Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-12 08:07 UTC
Certificate-log entries · 24 h
338.8M
from 84 distinct feeds
Unique certificates · 24 h
34.9M
each reviewed
Names resolved · 24 h
21.9M
16.1M with an address
Findings · 24 h
6,439
253 of 1,061 brands targeted

5,644 hostnames from the last 24 hours.

The findings have updated. The list starts again from the top.

  1. akceptacja-ofert.study US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    akceptacja-ofert.study
    First seen
    2026-11-12 08:05 UTC
    Listing
    CERT Polska listed it 2026-09-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 07:05 UTC to 2027-02-10 07:04 UTC
    Logged 2026-11-12 08:03 UTC in Google PlumbersArms2027h1, entry 751,749,577
    SHA-256 3550e7b66ecf11eaa575296ad12074d6c8dd53b7f3ed6b9cbcdcf1e33da6c86c
    Public key SHA-256 4102b0f2474af6b833f718f93edb2358fa2bd595033fe4b53f7724ee74b2f81c
    Addresses
    104.21.35.226 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.35.226, 172.67.180.86): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    akceptacja-ofert.study
    Registered
    2026-09-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  2. bunmopa.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    bunmopa.xyz
    First seen
    2026-11-12 08:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 07:03 UTC to 2027-02-10 07:03 UTC
    Logged 2026-11-12 08:01 UTC in Google PlumbersArms2027h1, entry 751,723,681
    SHA-256 c0e2d4b25f091ff14e1c5c6a76dba15a1bbcb0ae4a1fe10a5e98d41edccbdd83
    Public key SHA-256 a84234c04900c12dfee6e8dec326d722d093a037cd0bbe8dba75690ac1153c91
    Addresses
    104.21.85.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.200.175 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.85.10, 172.67.200.175): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bunmopa.xyz
    Registered
    2026-05-19 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  3. chaletvelo.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Listed by MetaMaskMX absentSPF missingDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    chaletvelo.com
    First seen
    2026-11-12 08:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 07:05 UTC to 2027-02-10 07:05 UTC
    Logged 2026-11-12 08:03 UTC in IPng Networks Halloumi2027h1, entry 467,476,085
    SHA-256 4c23b450928c1079f865bedaee6b10443dcc8149dd628d1c79ce52cd9aa04fa9
    Public key SHA-256 7d901d32b19e24d7356576544baf0259b69f85ffb687cc910c544e2bffa4db21
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    chaletvelo.com
    Registered
    2016-08-09 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 08:45 UTC

    Suggest a correction

  4. dkhurnd.com
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    dkhurnd.com
    First seen
    2026-11-12 08:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 07:01 UTC to 2027-02-10 07:58 UTC
    Logged 2026-11-12 08:01 UTC in DigiCert Wyvern2027h1, entry 509,678,115
    SHA-256 c109e1c4116a6babd600b2eb5f0109eddf75c059ebfe679a26548ec03605ad68
    Public key SHA-256 0909734676148591aeae1aeffaae511ddd93b485c284adb2bd3db7eb5b86b398
    Domain
    dkhurnd.com
    Registered
    2025-11-23 · Metaregistrar BV
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  5. fyd.1doc-shop.com AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder 1doc-shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    fyd.1doc-shop.com
    First seen
    2026-11-12 08:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing 1doc-shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-12 07:01 UTC to 2027-02-10 07:01 UTC
    Logged 2026-11-12 08:00 UTC in Geomys Tuscolo2027h1, entry 587,703,461
    SHA-256 beaeeaf5307a334f5b5673655a97a7e9f27e95363bf3826738ef4873dbd3f48c
    Public key SHA-256 ed4b9e026a98cdf40747fe30269522b48b0d55e68b3685df0e2214cce2d87793
    PhishDestroy
    Addresses
    186.2.175.208 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    1doc-shop.com
    Registered
    2026-05-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 13:39 UTC

    Suggest a correction

  6. ge.n0de.tv-giveaway.com GB · AS213887 · WAICORE-LTD WAIcore Ltd
    ListedUnder tv-giveaway.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    ge.n0de.tv-giveaway.com
    First seen
    2026-11-12 08:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Listed
    MetaMask, listing tv-giveaway.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 07:05 UTC to 2027-02-10 07:05 UTC
    Logged 2026-11-12 08:04 UTC in Let's Encrypt Willow2027h1, entry 1,114,439,524
    SHA-256 4363e63098de02c2a0c98bae576e0e01962dfc6b3abfedcf386759b4161a4593
    Public key SHA-256 365cbbcb50c5ab912030c0cd5bebe063c1af179590e608a700e44cd0e52edf54
    Addresses
    95.85.230.209 · United Kingdom · AS213887 WAICORE-LTD WAIcore Ltd
    Domain
    tv-giveaway.com
    Registered
    2026-05-24 · Cloudflare, Inc.
    MX
    Receives mail at route1.mx.cloudflare.net, route3.mx.cloudflare.net, route2.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:06 UTC

    Suggest a correction

  7. luxvision-exchange-system-com.financecryptoworld.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder financecryptoworld.com, listed by CERT PolskaMX presentSPF ~allDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    luxvision-exchange-system-com.financecryptoworld.com
    First seen
    2026-11-12 08:05 UTC
    Listing
    CERT Polska listed it 2026-06-12 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska, listing financecryptoworld.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 07:02 UTC to 2027-02-10 08:00 UTC
    Logged 2026-11-12 08:02 UTC in Google ParcelYard2027h1, entry 751,549,936
    SHA-256 657c88bfde35a363394334f2b0cb3a5e056c00950c548fdbbce0b42f43722df6
    Public key SHA-256 9c8eacc10bac5a5e0f69a94ccc6972c349f7c3156736b9ad539596429c1c5f4a
    Addresses
    104.21.10.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.131.121 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.10.130, 172.67.131.121): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    financecryptoworld.com
    Registered
    2025-01-30 · MainReg Inc.
    MX
    Receives mail at mail.financecryptoworld.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  8. project-bridge-trer-us.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    project-bridge-trer-us.pages.dev
    First seen
    2026-11-12 08:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 07:01 UTC to 2027-02-10 08:00 UTC
    Logged 2026-11-12 08:01 UTC in Geomys Tuscolo2027h1, entry 587,717,580
    SHA-256 25b86c8e71600e4e3c5b8391a91b2a0bf82d1b648edc7c36f18ecbb41d5d7cc4
    Public key SHA-256 dd925348d8a0c261dacc7a95e8244e5c296b830dbdf5fd9eab3bd1545e28adaf
    Addresses
    172.66.45.12 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.45.12, 172.66.46.244): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  9. villaturbali.com TR · AS43391 · NETDIREKT-AS NETDIREKT BILI…
    ListedListed by CERT PolskaMX presentSPF -allDMARC quarantineRegistered 10 mo ago
    DetailsHide
    Hostname
    villaturbali.com
    First seen
    2026-11-12 08:05 UTC
    Listing
    CERT Polska listed it 2026-06-25 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 07:06 UTC to 2027-02-10 07:06 UTC
    Logged 2026-11-12 08:05 UTC in Google PlumbersArms2027h1, entry 751,772,041
    SHA-256 389ba8916f87ddd4b1217be926ce4ceaa5ef29fa97a3e3e189f34a6bc24e3ce5
    Public key SHA-256 38525565cc47f4f97a1ee993947348c0ee845c984d975abf1bf8b9a7c788c1c2
    Addresses
    195.244.34.178 · Türkiye · AS43391 NETDIREKT-AS NETDIREKT BILISIM DANISMANLIK ILETISIM HIZMETLERI SANAYI VE TICARET AS
    Domain
    villaturbali.com
    Registered
    2026-01-02 · Realtime Register B.V.
    MX
    Receives mail at mail.villaturbali.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  10. whatisbred.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    whatisbred.com
    First seen
    2026-11-12 08:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 07:02 UTC to 2027-02-10 07:02 UTC
    Logged 2026-11-12 08:00 UTC in Google ParcelYard2027h1, entry 751,525,455
    SHA-256 7866a493770ef620b61b353e4921f7f5ca2a518cdf29b3fbe556fbed12276ca8
    Public key SHA-256 a6a938cf2dd75892a76bf7eabb1962cefb94068fe5f7055a8879245e35d1a711
    PhishDestroy
    Addresses
    104.21.66.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.29 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.197, 172.67.164.29): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    whatisbred.com
    Registered
    2026-05-19 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:06 UTC

    Suggest a correction

  11. ybnwt.icu US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    ybnwt.icu
    First seen
    2026-11-12 08:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 07:03 UTC to 2027-02-10 07:03 UTC
    Logged 2026-11-12 08:02 UTC in Let's Encrypt Willow2027h1, entry 1,114,413,940
    SHA-256 03eb4ce72f13ab2d4a56998364331c864735cc6fb7ced22394350deffefb5a5c
    Public key SHA-256 88680b58d016b471aee8d4a47b1f3af2218650e8757110fdcea289c3004d7dde
    Addresses
    104.21.6.163 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.135.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.6.163, 172.67.135.6): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ybnwt.icu
    Registered
    2026-05-14 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  12. yuyao03.skin US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    yuyao03.skin
    First seen
    2026-11-12 08:05 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 07:00 UTC to 2027-02-10 07:59 UTC
    Logged 2026-11-12 08:00 UTC in DigiCert Wyvern2027h1, entry 509,671,927
    SHA-256 09a11de6e4d7443f1d7a016ed55db4e741f02281fdc1f03f9d2d51429684b7f0
    Public key SHA-256 9cc575f0842717a30e97e9277b6f8512ed770968ae49d00292143d18493ae8e1
    Addresses
    104.21.91.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.195, 172.67.178.97): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    yuyao03.skin
    Registered
    2026-07-14 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  13. cpcontacts.anonymix.biz AU · AS154653 · ParkLogic Pty Ltd
    ListedParking page · ParkLogicUnder anonymix.biz, listed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 2 y ago
    DetailsHide
    Hostname
    cpcontacts.anonymix.biz
    First seen
    2026-11-12 08:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask, listing anonymix.biz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 06:59 UTC to 2027-02-10 06:59 UTC
    Logged 2026-11-12 07:58 UTC in Google PlumbersArms2027h1, entry 751,676,346
    SHA-256 21f13225aca4f73e0709d42fb165787032f3f3217377e6eaf1833a923706d127
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Addresses
    162.4.84.248 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    ParkLogic (162.4.84.248): a parking service. It answers for names that are typically for sale or unused.
    Domain
    anonymix.biz
    Registered
    2024-11-12 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Receives mail at _dc-mx.2001a7bd669a.anonymix.biz
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 01:21 UTC

