# PhishDestroy domain threat record: 84.95.177.78.forward.012.net.il

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/84.95.177.78.forward.012.net.il/
Machine-readable companion: https://phishdestroy.io/domain/84.95.177.78.forward.012.net.il/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 16:40:07 UTC
- Last availability or vendor check: 2026-10-21 01:58:30 UTC
- Stored record updated: 2026-10-22 14:20:33 UTC
- VirusTotal detections in the stored snapshot: 3/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 84.95.177.78

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/84.95.177.78.forward.012.net.il
- Certificate Transparency search: https://crt.sh/?q=%25.84.95.177.78.forward.012.net.il
- Web Archive lookup: https://web.archive.org/web/*/https://84.95.177.78.forward.012.net.il/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
84.95.177.78.forward.012.net.il is on the PhishDestroy blocklist as a suspicious domain. It is not a branded lookalike. The name embeds a raw IPv4 address under an Israeli provider's domain, the pattern ISPs use for hostnames tied to individual connections. PhishDestroy first recorded it on 2026-08-09. The site went offline on 2026-09-13 and was still unreachable with DNS inactive at the last check on 2026-10-19.

How the scam works
No impersonated brand, page title or phishing kit is tied to this host, so it cannot be pinned to a specific scheme. What the evidence does show is that security vendors treat it as a source of malicious or phishing content. Hosts like this usually serve a page that either collects logins and personal details or pushes visitors toward an action that hands control of an account or wallet to the operator. The danger lies in whatever was entered or approved while the page was live.

Evidence
On 2026-09-16, VirusTotal showed 3 of 89 engines flagging the host: CRDF, Forcepoint ThreatSeeker and VIPRE. That is a thin but independent signal from three separate vendors, and it supports our listing rather than establishing a firm verdict. PhishDestroy is the only blocklist carrying it. The low count means many browsers and filters would not have warned visitors while the site was up.

Infrastructure
The address 84.95.177.78 belongs to Partner Communications Ltd. in Israel. The 012.net.il hostname is generated by the provider for that address rather than registered separately, which points to content served from a connection inside the provider's network rather than from a purpose-bought domain. The host went dark about five weeks after PhishDestroy first saw it.

What to do
If you entered a password or other login details on this host, change that password, change it anywhere you reused it, and enable app-based two-factor authentication. If you connected a crypto wallet or signed anything there, review and revoke unfamiliar token approvals, and move funds to a fresh wallet if you shared a seed phrase. If you only visited, scan the device for unwanted downloads. Defenders should block the hostname and 84.95.177.78 at the proxy and DNS layer, search logs for past connections, and report renewed activity to Partner Communications' abuse contact.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/84.95.177.78.forward.012.net.il
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=84.95.177.78.forward.012.net.il
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:59 UTC

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:30:50Z",
        "uuid": "d7470708-4b8e-4fce-926c-4d50f42af0eb",
        "scanned_at": "2026-09-13T01:06:01Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:53:42Z",
        "analysis_at": "2026-09-16T02:00:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 3,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "information technology",
            "BitDefender": "business",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "first_seen": "2026-07-30T22:15:14Z",
        "whois": {
            "dnssec": "unsigned"
        }
    }
}
```