# PhishDestroy domain threat record: a-unclick.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/a-unclick.net/ Machine-readable companion: https://phishdestroy.io/domain/a-unclick.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-28 19:16:34 UTC - Last availability or vendor check: 2026-10-22 10:25:47 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 16/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 23.153.104.5 - Registrar in stored WHOIS data: Wild West Domains, LLC - Last stored HTTP status: 200 - Registration date (registry RDAP, a-unclick.net): 2022-12-07 00:10:02 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/a-unclick.net - Certificate Transparency search: https://crt.sh/?q=%25.a-unclick.net - Web Archive lookup: https://web.archive.org/web/*/https://a-unclick.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview a-unclick.net is a domain on the PhishDestroy blocklist that we first saw on 2026-08-28. It has not yet been assigned a specific scheme type, and no impersonated brand has been identified. When we last checked it on 2026-10-19, the site was still online and serving content. Treat any link to it as untrusted. How the scam works The page returns the title "406 Not Acceptable", a standard web server error. That differs from what a typical lure page looks like, even though the domain is blocklisted as suspicious. A server that answers some visitors with an error can still deliver different content to others, so the error alone does not show the domain is safe. The main risk from a domain flagged this widely is being led into handing over login details, personal data or crypto access on a page you did not mean to trust. Anyone who reached it through an unexpected link, ad or message should assume the visit was not legitimate. Evidence On 2026-09-13, 16 of 89 VirusTotal engines flagged the domain. Those vendors include ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, ESET, Forcepoint ThreatSeeker, Fortinet and G-Data. Several of them are large commercial vendors working independently, which carries more weight than a single isolated hit. The domain also appears in four AlienVault OTX threat pulses, so other researchers have tied it to tracked malicious activity. Infrastructure The domain was registered on 2022-12-07 through Wild West Domains, LLC, nearly four years before PhishDestroy picked it up. A name that sat quietly for that long before drawing detections may have changed purpose or ownership along the way. It is hosted in the US on the Aquiryn LLC network at 23.153.104.5. Its Let's Encrypt certificate gives it a padlock in the browser, which only means the connection is encrypted, not that the site is trustworthy. What to do Do not enter credentials, personal details or wallet information on this domain, and close any page from it that asks for them. If you already typed a password there, change it on the real service and on any account that reuses it, then turn on two-factor authentication. If you supplied card or identity details, contact your bank and watch for misuse. Security teams should block the domain and its IP at the DNS and proxy level. They should also search logs for past connections to it and report fresh sightings so detections keep pace. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/a-unclick.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=a-unclick.net Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:48:51 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4d10c248-c43e-4dcf-a67e-329dcadab722.png Captured: 2026-09-12 19:31:48 UTC Source report: https://radar.cloudflare.com/scan/4d10c248-c43e-4dcf-a67e-329dcadab722 SHA-256: 9370aecbdaa7d76e963af8831c259fac87773f36f9c3768d4254a7c76842453c - URLScan · 2026-08-28: https://screenshots.phishdestroy.io/us/01a049d1-d914-74dd-89e2-8e64966a0a31.png Captured: 2026-08-28 19:21:31 UTC Source report: https://urlscan.io/result/01a049d1-d914-74dd-89e2-8e64966a0a31/ SHA-256: 7e144e40338aeaa577e55cb583d06fb429001bab73d605226e76677b862b747a - URLScan · 2026-08-28: https://screenshots.phishdestroy.io/us/01a049da-cb46-75bd-810f-2c700926bef4.png Captured: 2026-08-28 19:31:20 UTC Source report: https://urlscan.io/result/01a049da-cb46-75bd-810f-2c700926bef4/ SHA-256: 7e144e40338aeaa577e55cb583d06fb429001bab73d605226e76677b862b747a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:30:47Z", "uuid": "4d10c248-c43e-4dcf-a67e-329dcadab722", "scanned_at": "2026-09-12T19:31:48Z", "final_url": "https://a-unclick.net/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://a-unclick.net/", "status": 307 }, { "url": "https://a-unclick.net/", "status": 200 } ], "dom_hash": "ad4f1e2de607c3030f7e9a203fa765f68c3c349f87951a043624df58f904a967", "doc_hash": "0ab06aa341b69d41af2cf6486409235a8fa594c703b111d9a946544d6575e9c6", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "a-unclick.net", "type": "A", "value": "23.153.104.5" } ], "dnssec_valid": false, "ip": "23.153.104.5", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Wild West Domains, LLC", "created": "2022-12-07T00:10:02Z", "updated": "2026-08-16T01:30:31Z", "expires": "2026-12-07T00:10:02Z", "nameservers": [ "ns1.my-control-panel.com", "ns2.my-control-panel.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:53:30Z", "analysis_at": "2026-10-21T23:21:37Z", "stats": { "timeout": 0, "harmless": 42, "malicious": 15, "suspicious": 3, "undetected": 32 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "ADMINUSLabs": "malicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "created": "2022-12-07T00:00:00Z", "updated": "2025-12-08T00:00:00Z", "first_seen": "2023-11-04T02:27:50Z", "dns": [ { "ttl": 21600, "type": "SOA", "rname": "lmendoza2412.gmail.com", "value": "ns1.my-control-panel.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.my-control-panel.com" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:192.168.168.2 +ip4:23.153.104.5 ~all" }, { "ttl": 14400, "type": "A", "value": "23.153.104.5" }, { "ttl": 14400, "type": "MX", "value": "a-unclick.net", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns1.my-control-panel.com" } ], "dns_at": "2026-10-21T23:22:56Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "*.a-unclick.net", "a-unclick.net" ], "issuer": "Let's Encrypt / YR2", "serial": "699e2bcf94a07ecf3cb8f121c44d2adaef8", "sha256": "e1fd608287343a5ed92ab76474e1b9cc0ee9d2a90c793bcf34b72c5c3cf37c5d", "subject": "a-unclick.net", "valid_to": "2027-01-14T09:23:38Z", "valid_from": "2026-10-16T09:23:39Z" }, "rdap": { "status": [ "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2026-12-07T00:10:02Z", "last changed": "2026-08-16T01:30:31Z", "registration": "2022-12-07T00:10:02Z", "last update of RDAP database": "2026-10-21T23:22:35Z" }, "registrar": "Wild West Domains, LLC", "registrar_iana_id": "440" } } } ```