    Suggest a correction

  14. docs.flipt.fun US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder flipt.fun, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    docs.flipt.fun
    First seen
    2026-11-12 08:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing flipt.fun and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 06:59 UTC to 2027-02-10 07:56 UTC
    Logged 2026-11-12 07:59 UTC in IPng Networks Halloumi2027h1, entry 467,437,486
    SHA-256 3fed26ca335ba2d815fb74821d00bbe5ea1314dadeaa076e79544dd04dc30e00
    Public key SHA-256 c6e6557bf619228f86b6cb1801effb2a902ce33ef114c02566e0a66b53b73259
    PhishDestroy
    Addresses
    104.21.82.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.82.94, 172.67.199.224): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    flipt.fun
    Registered
    2026-08-25 · Cloudflare, Inc.
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-11 08:29 UTC

    Suggest a correction

  15. dvegif.com
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    dvegif.com
    First seen
    2026-11-12 08:00 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 07:01 UTC to 2027-02-10 07:01 UTC
    Logged 2026-11-12 07:59 UTC in Google ParcelYard2027h1, entry 751,509,142
    SHA-256 60b700d6d029d97ae04b31ca6d869c9c252e8b8f51261e9839153f7bd2d19534
    Public key SHA-256 1a883c6bdcad4ab95190495d38744c30f1c910b16929bb0f91ccc24de20b5e77
    Domain
    dvegif.com
    Registered
    2026-05-19 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  16. fauconcursos.org AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Trellian / Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 15 y ago
    DetailsHide
    Hostname
    fauconcursos.org
    First seen
    2026-11-12 08:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 07:01 UTC to 2027-02-10 07:01 UTC
    Logged 2026-11-12 07:59 UTC in Google ParcelYard2027h1, entry 751,509,499
    SHA-256 4d1e6d4ab8f37df88d9822fb5e176b96c1b854f4bc840cbaa157fcd1d91138cf
    Public key SHA-256 13d95e8b8005bbaa5b5af5c1956cbee9cc12429358b3d878fcae33d4b01ab9b7
    PhishDestroy
    Addresses
    103.224.182.239 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Trellian / Above.com
    Trellian / Above.com (103.224.182.239): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fauconcursos.org
    Registered
    2012-03-15 · Above.com Pty Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  17. geniusterminal.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    geniusterminal.net
    First seen
    2026-11-12 08:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-14 03:10 UTC to 2026-12-13 04:08 UTC
    Logged 2026-11-12 07:57 UTC in IPng Networks Halloumi2026h2a, entry 1,300,373,233
    SHA-256 c89a185cc28364b1a746259623af00588be9f081841a142921b1744384546c27
    Public key SHA-256 0da0d4dad2033ee185c6a7a219d2de3bc193c2cadba99c0dd63b2fd258d8c4f4
    PhishDestroy
    Addresses
    104.21.16.238 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.219 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.238, 172.67.216.219): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    geniusterminal.net
    Registered
    2026-07-16 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  18. midnight-stream-8ti.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    midnight-stream-8ti.pages.dev
    First seen
    2026-11-12 08:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:56 UTC to 2027-02-10 07:54 UTC
    Logged 2026-11-12 07:56 UTC in Geomys Tuscolo2027h1, entry 587,670,700
    SHA-256 8234731e5327ea5aae633f1959f27f710ead84acc0471c9c49181b50104413c9
    Public key SHA-256 c2ee4658f42c47344b2fb4b041ef7d4cd92a70ecd96689ad0496189b45b2cc7f
    Addresses
    172.66.44.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.243, 172.66.47.13): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  19. nacos.pay-pay-pay.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under pay-pay-pay.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    nacos.pay-pay-pay.com
    First seen
    2026-11-12 08:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask, listing pay-pay-pay.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:59 UTC to 2027-02-10 06:59 UTC
    Logged 2026-11-12 07:58 UTC in Let's Encrypt Sycamore2027h1, entry 1,160,498,857
    SHA-256 a8e5aa47900fa59dacca639b3dd2ed930fed243ea2703b7e63f0e1c9a2d28766
    Public key SHA-256 9a67916630b8c8f63ec4f580d1380dc72ea25b7be10927cc2c635fbfd2cbb065
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    pay-pay-pay.com
    Registered
    2025-11-25 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  20. ns2.official-kmspico.com AU · AS154653 · ParkLogic Pty Ltd
    ListedParking page · ParkLogicUnder official-kmspico.com, listed by MetaMaskMX presentSPF -allDMARC missingRegistered 20 mo ago
    DetailsHide
    Hostname
    ns2.official-kmspico.com
    First seen
    2026-11-12 08:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask, listing official-kmspico.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 07:01 UTC to 2027-02-10 07:01 UTC
    Logged 2026-11-12 07:59 UTC in Let's Encrypt Sycamore2027h1, entry 1,160,519,209
    SHA-256 22b34086639b3eaf0b609f3a0d3ae4308814449d0228c674656402a1fd4f61ff
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Addresses
    162.4.84.215 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates official-kmspico.com to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.215): a parking service. It answers for names that are typically for sale or unused.
    Domain
    official-kmspico.com
    Registered
    2025-03-13 · Dynadot Inc
    MX
    Receives mail at mx156.hostedmxserver.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 18:31 UTC

    Suggest a correction

  21. rgfn.fauconcursos.org AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Trellian / Above.comUnder fauconcursos.org, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 15 y ago
    DetailsHide
    Hostname
    rgfn.fauconcursos.org
    First seen
    2026-11-12 08:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing fauconcursos.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 07:01 UTC to 2027-02-10 07:01 UTC
    Logged 2026-11-12 07:59 UTC in Google ParcelYard2027h1, entry 751,509,499
    SHA-256 4d1e6d4ab8f37df88d9822fb5e176b96c1b854f4bc840cbaa157fcd1d91138cf
    Public key SHA-256 13d95e8b8005bbaa5b5af5c1956cbee9cc12429358b3d878fcae33d4b01ab9b7
    PhishDestroy
    Addresses
    103.224.182.239 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Trellian / Above.com
    Trellian / Above.com (103.224.182.239): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fauconcursos.org
    Registered
    2012-03-15 · Above.com Pty Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  22. romanceshopping.online US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC quarantineRegistered 6 mo ago
    DetailsHide
    Hostname
    romanceshopping.online
    First seen
    2026-11-12 08:00 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:58 UTC to 2027-02-10 06:58 UTC
    Logged 2026-11-12 07:56 UTC in Let's Encrypt Sycamore2027h1, entry 1,160,481,477
    SHA-256 5b265af3ce33d540abd2bb90e9c1e29a95b145dac1ec0858e538e1b2c4aa180f
    Public key SHA-256 d5b852a05500cac6a14d81e1a5c36f74a2dfadd8cec66dde1c7e726c7d7c1909
    Addresses
    104.21.66.194 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.194, 172.67.163.234): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    romanceshopping.online
    Registered
    2026-05-19 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  23. ww38.fauconcursos.org AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Trellian / Above.comUnder fauconcursos.org, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 15 y ago
    DetailsHide
    Hostname
    ww38.fauconcursos.org
    First seen
    2026-11-12 08:00 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing fauconcursos.org and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 07:01 UTC to 2027-02-10 07:01 UTC
    Logged 2026-11-12 07:59 UTC in Google ParcelYard2027h1, entry 751,509,499
    SHA-256 4d1e6d4ab8f37df88d9822fb5e176b96c1b854f4bc840cbaa157fcd1d91138cf
    Public key SHA-256 13d95e8b8005bbaa5b5af5c1956cbee9cc12429358b3d878fcae33d4b01ab9b7
    PhishDestroy
    Addresses
    103.224.182.239 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Trellian / Above.com
    Trellian / Above.com (103.224.182.239): a parking service. It answers for names that are typically for sale or unused.
    Domain
    fauconcursos.org
    Registered
    2012-03-15 · Above.com Pty Ltd.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  24. log.pedalswiftcouriers.icu BD · AS153568 · NEW DHAKA HARDWARE
    ReportedUnder pedalswiftcouriers.icu, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy noneRegistered 10 mo ago
    DetailsHide
    Hostname
    log.pedalswiftcouriers.icu
    First seen
    2026-11-12 07:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing pedalswiftcouriers.icu and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 06:52 UTC to 2027-02-10 06:52 UTC
    Logged 2026-11-12 07:51 UTC in DigiCert Wyvern2027h1, entry 509,576,050
    SHA-256 282581fe7c1c56dddc897a00abacb4c184aa23aaef9200a90f44ad80517c29d6
    Public key SHA-256 a97e5f170ea4def9f6e1897ac64ccd5bea6ba2203e0b764478ecf4c8bcd81558
    PhishDestroy
    Addresses
    163.61.188.5 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    pedalswiftcouriers.icu
    Registered
    2026-01-08 · Global Domain Group LLC
    MX
    Receives mail at pedalswiftcouriers.icu
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server pedalswiftcouriers.icu at 163.61.188.5 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.5 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-11 17:04 UTC

    Suggest a correction

  25. lootgo.live US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    lootgo.live
    First seen
    2026-11-12 07:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:53 UTC to 2027-02-10 07:52 UTC
    Logged 2026-11-12 07:53 UTC in Google ParcelYard2027h1, entry 751,439,759
    SHA-256 a77386de51a3311c525d465cbc7390678a2bb46fda911d67de28c9965aa6f666
    Public key SHA-256 38ef4132a9ead2f3f9e1739de9b1a856134cdd4be1dade134353b6ce105689ec
    PhishDestroy
    Addresses
    104.21.36.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.198.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.36.193, 172.67.198.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lootgo.live
    Registered
    2026-01-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  26. taisenjiankang.com HK · AS132839 · POWER LINE DATACENTERANA
    ListedSame certificateListed by JPCERT/CC as imitating ANA · Same certificate as xikangjiankang.com, listed by JPCERT/CCMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    taisenjiankang.com
    First seen
    2026-11-12 07:56 UTC
    Listing
    JPCERT/CC confirmed it 2026-07-24 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 02:17 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Same certificate
    Same certificate as xikangjiankang.com: listed by JPCERT/CC; a Apple lookalike
    Listed: resolved to 23.235.132.158 on Spamhaus DROP
    10 of 41 domains on this certificate have their own listing evidence
    Certificate 85996da42d39d2ce… · 41 domains on it · first seen 2026-11-12 07:58 UTC
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:54 UTC to 2027-02-10 06:54 UTC
    Logged 2026-11-12 07:52 UTC in Let's Encrypt Sycamore2027h1, entry 1,160,436,975
    SHA-256 85996da42d39d2ce6c6ab6b345af493c76beca8dba8fa567628ada8cf14dce00
    Public key SHA-256 553a4345a6cb43b4aaafd32c040570fb321cecd9c47fc1a68422640b2dc0e842
    Brand
    ANA
    Addresses
    23.235.132.158 · Hong Kong · AS132839 POWERLINE-AS-AP - POWER LINE DATACENTER
    Domain
    taisenjiankang.com
    Registered
    2026-11-11 · TuringSign Inc. d/b/a Cosmotown
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  27. www.krakenfn.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder krakenfn.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    www.krakenfn.com
    First seen
    2026-11-12 07:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing krakenfn.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-12 06:54 UTC to 2027-02-10 06:54 UTC
    Logged 2026-11-12 07:53 UTC in DigiCert Sphinx2027h1, entry 452,421,451
    SHA-256 07723281c9001ff9a638c696c35cf5f97cdec0f2033fa3778b42d468e5285a66
    Public key SHA-256 e11de2672393048bd18158e6448836d155631fad56f7d42e4f6ed28a84582b0e
    PhishDestroy
    Addresses
    104.21.25.14 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.25.14, 172.67.221.143): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    krakenfn.com
    Registered
    2023-04-12 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 09:06 UTC

