correction

  93. checker-hylo.app US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    checker-hylo.app
    First seen
    2026-11-12 05:06 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 04:04 UTC to 2027-02-10 05:03 UTC
    Logged 2026-11-12 05:04 UTC in DigiCert Wyvern2027h1, entry 507,991,655
    SHA-256 135d1342b6b7a106eaea60f380d2e09f660aade51794b6af950772eb611c41dc
    Public key SHA-256 1ac38616215b27b628c6db730fbe8c39229e759376959b360aa3868c9e3112b9
    Addresses
    104.21.91.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.175.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.157, 172.67.175.86): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    checker-hylo.app
    Registered
    2026-09-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  94. dappwiseamm.com ZA · AS328608 · Africa on Cloud
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    dappwiseamm.com
    First seen
    2026-11-12 05:06 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-12 04:04 UTC to 2027-02-10 04:04 UTC
    Logged 2026-11-12 05:03 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,384,894
    SHA-256 74fd8357d93b2b09370a8f8fc83805c76548fb7ed09af532076f0bc00a0d250c
    Public key SHA-256 de3fe78931daa8d61abd13c4d91d48bcab8cf49c7bccea94c226e1eb65450a53
    PhishDestroy
    Addresses
    45.197.20.2 · South Africa · AS328608 Africa on Cloud - Africa on Cloud
    Domain
    dappwiseamm.com
    Registered
    2025-04-08 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  95. exho.pro AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    exho.pro
    First seen
    2026-11-12 05:06 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:02 UTC to 2027-02-10 04:02 UTC
    Logged 2026-11-12 05:00 UTC in DigiCert Sphinx2027h1, entry 450,860,365
    SHA-256 73d87abb8c80583b94dc3366ee77f2de181da66817d91e4c9a14f98a47010979
    Public key SHA-256 d98fdb50db7db2c917ee78a462dd885640da46079e471ff96f7c8853edf16f08
    PhishDestroy
    Addresses
    103.224.212.217 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates exho.pro to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.217): a parking service. It answers for names that are typically for sale or unused.
    Domain
    exho.pro
    Registered
    2026-04-22 · CommuniGal Communication Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  96. gzsjjty.com US · AS54801 · Zillion Network Inc.Ministry of Internal Affairs and Communications (MIC)
    ListedListed by JPCERT/CC as imitating 総務省MX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    gzsjjty.com
    First seen
    2026-11-12 05:06 UTC
    Listing
    JPCERT/CC confirmed it 2026-08-04 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 02:17 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 04:04 UTC to 2027-02-10 04:04 UTC
    Logged 2026-11-12 05:03 UTC in Google PlumbersArms2027h1, entry 749,599,596
    SHA-256 329cd5b46a5e2e4875a4552aafbe721ccea17d289dd849424a7ca0331dff894f
    Public key SHA-256 8b9ccc19377f93285baf57928d4efffe98ef2f6e54cf9ffa3deaff02b3e37f61
    Brand
    Ministry of Internal Affairs and Communications (MIC)
    Addresses
    207.60.18.158 · United States · AS54801 ZILLION-NETWORK - Zillion Network Inc.
    Domain
    gzsjjty.com
    Registered
    2026-11-11 · GMO Internet Group, Inc. d/b/a Onamae.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  97. jira.yfwp.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under yfwp.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 19 y ago
    DetailsHide
    Hostname
    jira.yfwp.com
    First seen
    2026-11-12 05:06 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:07 UTC
    Listed
    MetaMask, listing yfwp.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:04 UTC to 2027-02-10 04:04 UTC
    Logged 2026-11-12 05:03 UTC in DigiCert Wyvern2027h1, entry 507,972,227
    SHA-256 1d8526ed2787856296f4d629bb82697b09073c0835df89764089f1e57c0d019b
    Public key SHA-256 52f1fc371c733e4865c446b771f1f8d937e708564ad266b468b7de57effeeac8
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    yfwp.com
    Registered
    2007-09-10 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 09:15 UTC

    Suggest a correction

  98. magic-rust.ru RU · AS49542 · AS-ARTPLANET ArtPlanet LLC
    ReportedReported by PhishDestroyMX presentDMARC missing
    DetailsHide
    Hostname
    magic-rust.ru
    First seen
    2026-11-12 05:06 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 04:01 UTC to 2027-02-10 04:01 UTC
    Logged 2026-11-12 05:00 UTC in DigiCert Wyvern2027h1, entry 507,940,731
    SHA-256 1ad8c2126f5ac2cd1b1caed4fdc8fdb55af77bdfa543f649c064cf448af38f5c
    Public key SHA-256 ff206fcacb05a9a730c94c44ec2b2dbd4c4198918a02713dc1590d4e51ae7d40
    PhishDestroy
    Addresses
    185.97.254.134 · Russia · AS49542 AS-ARTPLANET ArtPlanet LLC
    Domain
    magic-rust.ru
    MX
    Receives mail at mx.yandex.net
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:14 UTC

    Suggest a correction

  99. militaria-discount.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    militaria-discount.shop
    First seen
    2026-11-12 05:06 UTC
    Listing
    CERT Polska listed it 2026-05-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 03:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 04:06 UTC to 2027-02-10 04:06 UTC
    Logged 2026-11-12 05:05 UTC in DigiCert Wyvern2027h1, entry 507,995,049
    SHA-256 796ff8253bb6e02c8d04807658a52a4a015b047f4a64b3fe1c2abde2c4e5edc3
    Public key SHA-256 9a253eb99320fba2f9aab69d4e98f2bea69f00fbe983a8d953aa3e87ee04b335
    Addresses
    104.21.72.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.151.95 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.72.143, 172.67.151.95): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    militaria-discount.shop
    Registered
    2026-05-19 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

  100. onchainbitwise.com ZA · AS328608 · Africa on Cloud
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 23 mo ago
    DetailsHide
    Hostname
    onchainbitwise.com
    First seen
    2026-11-12 05:06 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 00:05 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-12 04:04 UTC to 2027-02-10 04:04 UTC
    Logged 2026-11-12 05:03 UTC in Let's Encrypt Sycamore2027h1, entry 1,158,384,894
    SHA-256 74fd8357d93b2b09370a8f8fc83805c76548fb7ed09af532076f0bc00a0d250c
    Public key SHA-256 de3fe78931daa8d61abd13c4d91d48bcab8cf49c7bccea94c226e1eb65450a53
    PhishDestroy
    Addresses
    45.197.20.2 · South Africa · AS328608 Africa on Cloud - Africa on Cloud
    Domain
    onchainbitwise.com
    Registered
    2025-01-03 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 05:55 UTC

    Suggest a correction

Showing 1–100 of 5,866 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources