Live

Live phishing findings

New certificates and domain registrations, with every hostname resolved and checked against phishing reports and bad-address lists. The newest findings, updated hourly.

Updated hourly · 2026-11-05 10:53 UTC
Certificate-log entries · 24 h
319.2M
from 84 distinct feeds
Unique certificates · 24 h
33.4M
each reviewed
Names resolved · 24 h
21.8M
16.0M with an address
Findings · 24 h
5,465
231 of 1,061 brands targeted

3 hostnames from the last 24 hours.

  1. accessgeoenergy.com.ng.sarkinyakiforchange.com.ng BD · AS153568 · NEW DHAKA HARDWARE
    Same certificateSame certificate as accessgeoenergy.com.ng, reported by PhishDestroyMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC missing
    DetailsHide
    Hostname
    accessgeoenergy.com.ng.sarkinyakiforchange.com.ng
    First seen
    2026-11-05 00:50 UTC
    Same certificate
    Same certificate as accessgeoenergy.com.ng: reported by PhishDestroy
    Listed: resolved to 163.61.188.2 on Spamhaus DROP
    Hosting-alias name of accessgeoenergy.com.ng
    2 of 2 domains on this certificate have their own listing evidence
    Certificate 62fe61a690a8b126… · 2 domains on it · first seen 2026-11-05 00:50 UTC
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 23:47 UTC to 2027-02-02 23:47 UTC
    Logged 2026-11-05 00:46 UTC in DigiCert Wyvern2027h1, entry 409,338,680
    SHA-256 62fe61a690a8b126ae4c222a10baafae32892a2952cd9e2996edaa02be32966d
    Public key SHA-256 09ca2d9880bf345539c6a042db2c082311642149e115442c53d6258e2b9be653
    Addresses
    163.61.188.2 · Bangladesh · AS153568 NEWDHAKAHARDWARE-AS-AP - NEW DHAKA HARDWARE
    Domain
    sarkinyakiforchange.com.ng
    MX
    Receives mail at sarkinyakiforchange.com.ng
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    MX listing
    Mail server sarkinyakiforchange.com.ng at 163.61.188.2 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 163.61.188.2 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-05 01:49 UTC

    Suggest a correction

  2. www.cefxtchfk.com HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as www.cefxtbvfk.com, listed by NPA 165MX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.cefxtchfk.com
    First seen
    2026-11-04 17:45 UTC
    Same certificate
    Same certificate as www.cefxtbvfk.com: listed by NPA 165
    Listed: resolved to 103.254.108.7 on Spamhaus DROP
    3 of 3 domains on this certificate have their own listing evidence
    Certificate a3d7e57ed2314f10… · 3 domains on it · first seen 2026-11-04 17:45 UTC
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 16:37 UTC to 2027-02-02 16:37 UTC
    Logged 2026-11-04 17:36 UTC in DigiCert Sphinx2027h1, entry 357,503,567
    SHA-256 a3d7e57ed2314f102c18a7e8cc5f232ffd8f154f7ef551ce1f81f4d0107cf680
    Public key SHA-256 1183f1a40b82460f7954994043acc023ff30970cbc966a0b4c9e64a93212de08
    Addresses
    103.254.108.7 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    cefxtchfk.com
    Registered
    2026-09-05 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:05 UTC

    Suggest a correction

  3. www.cefxtfgfk.com HK · AS152194 · CTG Server Limited
    Same certificateSame certificate as www.cefxtbvfk.com, listed by NPA 165MX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.cefxtfgfk.com
    First seen
    2026-11-04 17:45 UTC
    Same certificate
    Same certificate as www.cefxtbvfk.com: listed by NPA 165
    Listed: resolved to 103.254.108.7 on Spamhaus DROP
    3 of 3 domains on this certificate have their own listing evidence
    Certificate a3d7e57ed2314f10… · 3 domains on it · first seen 2026-11-04 17:45 UTC
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 16:37 UTC to 2027-02-02 16:37 UTC
    Logged 2026-11-04 17:36 UTC in DigiCert Sphinx2027h1, entry 357,503,567
    SHA-256 a3d7e57ed2314f102c18a7e8cc5f232ffd8f154f7ef551ce1f81f4d0107cf680
    Public key SHA-256 1183f1a40b82460f7954994043acc023ff30970cbc966a0b4c9e64a93212de08
    Addresses
    103.254.108.7 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
    Domain
    cefxtfgfk.com
    Registered
    2026-09-05 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:05 UTC

    Suggest a correction

All 3 hostnames shown.
How these findings are made

Brand spoofs: findings that impersonate one of the 1,000 most-impersonated brands. The list opens on them; All shows every finding.

Reported: a hostname in a new certificate that PhishTank or PhishDestroy reports, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. When a listing source names the brand imitated or a category, the finding shows it. Phishing host: a brand lookalike that resolves to an address which hosted confirmed phishing in the last 48 hours. Spamhaus DROP: a brand lookalike that resolves to an address on the Spamhaus DROP list. Same certificate: another name on a finding's certificate that resolves to an address on Spamhaus DROP. Suspicious: other names on a finding's certificate, rated high for a hosting-alias name or a lookalike on a phishing host, medium for a lookalike; they join the findings once they have listing evidence of their own. Also under Suspicious: registered domains using a brand’s name that PhishDestroy’s community list includes, rated high when they resolve to an address with no parking or holding signal, medium otherwise.

Brand labels cover the 1,000 most-impersonated brands. A name gets a brand when the brand's token starts a label or follows a hyphen, with a lure word such as "login" or "verify" for common words. Hostnames appear as plain text. How it works · Sources