    Suggest a correction

  28. www.log.pedalswiftcouriers.icu BD · AS153568 · NEW DHAKA HARDWARE
    ReportedUnder pedalswiftcouriers.icu, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy noneRegistered 10 mo ago
    DetailsHide
    Hostname
    www.log.pedalswiftcouriers.icu
    First seen
    2026-11-12 07:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing pedalswiftcouriers.icu and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 06:52 UTC to 2027-02-10 06:52 UTC
    Logged 2026-11-12 07:51 UTC in DigiCert Wyvern2027h1, entry 509,576,050
    SHA-256 282581fe7c1c56dddc897a00abacb4c184aa23aaef9200a90f44ad80517c29d6
    Public key SHA-256 a97e5f170ea4def9f6e1897ac64ccd5bea6ba2203e0b764478ecf4c8bcd81558
    PhishDestroy
    Addresses
    163.61.188.5 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    pedalswiftcouriers.icu
    Registered
    2026-01-08 · Global Domain Group LLC
    MX
    Receives mail at pedalswiftcouriers.icu
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server pedalswiftcouriers.icu at 163.61.188.5 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.5 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-11 17:04 UTC

    Suggest a correction

  29. xikangjiankang.com HK · AS132839 · POWER LINE DATACENTERApple
    ListedSame certificateListed by JPCERT/CC as imitating Apple Account · Same certificate as taisenjiankang.com, listed by JPCERT/CCMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    xikangjiankang.com
    First seen
    2026-11-12 07:56 UTC
    Listing
    JPCERT/CC confirmed it 2026-08-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 02:17 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Same certificate
    Same certificate as taisenjiankang.com: listed by JPCERT/CC; a ANA lookalike
    Listed: resolved to 23.235.148.215 on Spamhaus DROP
    10 of 41 domains on this certificate have their own listing evidence
    Certificate 85996da42d39d2ce… · 41 domains on it · first seen 2026-11-12 07:58 UTC
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:54 UTC to 2027-02-10 06:54 UTC
    Logged 2026-11-12 07:52 UTC in Let's Encrypt Sycamore2027h1, entry 1,160,436,975
    SHA-256 85996da42d39d2ce6c6ab6b345af493c76beca8dba8fa567628ada8cf14dce00
    Public key SHA-256 553a4345a6cb43b4aaafd32c040570fb321cecd9c47fc1a68422640b2dc0e842
    Brand
    Apple
    Addresses
    23.235.148.215 · Hong Kong · AS132839 POWERLINE-AS-AP - POWER LINE DATACENTER
    Domain
    xikangjiankang.com
    Registered
    2026-11-11 · TuringSign Inc. d/b/a Cosmotown
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  30. glaciarcapitaleza.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    glaciarcapitaleza.shop
    First seen
    2026-11-12 07:51 UTC
    Listing
    CERT Polska listed it 2026-07-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:50 UTC to 2027-02-10 06:50 UTC
    Logged 2026-11-12 07:48 UTC in Google ParcelYard2027h1, entry 751,376,649
    SHA-256 57a982d453dde1b742780562ccee5d519da7241c0248bfda906e22612d6ea81e
    Public key SHA-256 a66b57fe5f4ed48be123b7ff42838d1fd4933c32e34e8f7286026ad2f2471e37
    Addresses
    104.21.23.2 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.208.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.23.2, 172.67.208.35): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    glaciarcapitaleza.shop
    Registered
    2026-05-19 · Dynadot Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  31. versicherungs-vergleicher.info US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF ~allDMARC policy noneRegistered 10 mo ago
    DetailsHide
    Hostname
    versicherungs-vergleicher.info
    First seen
    2026-11-12 07:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:46 UTC to 2027-02-10 07:45 UTC
    Logged 2026-11-12 07:46 UTC in DigiCert Wyvern2027h1, entry 509,523,817
    SHA-256 681c2fa524906f0627d079479a99ca4d97abc366544cac6fe28d191e915e3371
    Public key SHA-256 9b05509eb58c5ac1bd98f4fc3705ead28276aa30ba58d250dc515e30a3b7e390
    Addresses
    104.21.51.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.177.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.51.88, 172.67.177.250): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    versicherungs-vergleicher.info
    Registered
    2026-01-20 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  32. www.exodus-app.asia DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under exodus-app.asia, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    www.exodus-app.asia
    First seen
    2026-11-12 07:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask, listing exodus-app.asia and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:51 UTC to 2027-02-10 06:51 UTC
    Logged 2026-11-12 07:49 UTC in IPng Networks Halloumi2027h1, entry 467,342,363
    SHA-256 3351d94c89b9f7b33760f024b91f75659a761b8752516bcddc57ccc111542610
    Public key SHA-256 b5e5a10bf8bd14550e18b73803fe14d6075701cdfc611da9fbc6230d38adae9e
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    exodus-app.asia
    Registered
    2026-08-14 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 19:20 UTC

    Suggest a correction

  33. 288492-ledger.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    288492-ledger.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:44 UTC to 2027-02-10 06:44 UTC
    Logged 2026-11-12 07:43 UTC in IPng Networks Gouda2027h1, entry 392,305,093
    SHA-256 4c4c3f8e2d885e6aa4265c8066845650c4fb988c29f24f73eba5902df582c023
    Public key SHA-256 2b7d12303e521c0780eff0522d8018691e7d2eb3ee298150f0e1c24ced73034e
    Addresses
    104.21.59.246 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.73 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.59.246, 172.67.186.73): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    288492-ledger.com
    Registered
    2026-09-13 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  34. alipay.polar-tensor.com DE · AS51167 · CONTABO Contabo GmbH4 addresses
    ListedContabo +1Under polar-tensor.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    alipay.polar-tensor.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask, listing polar-tensor.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 06:43 UTC to 2027-02-10 06:43 UTC
    Logged 2026-11-12 07:42 UTC in Google PlumbersArms2027h1, entry 751,478,847
    SHA-256 00f624214921e08ed4e7862501eb42ab4ed87f73a0058c202fd3d917218d1728
    Public key SHA-256 8329d103bce010c6411a21817b21399426ff6de19d065ba5d155652f95ab5c71
    Addresses
    5.189.134.86 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    57.128.187.75 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    57.129.49.179 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    193.242.211.59 · Germany · AS58329 SERVINGA-NL servinga GmbH
    Contabo +1
    Contabo (5.189.134.86): a cloud provider. It rents servers and addresses to its customers. OVH (57.128.187.75, 57.129.49.179): a cloud provider. It rents servers and addresses to its customers.
    Domain
    polar-tensor.com
    Registered
    2025-04-28 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 19:42 UTC

    Suggest a correction

  35. bcgameru1.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 14 mo ago
    DetailsHide
    Hostname
    bcgameru1.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:42 UTC to 2027-02-10 07:40 UTC
    Logged 2026-11-12 07:42 UTC in Google PlumbersArms2027h1, entry 751,481,310
    SHA-256 b3f97e809cf21fa0dbc1c04ef0d68a776b70c215ba40f2f645dabc791e106600
    Public key SHA-256 375f82f68ed57f152e12f4213f0e58227828f88ba821d8686ac4a829d0b3efad
    PhishDestroy
    Addresses
    104.18.28.29 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.18.29.29 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.28.29, 104.18.29.29): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bcgameru1.com
    Registered
    2025-09-25 · Gandi SAS
    MX
    Receives mail at spool.mail.gandi.net, fb.mail.gandi.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  36. foundation-deck.pages.dev US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    foundation-deck.pages.dev
    First seen
    2026-11-12 07:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:42 UTC to 2027-02-10 07:40 UTC
    Logged 2026-11-12 07:42 UTC in Google PlumbersArms2027h1, entry 751,477,640
    SHA-256 ad1d2f561e7e7f9c1fc9e7fce82b521e699c5efa98a60783b026ee61cd648f97
    Public key SHA-256 c8734ea4d9478190a35a97e7496df0b0591c7c54c01a1ed8f9b0216c5ffb4c7b
    Addresses
    172.66.44.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.59 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.66.44.197, 172.66.47.59): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  37. fxw.1doc-shop.com AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder 1doc-shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    fxw.1doc-shop.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing 1doc-shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-12 06:45 UTC to 2027-02-10 06:45 UTC
    Logged 2026-11-12 07:43 UTC in Google PlumbersArms2027h1, entry 751,496,407
    SHA-256 8fec38cd906f675f4232f0b155fd3b7aacd3ad3e87ce79c46f4c9e665fb1482f
    Public key SHA-256 4c600084b1c7791454b77c2469b390f50490c0a7b6dc94e3caca075e5c5a04ea
    PhishDestroy
    Addresses
    186.2.175.208 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    1doc-shop.com
    Registered
    2026-05-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 13:39 UTC

    Suggest a correction

  38. fxx.1doc-shop.com AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder 1doc-shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    fxx.1doc-shop.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing 1doc-shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-12 06:45 UTC to 2027-02-10 06:45 UTC
    Logged 2026-11-12 07:43 UTC in Google PlumbersArms2027h1, entry 751,496,407
    SHA-256 8fec38cd906f675f4232f0b155fd3b7aacd3ad3e87ce79c46f4c9e665fb1482f
    Public key SHA-256 4c600084b1c7791454b77c2469b390f50490c0a7b6dc94e3caca075e5c5a04ea
    PhishDestroy
    Addresses
    186.2.175.208 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    1doc-shop.com
    Registered
    2026-05-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 13:39 UTC

    Suggest a correction

  39. fya.1doc-shop.com AE · AS59692 · IQWEB IQWeb FZ-LLC
    ReportedUnder 1doc-shop.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    fya.1doc-shop.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing 1doc-shop.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-12 06:45 UTC to 2027-02-10 06:45 UTC
    Logged 2026-11-12 07:43 UTC in Google PlumbersArms2027h1, entry 751,496,407
    SHA-256 8fec38cd906f675f4232f0b155fd3b7aacd3ad3e87ce79c46f4c9e665fb1482f
    Public key SHA-256 4c600084b1c7791454b77c2469b390f50490c0a7b6dc94e3caca075e5c5a04ea
    PhishDestroy
    Addresses
    186.2.175.208 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    1doc-shop.com
    Registered
    2026-05-13 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 13:39 UTC

    Suggest a correction

  40. jamshopping.online US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC quarantineRegistered 6 mo ago
    DetailsHide
    Hostname
    jamshopping.online
    First seen
    2026-11-12 07:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:46 UTC to 2027-02-10 06:46 UTC
    Logged 2026-11-12 07:44 UTC in Google PlumbersArms2027h1, entry 751,510,163
    SHA-256 bee890bd75ce6954747e96abaef4c412265b73246a93bb0b49e046cb05ffb27c
    Public key SHA-256 ec0ef5f3a91e4d52a6a13b6139ab209bd08be17751a2a4f98e29a1ba092767b6
    Addresses
    104.21.18.187 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.33 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.18.187, 172.67.183.33): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jamshopping.online
    Registered
    2026-05-19 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  41. llbmvgmall.shop
    ListedListed by MODA (one-page scam site)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    llbmvgmall.shop
    First seen
    2026-11-12 07:46 UTC
    Listing
    Reported to MODA 2026-03-03 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 08:01 UTC
    Listed
    MODA
    1. Reported to MODA
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:41 UTC to 2027-02-10 07:40 UTC
    Logged 2026-11-12 07:41 UTC in Google ParcelYard2027h1, entry 751,283,824
    SHA-256 9203543653d8adace6a818be893e9dfc6b1440e8a3a84fe0f2886615329f30d1
    Public key SHA-256 73a82fa63ee1dd42bb29ea617c8d4473161cd354e730ad44aa435c2d99824736
    Domain
    llbmvgmall.shop
    Registered
    2026-01-21 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  42. mcd66.com CN · AS45102 · Alibaba (US) Technology Co.…4 addresses
    ListedAlibaba CloudListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    mcd66.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:46 UTC to 2027-02-10 06:46 UTC
    Logged 2026-11-12 07:45 UTC in Let's Encrypt Willow2027h1, entry 1,114,205,103
    SHA-256 5fd5a840b0de1e7f50c10339d9c99e130a6d232f931e6623010ed7da28705c25
    Public key SHA-256 9423b5edf904c555fda2459aae0f9b586726b6153a17fc27303df00e0c1d8d8c
    Addresses
    43.106.19.168 · China · AS45102 ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. · Alibaba Cloud (cloud provider)
    47.84.18.249 · China · AS45102 ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. · Alibaba Cloud (cloud provider)
    47.84.122.121 · China · AS45102 ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. · Alibaba Cloud (cloud provider)
    47.84.198.177 · China · AS45102 ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. · Alibaba Cloud (cloud provider)
    Alibaba Cloud
    Alibaba Cloud (43.106.19.168, 47.84.18.249, 47.84.122.121, 47.84.198.177): a cloud provider. It rents servers and addresses to its customers.
    Domain
    mcd66.com
    Registered
    2026-03-19 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  43. onions.kraken-ssylka.co.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder kraken-ssylka.co.com, reported by PhishDestroy
    DetailsHide
    Hostname
    onions.kraken-ssylka.co.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing kraken-ssylka.co.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-12 06:43 UTC to 2027-02-10 06:43 UTC
    Logged 2026-11-12 07:42 UTC in Google ParcelYard2027h1, entry 751,292,252
    SHA-256 530e472526a3f6fdb2fbd6bab8b77a9f939857fb55fba5de27062ef7eb43e2c3
    Public key SHA-256 c4b2e3280d1915a97087914413c68e4c06429cf338448bf9ce18829f41911ff7
    PhishDestroy
    Addresses
    104.21.88.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.177 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.88.117, 172.67.178.177): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  44. spup.edu.ph US · AS26496 · GoDaddy.com, LLC
    ReportedGoDaddyReported by PhishDestroyMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    spup.edu.ph
    First seen
    2026-11-12 07:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-12 07:39 UTC to 2027-05-29 07:15 UTC
    Logged 2026-11-12 07:39 UTC in Sectigo Elephant2027h1, entry 845,270,995
    SHA-256 73b72bcd7e4e3dca333dfeee30b52c4b25dd00d01fb812897b3f9c6930a9c3bf
    Public key SHA-256 e1bb564c5cecfae503afc1704f245d9c6c158b21fe686189c6857869891b1bdf
    PhishDestroy
    Addresses
    166.62.28.97 · United States · AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC · GoDaddy (shared hosting)
    GoDaddy
    GoDaddy (166.62.28.97): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    spup.edu.ph
    MX
    Receives mail at spup-edu-ph.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 07:50 UTC

    Suggest a correction

  45. test.www.rds.professorflapjacks.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder www.rds.professorflapjacks.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    test.www.rds.professorflapjacks.com
    First seen
    2026-11-12 07:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing www.rds.professorflapjacks.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 06:42 UTC to 2027-02-10 06:42 UTC
    Logged 2026-11-12 07:41 UTC in Let's Encrypt Willow2027h1, entry 1,114,163,174
    SHA-256 01ee03950107ea16e077f8c33096f1df3f3b438362a91bc0c6ae423b81701827
    Public key SHA-256 903b281a49331ac324f0ad39b898e92a8d8430083195fd4d1c9fbeef8a89d313
    PhishDestroy
    Addresses
    185.149.120.183 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.149.120.183): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    professorflapjacks.com
    Registered
    2016-07-03 · Gandi SAS
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 19:41 UTC

    Suggest a correction

  46. www.spup.edu.ph US · AS26496 · GoDaddy.com, LLC
    ReportedGoDaddyUnder spup.edu.ph, reported by PhishDestroyMX presentSPF -allDMARC policy none
    DetailsHide
    Hostname
    www.spup.edu.ph
    First seen
    2026-11-12 07:46 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing spup.edu.ph and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-12 07:39 UTC to 2027-05-29 07:15 UTC
    Logged 2026-11-12 07:39 UTC in Sectigo Elephant2027h1, entry 845,270,995
    SHA-256 73b72bcd7e4e3dca333dfeee30b52c4b25dd00d01fb812897b3f9c6930a9c3bf
    Public key SHA-256 e1bb564c5cecfae503afc1704f245d9c6c158b21fe686189c6857869891b1bdf
    PhishDestroy
    Addresses
    166.62.28.97 · United States · AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC · GoDaddy (shared hosting)
    GoDaddy
    GoDaddy (166.62.28.97): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    spup.edu.ph
    MX
    Receives mail at spup-edu-ph.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 07:50 UTC

    Suggest a correction

  47. 72xdvk.bond CN · AS132203 · Tencent Building, Kejizhong…
    ReportedTencent CloudReported by PhishTankMX presentSPF -allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    72xdvk.bond
    First seen
    2026-11-12 07:41 UTC
    Listing
    PhishTank: first observed in the feed 2026-11-10 · still listed at the last successful feed check 2026-11-12 07:35 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:39 UTC to 2027-02-10 06:39 UTC
    Logged 2026-11-12 07:38 UTC in DigiCert Wyvern2027h1, entry 509,434,049
    SHA-256 1f15639b507a9ebe44cd863da4ac14f940a5254ed551739e2683b597f72a9ae5
    Public key SHA-256 f4f43002330d527a8013b4c2c23ec8caf72ae0e1550642bc560118c9aa8a3e63
    PhishTank
    PhishTank report #9557707
    Addresses
    43.165.171.210 · China · AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue · Tencent Cloud (cloud provider)
    Tencent Cloud
    Tencent Cloud (43.165.171.210): a cloud provider. It rents servers and addresses to its customers.
    Domain
    72xdvk.bond
    Registered
    2026-07-03 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Receives mail at aspmx1.migadu.com, aspmx2.migadu.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 07:43 UTC

    Suggest a correction

  48. dkaq.agndatacom.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under agndatacom.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    dkaq.agndatacom.com
    First seen
    2026-11-12 07:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask, listing agndatacom.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 06:38 UTC to 2027-02-10 06:38 UTC
    Logged 2026-11-12 07:36 UTC in Geomys Tuscolo2027h1, entry 587,500,929
    SHA-256 34e3700a9f7e6633095eedeaa5a4c1a786ab9d7a754b36e2bcde8bb19cae4fb2
    Public key SHA-256 dc9621a04bcb13512d1c9b4381c071ef255b5bdddad0f092d3d309297d6d7d03
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    agndatacom.com
    Registered
    2026-08-20 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  49. firelightmainnets.live
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    firelightmainnets.live
    First seen
    2026-11-12 07:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:40 UTC to 2027-02-10 06:40 UTC
    Logged 2026-11-12 07:38 UTC in Google ParcelYard2027h1, entry 751,249,776
    SHA-256 2b5aa664dc1d0a30b2506e9b2647fd2ac59460f61538a74a8112c91b737a9ae9
    Public key SHA-256 54b5032690110196e4a5755e8bbf45261f6424d0fbd30f61eb4d3408e3fd4c61
    Domain
    firelightmainnets.live
    Registered
    2026-09-13 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  50. fun-creators.live US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    fun-creators.live
    First seen
    2026-11-12 07:41 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:38 UTC to 2027-02-10 06:38 UTC
    Logged 2026-11-12 07:37 UTC in Google PlumbersArms2027h1, entry 751,417,927
    SHA-256 2a28e2184a7710b3bde61e038c58d32803dc02b19742150be1f3efc6c792f461
    Public key SHA-256 3aa7d5a3ed057cc19b5363bf7f6c36d3d361ddf7434438fc932c47d116ae3c06
    PhishDestroy
    Addresses
    104.21.96.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.182.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.96.148, 172.67.182.214): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    fun-creators.live
    Registered
    2026-03-07 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  51. oferta-9628.courses US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    oferta-9628.courses
    First seen
    2026-11-12 07:41 UTC
    Listing
    CERT Polska listed it 2026-09-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 06:38 UTC to 2027-02-10 06:38 UTC
    Logged 2026-11-12 07:37 UTC in Google ParcelYard2027h1, entry 751,228,119
    SHA-256 c5bcc61b5d48af40c6e1fc7a67cd53d7f46a2b7092ee758bb3445f2988634928
    Public key SHA-256 05373e3eb2cc573d09d1b31db60530a65ddb8436a1233bdeed00450d42dad490
    Addresses
    104.21.4.14 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.223.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.4.14, 172.67.223.242): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    oferta-9628.courses
    Registered
    2026-09-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  52. qvantaro.online US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    qvantaro.online
    First seen
    2026-11-12 07:41 UTC
    Listing
    CERT Polska listed it 2026-09-01 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:39 UTC to 2027-02-10 07:37 UTC
    Logged 2026-11-12 07:39 UTC in DigiCert Wyvern2027h1, entry 509,449,777
    SHA-256 7b243122508412acbf0ea954a77ccb9e0b291626192ce5be45aa7f016a166b08
    Public key SHA-256 9c6b285f69523e3bc415a31e22d49013a800479feefe343f963a3d4fe1afb97c
    Addresses
    104.21.84.16 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.194 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.84.16, 172.67.184.194): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    qvantaro.online
    Registered
    2026-07-17 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  53. sso2.polar-tensor.com DE · AS51167 · CONTABO Contabo GmbH4 addresses
    ListedContabo +1Under polar-tensor.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 19 mo ago
    DetailsHide
    Hostname
    sso2.polar-tensor.com
    First seen
    2026-11-12 07:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask, listing polar-tensor.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 06:38 UTC to 2027-02-10 06:38 UTC
    Logged 2026-11-12 07:37 UTC in DigiCert Wyvern2027h1, entry 509,425,867
    SHA-256 be92607c37fc1409d9bdd3780f487cba49b06f2821861e0ad8070442d5cb100c
    Public key SHA-256 1bd86cafbe7f8c5cdf8d88e1e2c1905a8a5110430a271d07713326b510987ec9
    Addresses
    5.189.134.86 · Germany · AS51167 CONTABO Contabo GmbH · Contabo (cloud provider)
    57.128.187.75 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    57.129.49.179 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    193.242.211.59 · Germany · AS58329 SERVINGA-NL servinga GmbH
    Contabo +1
    Contabo (5.189.134.86): a cloud provider. It rents servers and addresses to its customers. OVH (57.128.187.75, 57.129.49.179): a cloud provider. It rents servers and addresses to its customers.
    Domain
    polar-tensor.com
    Registered
    2025-04-28 · Web Commerce Communications Limited dba WebNic.cc
    MX
    Receives mail at mail.protonmail.ch, mailsec.protonmail.ch
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 19:42 UTC

    Suggest a correction

  54. uborka.coin-side.com NL · AS57043 · HOSTKEY-AS HOSTKEY B.V.
    ListedUnder coin-side.com, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    uborka.coin-side.com
    First seen
    2026-11-12 07:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Listed
    MetaMask, listing coin-side.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 06:38 UTC to 2027-02-10 06:38 UTC
    Logged 2026-11-12 07:36 UTC in Let's Encrypt Sycamore2027h1, entry 1,160,237,415
    SHA-256 04d9d75481fcc111f3e5c0bba5b1f3d4613ec655a9b3e3847ac857f97ac7f310
    Public key SHA-256 dcce8dde6564149803989243409cd7afabb8905780a15230008a201a609c7be2
    Addresses
    78.17.124.132 · Netherlands · AS57043 HOSTKEY-AS HOSTKEY B.V.
    Domain
    coin-side.com
    Registered
    2022-02-06 · Registrar of Domain Names REG.RU LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 09:02 UTC

    Suggest a correction

  55. 06pump.fun US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    06pump.fun
    First seen
    2026-11-12 07:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:31 UTC to 2027-02-10 07:30 UTC
    Logged 2026-11-12 07:31 UTC in DigiCert Wyvern2027h1, entry 509,392,208
    SHA-256 da59cbfa8f6d07521f898c7a0331d99d8d99635531753123aba183e590fa9c3e
    Public key SHA-256 21f8e4ef75aec55272ee06edb2d4327e938cdf462d4e90ff21ba51f7d3ee726d
    PhishDestroy
    Addresses
    104.21.20.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.207 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.20.58, 172.67.191.207): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    06pump.fun
    Registered
    2026-01-20 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  56. bumper.masuksaba.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder masuksaba.net, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    bumper.masuksaba.net
    First seen
    2026-11-12 07:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing masuksaba.net and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 06:32 UTC to 2027-02-10 07:31 UTC
    Logged 2026-11-12 07:32 UTC in Let's Encrypt Sycamore2027h1, entry 1,160,190,597
    SHA-256 3c044de25b80e3adf8597db1d74d48c78eb06cda09f3ade47fa24b7df5f66c01
    Public key SHA-256 2cbf8d86ac4264844f059436444a0354f00dec56019555458efdcbb59b7d64a8
    PhishDestroy
    Addresses
    104.21.77.223 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.31 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.77.223, 172.67.212.31): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    masuksaba.net
    Registered
    2023-10-07 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 08:27 UTC

    Suggest a correction

  57. egmgov.biz.id US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    egmgov.biz.id
    First seen
    2026-11-12 07:36 UTC
    Listing
    USOM listed it 2026-09-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 07:32 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 06:32 UTC to 2027-02-10 06:32 UTC
    Logged 2026-11-12 07:31 UTC in Google ParcelYard2027h1, entry 751,156,861
    SHA-256 396fbd3a5fe2a733473a2192a9096d2ec771004e6d24a1584973baa1aedcf388
    Public key SHA-256 2ddaf5d6579e7693b3dee26df82d85daaa7c893198c3f57acd6dc9256d144d0d
    Addresses
    104.21.54.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.189 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.54.97, 172.67.137.189): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    egmgov.biz.id
    Registered
    2026-09-14 · PT Jagoan Hosting Indonesia
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  58. genesis-hyperliquid.trade US · AS13335 · Cloudflare, Inc.4 addressesHyperliquid
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    genesis-hyperliquid.trade
    First seen
    2026-11-12 07:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:34 UTC to 2027-02-10 07:33 UTC
    Logged 2026-11-12 07:34 UTC in DigiCert Wyvern2027h1, entry 509,412,563
    SHA-256 35c5d50bfcda7c8b991859ac7b62ac71fb201977081c61992b8d5cc13f35d675
    Public key SHA-256 16c35ad4bf50367a8ba10fd3817f15a0151b86e5cd42545f09468470dd746227
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.50.182 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.196 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:cfc4
    2606:4700:3036::6815:32b6
    Cloudflare
    Cloudflare (104.21.50.182, 172.67.207.196): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    genesis-hyperliquid.trade
    Registered
    2025-11-23 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 07:37 UTC

    Suggest a correction

  59. gomnygorka.shop AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    gomnygorka.shop
    First seen
    2026-11-12 07:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 06:35 UTC to 2027-02-10 06:35 UTC
    Logged 2026-11-12 07:34 UTC in Let's Encrypt Willow2027h1, entry 1,114,080,991
    SHA-256 1d46e86bd9fc075614c3c5211fd761e861adf589aa7a41a7e962d8fc3ea79250
    Public key SHA-256 9974c83d3e15f3755d31723d6f72076bdd51a779365a736569d8eba882b3e706
    PhishDestroy
    Addresses
    103.224.212.210 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates gomnygorka.shop to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.210): a parking service. It answers for names that are typically for sale or unused.
    Domain
    gomnygorka.shop
    Registered
    2026-05-01 · Dynadot Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  60. jxsxc.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    jxsxc.com
    First seen
    2026-11-12 07:36 UTC
    Listing
    CERT Polska listed it 2026-05-20 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:33 UTC to 2027-02-10 06:33 UTC
    Logged 2026-11-12 07:31 UTC in Google PlumbersArms2027h1, entry 751,350,736
    SHA-256 0c8b84781f84678d052266c32bf224f6faee26a18e362ddeb8fe9b0112952304
    Public key SHA-256 431e88b46c5b4c48bc22603070e8b2dac451dda82b25e20509cbecdc187c3e5c
    Addresses
    104.21.49.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.49.164, 172.67.164.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    jxsxc.com
    Registered
    2026-05-19 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  61. kywohdwl.shop AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    kywohdwl.shop
    First seen
    2026-11-12 07:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 06:35 UTC to 2027-02-10 06:35 UTC
    Logged 2026-11-12 07:34 UTC in Let's Encrypt Willow2027h1, entry 1,114,080,991
    SHA-256 1d46e86bd9fc075614c3c5211fd761e861adf589aa7a41a7e962d8fc3ea79250
    Public key SHA-256 9974c83d3e15f3755d31723d6f72076bdd51a779365a736569d8eba882b3e706
    PhishDestroy
    Addresses
    103.224.212.216 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates kywohdwl.shop to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.216): a parking service. It answers for names that are typically for sale or unused.
    Domain
    kywohdwl.shop
    Registered
    2026-05-01 · Dynadot Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  62. lutewayredug.shop AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    lutewayredug.shop
    First seen
    2026-11-12 07:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 06:35 UTC to 2027-02-10 06:35 UTC
    Logged 2026-11-12 07:34 UTC in Let's Encrypt Willow2027h1, entry 1,114,080,991
    SHA-256 1d46e86bd9fc075614c3c5211fd761e861adf589aa7a41a7e962d8fc3ea79250
    Public key SHA-256 9974c83d3e15f3755d31723d6f72076bdd51a779365a736569d8eba882b3e706
    PhishDestroy
    Addresses
    103.224.212.214 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates lutewayredug.shop to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.214): a parking service. It answers for names that are typically for sale or unused.
    Domain
    lutewayredug.shop
    Registered
    2026-05-01 · Dynadot Inc.
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  63. mktalignxpro.com
    ListedListed by NPA 165 (finance and insurance)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    mktalignxpro.com
    First seen
    2026-11-12 07:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:33 UTC to 2027-02-10 07:32 UTC
    Logged 2026-11-12 07:33 UTC in Geomys Tuscolo2027h1, entry 587,478,450
    SHA-256 7e8ca3260d08dcf84c0dd726218aed5937222a39138ff5011860dacba2b93990
    Public key SHA-256 b11bc06a00eadd5442b3eb63191e18787cb31af7acf02191807cac2094d85aef
    Domain
    mktalignxpro.com
    Registered
    2026-01-20 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  64. oehju.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    oehju.shop
    First seen
    2026-11-12 07:36 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:35 UTC to 2027-02-10 06:35 UTC
    Logged 2026-11-12 07:34 UTC in DigiCert Sphinx2027h1, entry 452,252,919
    SHA-256 0a5211bf15fa0d24324e6208528c0e0a2742dc0abde1c6bd75e60de075a6b05b
    Public key SHA-256 2b01aa3c76d8f3a8682161265dd4e424792a0e5c2e077edbba2f4fd63b597dae
    Addresses
    104.21.55.131 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.148.47 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.55.131, 172.67.148.47): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    oehju.shop
    Registered
    2026-05-18 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  65. server.abundantmines.com US · AS396982 · Google LLC
    ReportedGoogle CloudUnder abundantmines.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 4 y ago
    DetailsHide
    Hostname
    server.abundantmines.com
    First seen
    2026-11-12 07:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing abundantmines.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-12 06:33 UTC to 2027-02-10 06:33 UTC
    Logged 2026-11-12 07:31 UTC in Google ParcelYard2027h1, entry 751,166,810
    SHA-256 61a6b08986aa2df7f55058a46f729a4c1c393ccd10458028bd6c1665e9b87e88
    Public key SHA-256 040db14abdabcb968e85887b1b1161a6682dba9ef72915d4126f923b733bc554
    PhishDestroy
    Addresses
    35.230.117.78 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (35.230.117.78): a cloud provider. It rents servers and addresses to its customers.
    Domain
    abundantmines.com
    Registered
    2023-03-29 · GoDaddy.com, LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-11 21:02 UTC

    Suggest a correction

  66. stellasmartnetwork.com
    ListedListed by MetaMaskRegistered 36 d ago
    DetailsHide
    Hostname
    stellasmartnetwork.com
    First seen
    2026-11-12 07:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-31 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    PhishDestroy: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 06:34 UTC to 2027-02-10 06:34 UTC
    Logged 2026-11-12 07:33 UTC in DigiCert Wyvern2027h1, entry 509,401,500
    SHA-256 2061cd15b1a8bdb13da10719754e738c64d40ca48b83fbf0d73d909db4ff3e6c
    Public key SHA-256 a1bba62454adc6fc943a37b50e315ff8408182465d13da85bc97dfb5bee11f97
    Domain
    stellasmartnetwork.com
    Registered
    2026-10-07 · Dynadot Inc
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  67. xn--mooshots-f3a.net US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    xn--mooshots-f3a.net
    First seen
    2026-11-12 07:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:34 UTC to 2027-02-10 06:34 UTC
    Logged 2026-11-12 07:32 UTC in Google PlumbersArms2027h1, entry 751,363,205
    SHA-256 45369d4fc3bcfa4a3cde9df15d4d0c96aad8d45c8f2b97b7eae61f1325d54aa2
    Public key SHA-256 c5d3e869aa727a0d1297ff2698b9de14369d13d491bcd0753df38a003f45c0bb
    PhishDestroy
    Addresses
    104.21.93.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.93.83, 172.67.207.157): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    xn--mooshots-f3a.net
    Registered
    2026-01-21 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  68. zakladyboleslawiec.shop US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    zakladyboleslawiec.shop
    First seen
    2026-11-12 07:36 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:32 UTC to 2027-02-10 06:32 UTC
    Logged 2026-11-12 07:31 UTC in IPng Networks Gouda2027h1, entry 392,250,705
    SHA-256 1308c9f28804c4b2e0735d648a8ab8d40cc1dd673bd6b369405dba04e14cc1f1
    Public key SHA-256 17885745ea5d6434dfd3cd3263b5719d1730ebcc7ddc4410fbb0b7f7cb09362a
    Addresses
    104.18.22.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.22.122): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zakladyboleslawiec.shop
    Registered
    2026-05-19 · Dynadot Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  69. zakladyboleslawiecpl.shop US · AS13335 · Cloudflare, Inc.
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    zakladyboleslawiecpl.shop
    First seen
    2026-11-12 07:36 UTC
    Listing
    CERT Polska listed it 2026-05-19 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:36 UTC to 2027-02-10 06:36 UTC
    Logged 2026-11-12 07:34 UTC in Google ParcelYard2027h1, entry 751,201,533
    SHA-256 3aa64aefb4235d4d03df56daf60ebf7a3ec4d24ddb2a14a5254fcf3013a516ff
    Public key SHA-256 a4b26cdb83a4a8abd4cdb914a80d9f8b0a0da0a80e0ea1e3134e3739e9b3961e
    Addresses
    104.18.22.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.18.22.122): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zakladyboleslawiecpl.shop
    Registered
    2026-05-19 · Dynadot Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  70. cepte-teb-pro.my-homeip.de US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by USOMMX presentSPF missingDMARC missing
    DetailsHide
    Hostname
    cepte-teb-pro.my-homeip.de
    First seen
    2026-11-12 07:32 UTC
    Listing
    USOM listed it 2026-11-12 · still listed at the last successful feed check 2026-11-12 07:32 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-11 21:38 UTC to 2027-02-09 21:38 UTC
    Logged 2026-11-11 22:36 UTC in Google PlumbersArms2027h1, entry 744,231,077
    SHA-256 34f1846b6f8e57348e3950aeb823e4167fb3237e4ab72b6e78a14c91a806e841
    Public key SHA-256 e4185d8d2588374bd22ec13145eb5661b6977e662d3ad7fb7ee0d107630c4284
    Addresses
    3.67.168.154 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (3.67.168.154): a cloud provider. It rents servers and addresses to its customers.
    Domain
    my-homeip.de
    MX
    Receives mail at mail-02.dd24.net
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 17:26 UTC

    Suggest a correction

  71. kmpynlrefsanetukenyr1o1.xyz AU · AS133618 · Trellian Pty. Limited
    ListedParking page · Above.comListed by USOMMX presentSPF -allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    kmpynlrefsanetukenyr1o1.xyz
    First seen
    2026-11-12 07:32 UTC
    Listing
    USOM listed it 2026-11-12 · still listed at the last successful feed check 2026-11-12 07:32 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 02:18 UTC to 2027-02-10 02:18 UTC
    Logged 2026-11-12 03:16 UTC in Google PlumbersArms2027h1, entry 748,293,013
    SHA-256 4f26e7f4b1d6d6317d687eef4e0f1c02dae1d5f0fddd5ae6c2e694648252b960
    Public key SHA-256 1087a9b5860d22461ced3519d5506e13180af92f6c7f3e12f025936ae207ba50
    Addresses
    103.224.212.142 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates kmpynlrefsanetukenyr1o1.xyz to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.142): a parking service. It answers for names that are typically for sale or unused.
    Domain
    kmpynlrefsanetukenyr1o1.xyz
    Registered
    2025-11-11 · Dynadot Inc
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  72. nltkamtnas.net
    ListedListed by USOMMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    nltkamtnas.net
    First seen
    2026-11-12 07:32 UTC
    Listing
    USOM listed it 2026-11-12 · still listed at the last successful feed check 2026-11-12 07:32 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-11 18:38 UTC to 2027-02-09 18:38 UTC
    Logged 2026-11-11 19:37 UTC in IPng Networks Gouda2027h1, entry 386,583,737
    SHA-256 6a4e229a1272cd421833a77276e3d7c46e54fdadb4e8d2e1b54115fc76f1eb93
    Public key SHA-256 914776c1ec26fcc62dee2eda5d0552e7ec3120a930174c25445a8c7555bbddd9
    Domain
    nltkamtnas.net
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 07:37 UTC

    Suggest a correction

  73. sahibindensatici.live US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by USOMMX absentSPF missingDMARC missingRegistered 1 d ago
    DetailsHide
    Hostname
    sahibindensatici.live
    First seen
    2026-11-12 07:32 UTC
    Listing
    USOM listed it 2026-11-12 · still listed at the last successful feed check 2026-11-12 07:32 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-11 22:11 UTC to 2027-02-09 22:11 UTC
    Logged 2026-11-11 23:10 UTC in Google PlumbersArms2027h1, entry 744,733,775
    SHA-256 06b17146c3fbef3604c37773bbc4f6a9eccc9253f087075c62f3f0dab0cee91d
    Public key SHA-256 22bc9e5d566ce2b34168a7cf7eb83f78cf9d44e37187b5b5528438a537ae4174
    Addresses
    104.21.75.27 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.166.254 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:4b1b
    2606:4700:3036::ac43:a6fe
    Cloudflare
    Cloudflare (104.21.75.27, 172.67.166.254): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    sahibindensatici.live
    Registered
    2026-11-11 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  74. sepetindevar-tr.online PA · AS52469 · Offshore Racks S.A
    ListedListed by USOMMX presentSPF ~allDMARC policy noneRegistered 1 d ago
    DetailsHide
    Hostname
    sepetindevar-tr.online
    First seen
    2026-11-12 07:32 UTC
    Listing
    USOM listed it 2026-11-12 · still listed at the last successful feed check 2026-11-12 07:32 UTC
    Listed
    USOM
    1. Certificate logged in CT
    2. Listed by USOM
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-11 21:32 UTC to 2027-02-09 21:32 UTC
    Logged 2026-11-11 22:31 UTC in Google PlumbersArms2027h1, entry 744,142,433
    SHA-256 9da8095054edd289ce6276e7c53963ca621a94cdf495e5a211ed90431d35d4cb
    Public key SHA-256 1bfb0a8d660444e1f6c8efde98a1557d0bba8e0bf16c0da864553c3009588159
    Addresses
    181.174.166.15 · Panama · AS52469 AS52469 - Offshore Racks S.A
    Domain
    sepetindevar-tr.online
    Registered
    2026-11-11 · NameSilo, LLC
    MX
    Receives mail at sepetindevar-tr.online
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  75. 815.oojusales.com US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareUnder oojusales.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 16 mo ago
    DetailsHide
    Hostname
    815.oojusales.com
    First seen
    2026-11-12 07:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing oojusales.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:30 UTC to 2027-02-10 06:30 UTC
    Logged 2026-11-12 07:28 UTC in DigiCert Sphinx2027h1, entry 452,210,822
    SHA-256 076d1867cf38c1fd7d9e2c33bf8a2b97af41253505eb1ec80d45019535fafe23
    Public key SHA-256 0a6e038ac4177268c4d10d87ff034cdb4aa6c7906e02c28dd9914c9ce834b9e5
    PhishDestroy
    Addresses
    104.21.4.68 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.18 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.4.68, 172.67.154.18): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    oojusales.com
    Registered
    2025-07-13 · Wild West Domains, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:04 UTC

    Suggest a correction

  76. governance-solv.finance US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    governance-solv.finance
    First seen
    2026-11-12 07:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-06 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 06:28 UTC to 2027-02-10 06:28 UTC
    Logged 2026-11-12 07:26 UTC in Google ParcelYard2027h1, entry 751,111,192
    SHA-256 958365ea78aa0b26939cab7775bfca17a4f8cbfdcaec9bd90a1228f1cd04a737
    Public key SHA-256 ec55e830ca92581e2f339065b9863a7f325a654d425442b989a58989801462b3
    Addresses
    104.21.29.48 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.171.103 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.29.48, 172.67.171.103): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    governance-solv.finance
    Registered
    2026-05-19 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  77. hignubk.shop US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (information services)MX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    hignubk.shop
    First seen
    2026-11-12 07:31 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-12 06:28 UTC to 2027-02-10 06:28 UTC
    Logged 2026-11-12 07:27 UTC in Google ParcelYard2027h1, entry 751,114,187
    SHA-256 527bd2f9efe6d90259e9b4a004dfdc3ac8d5c39ef1c57ea0d5017773b2c4ea22
    Public key SHA-256 449e3355ad9d8b65c755183b41cce24146e1d7f4b2afc5940df24a6f6cb66358
    Addresses
    104.21.30.4 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.150.40 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.30.4, 172.67.150.40): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hignubk.shop
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 07:32 UTC

    Suggest a correction

  78. lurkster.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 27 y ago
    DetailsHide
    Hostname
    lurkster.com
    First seen
    2026-11-12 07:31 UTC
    Listing
    CERT Polska listed it 2026-07-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:28 UTC to 2027-02-10 07:26 UTC
    Logged 2026-11-12 07:28 UTC in Google PlumbersArms2027h1, entry 751,316,309
    SHA-256 3b4446a42ca7dff224f29735f20352650d88ea1f18bc9cfb954dcb6ee7f80d39
    Public key SHA-256 301e2f5d88b35ffa8e1e36132122cb1147a73ad2f43ee2692ee8a9270fb6c80f
    Addresses
    104.21.72.146 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.72.146, 172.67.186.67): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lurkster.com
    Registered
    2000-01-15 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  79. nmxyl.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    nmxyl.com
    First seen
    2026-11-12 07:31 UTC
    Listing
    CERT Polska listed it 2026-05-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:30 UTC to 2027-02-10 06:30 UTC
    Logged 2026-11-12 07:28 UTC in Let's Encrypt Willow2027h1, entry 1,114,021,527
    SHA-256 5dc148f099978f630049cb7bc8faf2d6ec07c14242f8bdd80f24fa83fcfac9b2
    Public key SHA-256 0643098543d8496f2e2967ea5e60152dbc2f9d4a5f9710f2f0ba38a9f96b9e42
    Addresses
    104.21.33.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.158.222 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.49, 172.67.158.222): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nmxyl.com
    Registered
    2026-05-19 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  80. novosite.institutobushido.org.br US · AS31898 · Oracle Corporation
    ReportedOracle CloudUnder institutobushido.org.br, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    novosite.institutobushido.org.br
    First seen
    2026-11-12 07:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing institutobushido.org.br and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-12 06:28 UTC to 2027-02-10 06:28 UTC
    Logged 2026-11-12 07:27 UTC in IPng Networks Gouda2027h1, entry 392,227,070
    SHA-256 048e1f890278aa7a98ba9d2c9cb9daf176d6b5ce2aced61a9e9ba72dfa484eab
    Public key SHA-256 f1bcec6a98c51f4724468960d6b0bfae12300d2786c0b54e17e061e2dc27982b
    PhishDestroy
    Addresses
    162.241.203.96 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (162.241.203.96): a cloud provider. It rents servers and addresses to its customers.
    Domain
    institutobushido.org.br
    Registered
    2021-11-04
    MX
    Receives mail at mail.institutobushido.org.br
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:04 UTC

    Suggest a correction

  81. proezas.diazpabon.info US · AS398101 · GoDaddy.com, LLC
    ReportedGoDaddyReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 18 y ago
    DetailsHide
    Hostname
    proezas.diazpabon.info
    First seen
    2026-11-12 07:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-11-07 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 07:35 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 06:30 UTC to 2027-02-10 06:30 UTC
    Logged 2026-11-12 07:29 UTC in Google ParcelYard2027h1, entry 751,137,603
    SHA-256 1d8c77cc111c3cbf640410f06fb82f3b6ccebec6d290d955f0813478df46d83f
    Public key SHA-256 f628e875739552499b1b84840069d3090b5ecfb4d902321ec8064ef948a63656
    PhishDestroy
    Addresses
    208.109.75.94 · United States · AS398101 GO-DADDY-COM-LLC - GoDaddy.com, LLC · GoDaddy (shared hosting)
    GoDaddy
    GoDaddy (208.109.75.94): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    diazpabon.info
    Registered
    2008-10-01 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  82. www.lurkster.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder lurkster.com, listed by CERT PolskaMX absentSPF missingDMARC missingRegistered 27 y ago
    DetailsHide
    Hostname
    www.lurkster.com
    First seen
    2026-11-12 07:31 UTC
    Listing
    CERT Polska listed it 2026-07-10 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska, listing lurkster.com and the names under it
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:29 UTC to 2027-02-10 07:29 UTC
    Logged 2026-11-12 07:29 UTC in Google PlumbersArms2027h1, entry 751,330,023
    SHA-256 4ffe60e0b9b1ed0f1922811e6fb7a6b2577a6157014a8bf14f64bb3e827124f6
    Public key SHA-256 0ca8463ac4adf4434db8ce5c893b874a69db6773d42e79c6819457f89a76feef
    Addresses
    104.21.72.146 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.72.146, 172.67.186.67): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    lurkster.com
    Registered
    2000-01-15 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  83. www.novosite.institutobushido.org.br US · AS31898 · Oracle Corporation
    ReportedOracle CloudUnder institutobushido.org.br, reported by PhishDestroyMX presentSPF -allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    www.novosite.institutobushido.org.br
    First seen
    2026-11-12 07:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing institutobushido.org.br and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-12 06:28 UTC to 2027-02-10 06:28 UTC
    Logged 2026-11-12 07:27 UTC in IPng Networks Gouda2027h1, entry 392,227,070
    SHA-256 048e1f890278aa7a98ba9d2c9cb9daf176d6b5ce2aced61a9e9ba72dfa484eab
    Public key SHA-256 f1bcec6a98c51f4724468960d6b0bfae12300d2786c0b54e17e061e2dc27982b
    PhishDestroy
    Addresses
    162.241.203.96 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (162.241.203.96): a cloud provider. It rents servers and addresses to its customers.
    Domain
    institutobushido.org.br
    Registered
    2021-11-04
    MX
    Receives mail at mail.institutobushido.org.br
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:04 UTC

    Suggest a correction

  84. zimbrasoft.com.ua US · AS21100 · ITLDC-EU ROUTE 95 LLC
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    zimbrasoft.com.ua
    First seen
    2026-11-12 07:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:30 UTC to 2027-02-10 07:29 UTC
    Logged 2026-11-12 07:30 UTC in Google ParcelYard2027h1, entry 751,147,406
    SHA-256 6777427b291d9976cf18e8b47958a3da63c38dc4f1a4934d934c0f52043bd2b3
    Public key SHA-256 f8e600c1f5f50450ca46920b1300a3431c109d3a7394e4268fb2fdc50cf8a6aa
    PhishDestroy
    Addresses
    193.238.152.66 · United States · AS21100 ITLDC-EU ROUTE 95 LLC
    Domain
    zimbrasoft.com.ua
    Registered
    2026-01-20 · Service Online LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  85. biggamesacademy.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX presentSPF ~allDMARC policy noneRegistered 5 mo ago
    DetailsHide
    Hostname
    biggamesacademy.com
    First seen
    2026-11-12 07:26 UTC
    Listing
    CERT Polska listed it 2026-07-16 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-12 06:22 UTC to 2027-02-10 06:22 UTC
    Logged 2026-11-12 07:20 UTC in Let's Encrypt Willow2027h1, entry 1,113,926,331
    SHA-256 22a7920619fcf2bdc4732af8b28e44a9eb6143459494727117b0351e2c5d5df8
    Public key SHA-256 2a6a99c7c4b3fcf485ac43806dd2ea12b893a45053679dfc80c7ae8d70eed485
    Addresses
    104.21.89.40 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.156.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.89.40, 172.67.156.86): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    biggamesacademy.com
    Registered
    2026-06-02 · Cloudflare, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  86. boynewealthholm.click US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    boynewealthholm.click
    First seen
    2026-11-12 07:26 UTC
    Listing
    CERT Polska listed it 2026-07-22 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:24 UTC to 2027-02-10 06:24 UTC
    Logged 2026-11-12 07:22 UTC in Let's Encrypt Willow2027h1, entry 1,113,954,419
    SHA-256 ca677bda95e87c99d68b8ca8f012948d4fcfc6982a8197d744986c768cbc0e39
    Public key SHA-256 c2fb5308ce6e70ac09b771f14c588fab60ac06039907f3a2c695958b93e985d7
    Addresses
    104.21.66.215 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.164.100 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.215, 172.67.164.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    boynewealthholm.click
    Registered
    2026-05-19 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 07:30 UTC

    Suggest a correction

  87. jointbk.com US · AS53667 · FranTech Solutions
    ReportedReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 38 d ago
    DetailsHide
    Hostname
    jointbk.com
    First seen
    2026-11-12 07:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 06:24 UTC to 2027-02-10 06:24 UTC
    Logged 2026-11-12 07:23 UTC in Google ParcelYard2027h1, entry 751,074,690
    SHA-256 7699f4fabbb57b89d0cdb419300f67bb964b7cb69526890956fee4d9c7a3a89b
    Public key SHA-256 6ca74ea62d2e5b34c2ef82033f26e2562833817de70cd8270111b15e368b7204
    PhishDestroy
    Addresses
    198.251.84.200 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    jointbk.com
    Registered
    2026-10-05 · NameCheap, Inc.
    MX
    Receives mail at jointbk.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  88. update.update.update.development.discord.tattoo US · AS396982 · Google LLC
    ListedGoogle CloudUnder discord.tattoo, listed by MetaMaskMX presentSPF -allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    update.update.update.development.discord.tattoo
    First seen
    2026-11-12 07:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask, listing discord.tattoo and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL RSA DV SSL CA 2
    Valid 2026-11-12 00:00 UTC to 2027-02-10 23:59 UTC
    Logged 2026-11-12 07:21 UTC in Google Argon2027h1, entry 997,122,111
    SHA-256 3fed074812084a4e2fc591483b97e49f1dc44b2b5eb9947be1c0e2231ecd6980
    Public key SHA-256 8c0e4e8cc4386563a73e69946317e15ebaa2e82763e215b73640ddadbaaa950a
    Addresses
    34.41.139.193 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.41.139.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    discord.tattoo
    Registered
    2026-06-28 · Dynadot Inc
    MX
    Receives mail at mx1.csof.net, mx2.csof.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 00:26 UTC

    Suggest a correction

  89. www.citty.jointbk.com US · AS53667 · FranTech Solutions
    ReportedUnder jointbk.com, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 38 d ago
    DetailsHide
    Hostname
    www.citty.jointbk.com
    First seen
    2026-11-12 07:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing jointbk.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 06:24 UTC to 2027-02-10 06:24 UTC
    Logged 2026-11-12 07:23 UTC in Google ParcelYard2027h1, entry 751,074,690
    SHA-256 7699f4fabbb57b89d0cdb419300f67bb964b7cb69526890956fee4d9c7a3a89b
    Public key SHA-256 6ca74ea62d2e5b34c2ef82033f26e2562833817de70cd8270111b15e368b7204
    PhishDestroy
    Addresses
    198.251.84.200 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    jointbk.com
    Registered
    2026-10-05 · NameCheap, Inc.
    MX
    Receives mail at jointbk.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  90. apyxfinance.support US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    apyxfinance.support
    First seen
    2026-11-12 07:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:19 UTC to 2027-02-10 07:17 UTC
    Logged 2026-11-12 07:19 UTC in Google PlumbersArms2027h1, entry 751,218,700
    SHA-256 a46431b1f6e1179346df608f6315cb40979583cd2c35f6fe6654bb9c32d08872
    Public key SHA-256 743b185c42bae753dc0106cfb524714125f96d0c24846f48f60959d2700c9dd6
    Addresses
    104.21.41.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.166.215 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.41.197, 172.67.166.215): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    apyxfinance.support
    Registered
    2026-07-16 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  91. baicao.site US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    baicao.site
    First seen
    2026-11-12 07:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:18 UTC to 2027-02-10 07:16 UTC
    Logged 2026-11-12 07:18 UTC in DigiCert Wyvern2027h1, entry 509,267,269
    SHA-256 451a715c944f9f9b8737eca1555a3b6e1b65839de2207892a5ae307ec2aa7b52
    Public key SHA-256 3624dc86ed46ba1af8ea50000bd519afff73aedf6691163486a78db529a52271
    Addresses
    104.21.80.169 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.152.50 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.80.169, 172.67.152.50): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    baicao.site
    Registered
    2026-07-17 · Chengdu West Dimension Digital Technology Co., Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  92. coretific.online ZA · AS328608 · Africa on Cloud
    ReportedReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 17 mo ago
    DetailsHide
    Hostname
    coretific.online
    First seen
    2026-11-12 07:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-12 06:18 UTC to 2027-02-10 06:18 UTC
    Logged 2026-11-12 07:16 UTC in Geomys Tuscolo2027h1, entry 587,337,797
    SHA-256 2a0103819d1a59ddaa12a044cc12d98612fc12ac93cc2ee5324a6d5cf794c7da
    Public key SHA-256 0851e7cc0795387a106312603401e78c3c9d767204274d6cbe1c597c64821e14
    PhishDestroy
    Addresses
    45.197.20.7 · South Africa · AS328608 Africa on Cloud - Africa on Cloud
    Domain
    coretific.online
    Registered
    2025-06-17 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  93. docs.blockstreet.money US · AS13335 · Cloudflare, Inc.3 addresses
    ReportedCloudflareUnder blockstreet.money, reported by PhishDestroyMX presentSPF ~allDMARC rejectRegistered 16 mo ago
    DetailsHide
    Hostname
    docs.blockstreet.money
    First seen
    2026-11-12 07:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing blockstreet.money and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-12 06:17 UTC to 2027-02-10 07:11 UTC
    Logged 2026-11-12 07:17 UTC in Google ParcelYard2027h1, entry 751,002,042
    SHA-256 04a9171781074797a8fb94c35dfe6777aa10d0df8fb461cfe83cc3c3fee65acb
    Public key SHA-256 e51b13ea41f480a681aa11f8f68723c2f8ed095e34b008da9d97318a0e9fdf65
    PhishDestroy
    Addresses
    104.26.14.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    104.26.15.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.70.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.26.14.186, 104.26.15.186, 172.67.70.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    blockstreet.money
    Registered
    2025-07-15 · GoDaddy.com, LLC
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-11 08:28 UTC

    Suggest a correction

  94. elefanden.de AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    elefanden.de
    First seen
    2026-11-12 07:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-12 06:17 UTC to 2027-02-10 06:17 UTC
    Logged 2026-11-12 07:15 UTC in Google ParcelYard2027h1, entry 750,984,925
    SHA-256 6d0b3ac88a6186ef3babbc03f9baf4b6cc607cd60718825130ac2d6a26372435
    Public key SHA-256 dcf553ab2f91e5f9bfffde6c7565de4a082be847d5736997a3f5e2e780327783
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates elefanden.de to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    elefanden.de
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 07:25 UTC

    Suggest a correction

  95. ethgasfoundatoin.xyz US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    ethgasfoundatoin.xyz
    First seen
    2026-11-12 07:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-14 03:52 UTC to 2026-12-13 04:52 UTC
    Logged 2026-11-12 07:17 UTC in DigiCert Wyvern2026h2, entry 2,220,375,333
    SHA-256 390accc8467a16aafa040377dc9a21a7741b6a34c10359776c823a421ca7ba5f
    Public key SHA-256 c4be8ff149210bb589344a2f8f22aa27da9f272b77a747bac7b8a10a9d38cef9
    PhishDestroy
    Addresses
    104.21.71.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.208 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.71.122, 172.67.144.208): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethgasfoundatoin.xyz
    Registered
    2026-01-20 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 07:24 UTC

    Suggest a correction

  96. freundind.de AU · AS133618 · Trellian Pty. Limited
    ReportedParking page · Above.comReported by PhishDestroyMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    freundind.de
    First seen
    2026-11-12 07:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:17 UTC to 2027-02-10 06:17 UTC
    Logged 2026-11-12 07:15 UTC in Let's Encrypt Sycamore2027h1, entry 1,159,991,378
    SHA-256 63953d85483d6d7e00f5fab415ad0c6de354345045d958f0cc6e1f4a148d37d3
    Public key SHA-256 a2d75beea6ac5ec9854dae5fb79410e801ea137f3fd085f865bd8a03a993ac93
    PhishDestroy
    Addresses
    103.224.182.245 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
    Parking page · Above.com
    The registry delegates freundind.de to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.245): a parking service. It answers for names that are typically for sale or unused.
    Domain
    freundind.de
    MX
    Receives mail at park-mx.above.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 07:25 UTC

    Suggest a correction

  97. gielda-ofert-9192.best US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 59 d ago
    DetailsHide
    Hostname
    gielda-ofert-9192.best
    First seen
    2026-11-12 07:21 UTC
    Listing
    CERT Polska listed it 2026-09-14 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 06:50 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-12 06:20 UTC to 2027-02-10 06:20 UTC
    Logged 2026-11-12 07:18 UTC in DigiCert Sphinx2027h1, entry 452,125,587
    SHA-256 2ac376d4b0a9b98436d5190e0a2a5ccfb252c63c272764a5831b6dfcb67faa79
    Public key SHA-256 cf4f1fb1f03a434e7b2f0253909213aa0724d4865f156c4e6ec3894ead6cd697
    Addresses
    104.21.33.152 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.136 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.33.152, 172.67.146.136): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    gielda-ofert-9192.best
    Registered
    2026-09-14 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  98. happyvap.shop CN · AS45102 · Alibaba (US) Technology Co.…
    ListedAlibaba CloudListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    happyvap.shop
    First seen
    2026-11-12 07:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:19 UTC to 2027-02-10 07:18 UTC
    Logged 2026-11-12 07:19 UTC in DigiCert Sphinx2027h1, entry 452,132,231
    SHA-256 2899c47c961758eb8c9bcc151308b2ec5b72e88453f0f6263c8c683049b8c7f8
    Public key SHA-256 c5ffb8c698c9b9c84d26ff650c97ff9bcbcc1dc3c3db51d18931e2de31c48b01
    Addresses
    47.239.94.169 · China · AS45102 ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. · Alibaba Cloud (cloud provider)
    Alibaba Cloud
    Alibaba Cloud (47.239.94.169): a cloud provider. It rents servers and addresses to its customers.
    Domain
    happyvap.shop
    Registered
    2026-07-17 · GoDaddy.com LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  99. judithshopping.store
    ListedListed by NPA 165 (e-commerce)MX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    judithshopping.store
    First seen
    2026-11-12 07:21 UTC
    Listing
    NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-12 01:38 UTC
    Listed
    NPA 165
    1. Observed in the NPA 165 feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-12 06:15 UTC to 2027-02-10 07:14 UTC
    Logged 2026-11-12 07:15 UTC in Let's Encrypt Sycamore2027h1, entry 1,159,990,510
    SHA-256 80fbc22daf6a88abb96874fcb595a6b0f503f22edcaa9b349bd8f0351796d0eb
    Public key SHA-256 306bd55b1e2405e8817f4aed99521dcfc069b64d7f494c792e9c8cdc1c945faa
    Domain
    judithshopping.store
    Registered
    2026-01-21 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-12 08:13 UTC

    Suggest a correction

  100. login.staging.androidloading.com RU · AS57724 · DDOS-GUARD DDOS-GUARD LTD
    ReportedDDoS-GuardUnder androidloading.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 y ago
    DetailsHide
    Hostname
    login.staging.androidloading.com
    First seen
    2026-11-12 07:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-12 06:06 UTC
    Reported
    PhishDestroy, listing androidloading.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-12 06:16 UTC to 2027-02-10 06:16 UTC
    Logged 2026-11-12 07:15 UTC in IPng Networks Gouda2027h1, entry 392,152,052
    SHA-256 be9f1887e721c9f4e268f9cbdd52d690b8f649f409bfe865d64d829e12682266
    Public key SHA-256 dcc8d5bfc3d7548467eb6e421353226e222645bd3b357298ceaf55ba793d41df
    PhishDestroy
    Addresses
    185.178.208.191 · Russia · AS57724 DDOS-GUARD DDOS-GUARD LTD · DDoS-Guard (cdn)
    DDoS-Guard
    DDoS-Guard (185.178.208.191): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    androidloading.com
    Registered
    2023-04-19 · Center of Ukrainian Internet Names (UKRNAMES)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-11 22:38 UTC

    Suggest a correction

Showing 1–100 of 5,644 hostnames.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources